WO2023051409A1 - 一种通信方法及装置 - Google Patents

一种通信方法及装置 Download PDF

Info

Publication number
WO2023051409A1
WO2023051409A1 PCT/CN2022/120943 CN2022120943W WO2023051409A1 WO 2023051409 A1 WO2023051409 A1 WO 2023051409A1 CN 2022120943 W CN2022120943 W CN 2022120943W WO 2023051409 A1 WO2023051409 A1 WO 2023051409A1
Authority
WO
WIPO (PCT)
Prior art keywords
pdu
mac
mac sub
sub
security processing
Prior art date
Application number
PCT/CN2022/120943
Other languages
English (en)
French (fr)
Inventor
徐小英
娄崇
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2023051409A1 publication Critical patent/WO2023051409A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/03—Protecting confidentiality, e.g. by encryption
    • H04W12/033—Protecting confidentiality, e.g. by encryption of the user plane, e.g. user's traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/041—Key generation or derivation
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/10—Integrity
    • H04W12/106—Packet or message integrity

Definitions

  • the present application relates to the technical field of communication, and in particular to a communication method and device.
  • Wireless communication transmission is divided into user plane transmission and control plane transmission.
  • User plane transmission is mainly used to transmit user plane data
  • control plane transmission is mainly used to transmit control plane signaling.
  • the sending end and the receiving end can perform safe processing on user plane data and control plane signaling.
  • the sending end encrypts the data, and correspondingly, the receiving end decrypts the data to prevent the data from being read by a third party;
  • the sending end performs integrity protection processing on the data, and correspondingly, the receiving end verifies the integrity of the data processing to prevent data from being tampered with by third parties.
  • user plane transmission can also be used to transmit user plane control information. Since some user plane control information is more important, if it is used by illegal base stations or terminals to falsify or monitor related user plane control information, it will cause great security risks to wireless communications. Therefore, how to control user plane information Safe handling still needs further research.
  • the present application provides a communication method and device, which are used to implement security processing on user plane control information and improve the security of user plane control information.
  • the communication method provided in this application may be executed by two communication devices, which are respectively a first communication device and a second communication device.
  • the first communication device is a sending end, configured to execute the first security processing
  • the second communication device is a receiving end, configured to execute the second security processing.
  • the second security processing is a reverse process of the first security processing, for example, the first security processing includes encryption processing and/or integrity protection processing, and the second security processing includes decryption processing and/or integrity verification processing.
  • the first communication device may be an access network device or a chip set in the access network device, or may also be a DU or a chip set in the DU
  • the second communication device may be a terminal device or a chip set in the DU.
  • a chip set in the terminal device or, the first communication device may be a terminal device or a chip set in the terminal device, and the second communication device may be an access network device or a chip set in the access network device, or It can be a DU or a chip set in a DU.
  • the embodiment of the present application provides a communication method, which can be applied to the first communication device.
  • the first communication device performs the first security processing on the user plane control information at the MAC layer to obtain the MAC PDU , and send the MAC PDU to the second communication device;
  • the MAC PDU includes N first MAC sub-PDUs and M second MAC sub-PDUs, and each first MAC sub-PDU corresponds to at least one second MAC sub-PDU PDU, the first MAC sub-PDU is used by the second communication device to perform second security processing on the second MAC sub-PDU corresponding to the first MAC sub-PDU, and the M second MAC sub-PDUs include the User plane control information or the first user plane control information after first security processing; N and M are integers greater than or equal to 1.
  • the MAC PDU generated by the first communication device performing the first security processing on the user plane control information may include N first MAC sub-PDUs and M second MAC sub-PDUs
  • the N first MAC sub-PDUs are additional
  • the generated MAC sub-PDUs used to protect the M second MAC sub-PDUs, so that the user plane control information can be safely processed, while the existing MAC PDU format is less affected, and the MAC sub-PDU can be flexibly implemented.
  • One or more MAC CEs or MAC SDUs in the PDU are processed securely.
  • the user plane control information includes M MAC CEs and/or MAC SDUs, where the MAC SDUs include control PDUs from the PDCP layer, control PDUs from the RLC layer, or control PDUs from the SDAP layer .
  • the user plane control information includes at least one of the following: a MAC CE generated by the MAC layer; a control PDU from the PDCP layer; a control PDU from the RLC layer; and a control PDU from the SDAP layer.
  • the first MAC sub-PDU includes indication information, and the indication information is used to indicate a second MAC sub-PDU corresponding to the first MAC sub-PDU.
  • the indication information is carried in the MAC subheader of the first MAC sub-PDU, or the indication information is carried in the MAC CE of the first MAC sub-PDU.
  • the MAC subheader of the first MAC sub-PDU includes a preset logical channel identifier, and the preset logical channel identifier is used to indicate that the MAC sub-PDU including the preset logical channel identifier
  • the PDU is the first MAC sub-PDU.
  • the MAC CE of the first MAC sub-PDU includes at least one of the following: the sequence number of the second MAC sub-PDU corresponding to the first MAC sub-PDU; The count value of the second MAC sub-PDU; the integrity protection parameter of the second MAC sub-PDU corresponding to the first MAC sub-PDU.
  • the method further includes: the first communication device sends enabling information to the second communication device, and the enabling information is used to enable the second communication device
  • the first security processing and/or the second security processing are performed at the MAC layer; in this way, the first communication device can flexibly control whether the second communication device enables the security processing function.
  • the method further includes: receiving notification information from the second communication device, where the notification information is used to notify that the second security processing of the second MAC sub-PDU included in the MAC PDU fails, the The notification information includes the logical channel identifier corresponding to the second MAC sub-PDU that fails the second security process and/or the number of the second MAC sub-PDUs that fail the second security process.
  • the method further includes: receiving enabling information from the second communication device, where the enabling information is used to enable the second communication device to perform the The first security processing and/or the second security processing.
  • the first communication device performs first security processing on the user plane control information at the MAC layer, including: the first communication device uses the first key to perform the first security processing on the user plane control information at the MAC layer The first security process, the first key is deduced according to at least one of the second key, the third key, and the fourth key; wherein the second key is used to deduce the A third key and the fourth key, the third key is used to perform the first security processing or the second security processing on the control plane signaling, and the fourth key is used to perform the second security processing on the user plane data A security treatment or a second security treatment.
  • the first key used by the first communication device for security processing at the MAC layer is different from the key used for security processing at the PDCP layer (control plane signaling, user plane data, etc. are all security processing at the PDCP layer).
  • key so that in the CU-DU separation architecture, the key isolation of the CU and the DU can be realized, and the security of the CU cannot be guaranteed after the first key used by the DU is stolen.
  • the embodiment of the present application provides a communication method, which can be applied to the second communication device, and in this method, the second communication device receives a MAC PDU from the first communication device, and the MAC PDU includes N
  • the first MAC sub-PDU and M second MAC sub-PDUs each of the first MAC sub-PDUs corresponds to at least one second MAC sub-PDU
  • the M second MAC sub-PDUs include user plane control information or have undergone first security processing After the first user plane control information, N and M are integers greater than or equal to 1;
  • the second communication device performs the MAC layer corresponding to the first MAC sub-PDU according to the first MAC sub-PDU
  • the second MAC sub-PDU performs second security processing.
  • the user plane control information includes at least one of the following: a MAC CE generated by the MAC layer; a control PDU from the PDCP layer; a control PDU from the RLC layer; and a control PDU from the SDAP layer.
  • the first MAC sub-PDU includes indication information, and the indication information is used to indicate a second MAC sub-PDU corresponding to the first MAC sub-PDU.
  • the indication information is carried in the MAC subheader of the first MAC sub-PDU, or the indication information is carried in the MAC CE of the first MAC sub-PDU.
  • the MAC subheader of the first MAC sub-PDU includes a preset logical channel identifier, and the preset logical channel identifier is used to indicate that the MAC sub-PDU including the preset logical channel identifier
  • the PDU is the first MAC sub-PDU.
  • the MAC CE of the first MAC sub-PDU includes at least one of the following: the sequence number of the second MAC sub-PDU corresponding to the first MAC sub-PDU; The count value of the second MAC sub-PDU; the integrity protection parameter of the second MAC sub-PDU corresponding to the first MAC sub-PDU.
  • the method further includes: receiving enabling information from the first communication device, where the enabling information is used to enable the second communication device to perform the first security processing and/or said second security processing.
  • the method further includes: receiving notification information from the second communication device, where the notification information is used to notify the second security processing of the second MAC sub-PDU included in the MAC PDU Failure, the notification information includes the logical channel identifier corresponding to the second MAC sub-PDU that failed the second security process and/or the number of the second MAC sub-PDU that failed the second security process.
  • the method further includes: the second communication device sending enabling information to the first communication device, where the enabling information is used to enable the first communication device to The first security processing and/or the second security processing are performed.
  • the second communication device performs second security processing on the second MAC sub-PDU corresponding to the first MAC sub-PDU at the MAC layer according to the first MAC sub-PDU, including: The second communication device performs second security processing on the second MAC sub-PDU corresponding to the first MAC sub-PDU at the MAC layer by using a first key according to the first MAC sub-PDU, and the first key is Derived according to at least one of the second key, the third key, and the fourth key; wherein, the second key is used to derive the third key and the fourth key, The third key is used to perform the first security processing or the second security processing on the control plane signaling, and the fourth key is used to perform the first security processing or the second security processing on the user plane data.
  • an embodiment of the present application provides a communication system, which may include a first communication device and a second communication device, wherein the first communication device is used to perform the method described in the first aspect above, and the second communication device The device is used to execute the method described in the second aspect above.
  • the embodiment of the present application provides a communication system, which may include a CU and a DU; the CU is used to: determine the first key, and send the first key to the DU; the DU is used to: receive the The first key is used to perform first security processing and/or second security processing at the MAC layer.
  • the DU is specifically used to: use the first key to perform first security processing on the user plane control information at the MAC layer, obtain a MAC PDU, and send the MAC PDU to the terminal device; wherein, The MAC PDU includes N first MAC sub-PDUs and M second MAC sub-PDUs, each first MAC sub-PDU corresponds to at least one second MAC sub-PDU, and the first MAC sub-PDU is used for the second
  • the communication device performs second security processing on the second MAC sub-PDU corresponding to the first MAC sub-PDU, and the M second MAC sub-PDUs include the user plane control information or the encrypted first user plane control information.
  • Information N and M are integers greater than or equal to 1.
  • the DU is specifically used to: receive a MAC PDU from a terminal device, the MAC PDU includes N first MAC sub-PDUs and M second MAC sub-PDUs, and each first MAC sub-PDU corresponds to At least one second MAC sub-PDU, the M second MAC sub-PDUs include user plane control information or the first user plane control information after the first security processing, where N and M are integers greater than or equal to 1; According to the first MAC sub-PDU, performing second security processing on the second MAC sub-PDU corresponding to the first MAC sub-PDU at the MAC layer by using the first key.
  • the CU is specifically configured to: receive a second key from a core network element; derive a third key and a fourth key according to the first key, and the third key It is used to perform the first security processing or the second security processing on the control plane signaling, and the fourth key is used to perform the first security processing or the second security processing on the user plane data; according to the second key, the Deriving at least one of the third key and the fourth key to obtain the first key.
  • the present application provides a communication device, the communication device has the function of realizing the above first aspect, for example, the communication device includes a corresponding module or unit or means (means) for performing the operations involved in the above first aspect , the modules or units or means may be realized by software, or by hardware, or by executing corresponding software by hardware.
  • the communication device includes a processing unit and a communication unit, wherein the communication unit can be used to send and receive signals to realize communication between the communication device and other devices, for example, the communication unit is used to receive signals from Configuration information of the terminal device; the processing unit can be used to perform some internal operations of the communication device.
  • the functions performed by the processing unit and the communication unit may correspond to the operations involved in the first aspect above.
  • the communication device includes a processor, and the processor can be used to be coupled with the memory.
  • the memory may store necessary computer programs or instructions to realize the functions referred to in the first aspect above.
  • the processor may execute the computer program or instruction stored in the memory, and when the computer program or instruction is executed, the communication device may implement the method in any possible design or implementation manner in the first aspect above.
  • the communication device includes a processor and a memory, and the memory can store necessary computer programs or instructions for realizing the functions mentioned in the above first aspect.
  • the processor may execute the computer program or instruction stored in the memory, and when the computer program or instruction is executed, the communication device may implement the method in any possible design or implementation manner in the first aspect above.
  • the communication device includes a processor and an interface circuit, where the processor is used to communicate with other devices through the interface circuit, and perform any possible design or implementation in the first aspect above. method.
  • the present application provides a communication device, which is capable of realizing the functions involved in the above-mentioned second aspect, for example, the communication device includes a module or unit or means corresponding to performing the operations involved in the above-mentioned second aspect, the The above functions, units or means can be realized by software, or by hardware, or by executing corresponding software by hardware.
  • the communication device includes a processing unit and a communication unit, wherein the communication unit can be used to send and receive signals to realize communication between the communication device and other devices, for example, the communication unit is used to send The device sends system information; the processing unit can be used to perform some internal operations of the communication device.
  • the functions performed by the processing unit and the communication unit may correspond to the operations involved in the second aspect above.
  • the communication device includes a processor, and the processor can be used to be coupled with the memory.
  • the memory may store necessary computer programs or instructions to realize the functions referred to in the second aspect above.
  • the processor may execute the computer program or instruction stored in the memory, and when the computer program or instruction is executed, the communication device may implement the method in any possible design or implementation manner of the second aspect above.
  • the communication device includes a processor and a memory, and the memory can store necessary computer programs or instructions for realizing the functions mentioned in the second aspect above.
  • the processor may execute the computer program or instruction stored in the memory, and when the computer program or instruction is executed, the communication device may implement the method in any possible design or implementation manner of the second aspect above.
  • the communication device includes a processor and an interface circuit, where the processor is used to communicate with other devices through the interface circuit, and execute the method in any possible design or implementation of the second aspect above .
  • the processor can be implemented by hardware or by software.
  • the processor can be a logic circuit, an integrated circuit, etc.; when implemented by software
  • the processor may be a general-purpose processor, which is realized by reading software codes stored in the memory.
  • there may be one or more processors, and one or more memories.
  • the memory can be integrated with the processor, or the memory can be separated from the processor.
  • the memory and the processor can be integrated on the same chip, or they can be respectively arranged on different chips.
  • the embodiment of the present application does not limit the type of the memory and the arrangement of the memory and the processor.
  • the present application provides a computer-readable storage medium, where computer-readable instructions are stored in the computer-readable medium, and when a computer reads and executes the computer-readable instructions, the computer executes the above-mentioned first aspect or A method in any of the possible designs of the second aspect.
  • the present application provides a computer program product.
  • the computer executes the method in any possible design of the first aspect or the second aspect above.
  • the present application provides a chip, the chip includes a processor, the processor is coupled with a memory, and is used to read and execute a software program stored in the memory, so as to realize the above-mentioned first aspect or second Aspects of any one of the possible design methods.
  • FIG. 1 is a schematic diagram of a network architecture applicable to an embodiment of the present application
  • FIG. 2A is a schematic diagram of the transmission of downlink data between layers provided by the embodiment of the present application.
  • FIG. 2B is a schematic structural diagram of a physical module of a base station provided in an embodiment of the present application.
  • FIG. 2C is a schematic diagram of the CU-DU separation architecture provided by the embodiment of the present application.
  • FIG. 3A is a schematic diagram of integrity protection/verification processing provided by the embodiment of the present application.
  • Fig. 3B is a schematic diagram of the composition of the MAC PDU provided by the embodiment of the present application.
  • FIG. 3C is a schematic diagram of the composition of the MAC sub-header provided by the embodiment of the present application.
  • FIG. 3D is a schematic diagram of the key hierarchy provided by the embodiment of the present application.
  • FIG. 4 is a schematic diagram of security processing provided by the embodiment of the present application.
  • FIG. 5 is a schematic flowchart corresponding to a communication method provided in an embodiment of the present application.
  • FIG. 6A, FIG. 6B, and FIG. 6C are schematic diagrams of the positional relationship between the first MAC sub-PDU and the second MAC sub-PDU provided by the embodiment of the present application;
  • FIG. 7A, FIG. 7B, and FIG. 7C are schematic diagrams of the content contained in the first MAC sub-PDU and the second MAC sub-PDU provided by the embodiment of the present application;
  • FIG. 8 is another schematic flowchart corresponding to the communication method provided in the embodiment of the present application.
  • FIG. 9 is a possible exemplary block diagram of a device involved in an embodiment of the present application.
  • FIG. 10 is a schematic structural diagram of an access network device provided in an embodiment of the present application.
  • FIG. 11 is a schematic structural diagram of a terminal device provided in an embodiment of the present application.
  • FIG. 1 is a schematic structural diagram of a communication system applicable to an embodiment of the present application.
  • the communication system 1000 includes a radio access network (radio access network, RAN) 100 and a core network (core network, CN) 200, optionally, the communication system 1000 may also include a data network (data network, DN) ).
  • radio access network radio access network
  • core network core network
  • DN data network
  • the RAN100 may include at least one radio access network device (also referred to as an access network device, such as 110a and 110b in Figure 1), and may also include at least one terminal device (such as 120a-120j in Figure 1), the terminal device It can be connected with wireless access network equipment in a wireless manner.
  • the terminal device and the terminal device and the access network device and the access network device may be connected to each other in a wired or wireless manner.
  • CN200 may include multiple core network elements, and wireless access network equipment may be connected to the core network elements in a wireless or wired manner.
  • the core network element and the radio access network device can be independent and different physical devices, or the functions of the core network element and the logical functions of the radio access network device can be integrated on the same physical device, or they can be a
  • the physical device integrates some functions of core network elements and some functions of radio access network devices.
  • a terminal device may also be called a terminal, a user equipment (user equipment, UE), a mobile station, a mobile terminal, and the like.
  • Terminal devices can be widely used in various scenarios, such as device-to-device (D2D), vehicle-to-everything (V2X) communication, machine-type communication (MTC), Internet of Things (internet of things, IOT), virtual reality, augmented reality, industrial control, automatic driving, telemedicine, smart grid, smart furniture, smart office, smart wear, smart transportation, smart city, etc.
  • Terminal devices can be mobile phones, tablet computers, computers with wireless transceiver functions, wearable devices, vehicles, drones, helicopters, airplanes, ships, robots, robotic arms, smart home devices, etc.
  • the embodiment of the present application does not limit the specific technology and specific device form adopted by the terminal device.
  • the access network equipment can be a base station (base station), an evolved base station (evolved NodeB, eNodeB), a transmission reception point (transmission reception point, TRP), a next generation base station (next generation NodeB, gNB) in a 5G communication system, a first The next-generation base station in the sixth generation (6th generation, 6G) communication system, the base station in the future communication system, or the access node in the WiFi system, etc.; it can also be a module or unit that completes the function of the base station.
  • the access network device may be a macro base station (such as 110a in Figure 1), a micro base station or an indoor station (such as 110b in Figure 1), or a relay node or a donor node.
  • the embodiment of the present application does not limit the specific technology and specific equipment form adopted by the access network equipment.
  • the access network equipment and the terminal equipment may be fixed or mobile. Access network equipment and terminal equipment can be deployed on land, including indoor or outdoor, handheld or vehicle-mounted; they can also be deployed on water; they can also be deployed on aircraft, balloons and artificial satellites in the air.
  • the embodiments of the present application do not limit the application scenarios of the access network device and the terminal device.
  • the roles of access network equipment and terminal equipment can be relative.
  • the helicopter or drone 120i in FIG. 1 can be configured as a mobile access network equipment.
  • 120j 120i is an access network device; but for access network device 110a, 120i is a terminal device, that is, communication between 110a and 120i is performed through a wireless air interface protocol.
  • communication between 110a and 120i may also be performed through an interface protocol between access network devices.
  • 120i is also an access network device. Therefore, both the access network equipment and the terminal equipment can be collectively referred to as communication devices, 110a and 110b in FIG. 1 can be referred to as communication devices with access network equipment functions, and 120a-120j in FIG. functional communication device.
  • the functions of the access network equipment may also be performed by modules (such as chips) in the access network equipment, or may be performed by a control subsystem including the functions of the access network equipment.
  • the control subsystem including the functions of the access network equipment may be the control center in the above application scenarios such as smart grid, industrial control, intelligent transportation, and smart city.
  • the functions of the terminal may also be performed by a module (such as a chip or a modem) in the terminal, or may be performed by a device including the terminal function.
  • the control plane protocol layer structure may include radio resource control (radio resource control, RRC) layer, packet data convergence protocol (packet data convergence protocol, PDCP ) layer, radio link control (radio link control, RLC) layer, media access control (media access control, MAC) layer and physical layer (physical layer, PHY);
  • the user plane protocol layer structure may include PDCP layer, RLC layer , a MAC layer, and a physical layer.
  • a service data adaptation protocol (service data adaptation protocol, SDAP) layer may also be included above the PDCP layer.
  • the SDAP layer, the PDCP layer, the RLC layer, the MAC layer, and the physical layer may also be collectively referred to as an access layer.
  • 3GPP 3rd generation partnership project
  • the data transmission needs to pass through the user plane protocol layer, such as the SDAP layer, PDCP layer, RLC layer, MAC layer, and physical layer.
  • the downlink data transmission is taken as an example.
  • Figure 2A is a schematic diagram of the downlink data transmission between layers. After the SDAP layer entity obtains the data from the upper layer, it can identify (QoS flow indicator, QFI) according to the quality of service (QoS) of the data.
  • QFI quality of service
  • the PDCP layer entity can transmit the data to at least one RLC layer entity corresponding to the PDCP layer entity, and then the at least one RLC layer entity is transmitted to the corresponding MAC layer entity, and then the MAC layer Entities generate transport blocks, which are then wirelessly transmitted by corresponding physical layer entities.
  • the data is encapsulated correspondingly in each layer.
  • the data received by a certain layer from the upper layer of the layer is regarded as the service data unit (service data unit, SDU) of the layer, which becomes a protocol data unit (protocol data unit) after layer encapsulation. unit, PDU), and then passed to the next layer.
  • SDU service data unit
  • PDU protocol data unit
  • the data received by the PDCP layer entity from the upper layer is called PDCP SDU, and the data sent by the PDCP layer entity to the lower layer is called PDCP PDU; the data received by the RLC layer entity from the upper layer is called RLC SDU, and the data sent by the RLC layer entity to the lower layer It is called RLC PDU.
  • data can be transmitted between different layers through corresponding channels, for example, data can be transmitted between RLC layer entities and MAC layer entities through a logical channel (logical channel, LCH), and between MAC layer entities and physical layer entities can be transmitted through Transport channel (transport channel) to transmit data.
  • LCH logical channel
  • Transport channel transport channel
  • the centralized unit (CU)-distributed unit (DU) separation architecture is a new base station architecture introduced in the 5G communication system.
  • each base station is independently deployed and connected to the 4G core network; while in the 5G architecture, the DUs of different base stations are deployed independently, but the CUs of different base stations can be deployed centrally, that is, multiple DUs can be deployed by one CU Centralized control, where the CU is connected to the core network, and the DU is connected to the CU through the F1 interface.
  • the base station is divided into baseband unit (baseband unit, BBU), remote radio unit (remote radio unit, RRU) and antenna modules, each base station There is a set of BBUs, which are directly connected to the core network through the BBUs; in a possible design of the 5G communication system, the original RRU and the antenna are combined into an active antenna unit (active antenna unit, AAU), while the BBU is split Into DU and CU, each base station has a set of DU, and then multiple sites share the same CU for centralized management.
  • BBU baseband unit
  • RRU remote radio unit
  • the CU can include the functions of the PDCP layer, the SDAP layer, and the RRC layer, and the DU can include the functions of the RLC layer and the MAC layer. functions and some functions of the PHY layer.
  • a DU may include functions of higher layers in the PHY layer.
  • the high-level functions in the PHY layer may include cyclic redundancy check (cyclic redundancy check, CRC) function, channel coding, rate matching, scrambling, modulation, and layer mapping; or, the high-level functions in the PHY layer may include cyclic Redundancy checking, channel coding, rate matching, scrambling, modulation, layer mapping and precoding.
  • the functions of the middle and lower layers of the PHY layer can be implemented by another network entity (not shown in Figure 2C) that is independent from the DU, wherein the functions of the middle and lower layers of the PHY layer can include precoding, resource mapping, physical antenna mapping and radio frequency functions; or , the functions of the lower layers in the PHY layer may include resource mapping, physical antenna mapping and radio frequency functions.
  • the embodiment of the present application does not limit the function division of the upper layer and the lower layer in the PHY layer.
  • the signaling generated by the CU can be sent to the terminal device through the DU, or the signaling generated by the terminal device can be sent to the CU through the DU.
  • the DU can directly encapsulate the signaling through the protocol layer and transparently transmit it to the terminal device or CU without parsing the signaling.
  • the sending or receiving of the signaling by the DU includes this scenario.
  • signaling at the RRC or PDCP layer will eventually be processed as physical layer data and sent to the terminal device, or converted from received physical layer data.
  • the signaling at the RRC or PDCP layer can also be considered to be sent by the DU, or sent by the DU and the radio frequency device.
  • FIG. 1 is only a schematic diagram, and the communication system may also include other network devices, such as wireless relay devices and wireless backhaul devices.
  • the sending end and the receiving end can perform safe processing on user plane data and control plane signaling.
  • the security processing of the access layer can be performed at the PDCP layer, that is, the sending end performs security processing on the user plane data or control plane signaling at the PDCP layer, such as encryption or integrity protection; the receiving end also performs security processing on the user plane at the PDCP layer.
  • Corresponding security processing is performed on data or control plane signaling, such as decryption or integrity verification, etc., and integrity verification may also be referred to as integrity verification.
  • the sending end is a terminal device, and the receiving end is an access network device; or, the sending end is an access network device, and the receiving end is a terminal device.
  • the encryption process means that the sending end converts the data plaintext into ciphertext through calculation and processing according to the input parameters such as the key
  • the decryption process means that the receiving end converts the ciphertext into data plaintext.
  • Integrity protection processing means that the sender calculates the integrity protection parameters (such as parameter A) through algorithms according to input parameters such as data packets and keys; The algorithm calculates the parameter B. If the parameters A and B are consistent, the integrity verification is successful. If the parameters A and B are inconsistent, the integrity verification fails. When the input parameters used by the sending end are the same as those used by the receiving end, it can be realized that the integrity-protected information at the sending end can be successfully verified by the receiving end.
  • the integrity protection parameters such as parameter A
  • the algorithm calculates the parameter B. If the parameters A and B are consistent, the integrity verification is successful. If the parameters A and B are inconsistent, the integrity verification fails.
  • Fig. 3A it shows the process of integrity protection/verification through 5G security algorithm (integrity algorithm for 5G, NIA), wherein, the input parameters of integrity protection/verification may include count value, key, Information (such as the message itself to be integrity protected/verified), transmission direction (such as uplink transmission direction or downlink transmission direction), radio bearer identification, where the output parameter obtained from the integrity protection process (ie parameter A) may include complete message authentication code-integrity (MAC-I), and the output parameter (ie, parameter B) obtained by the integrity verification process may include an expected message authentication code-integrity (XMAC-I ). If the parameters MAC-I and XMAC-I are consistent, the integrity verification is successful; if the parameters MAC-I and XMAC-I are inconsistent, the integrity verification fails.
  • 5G security algorithm integrated protocol for 5G, NIA
  • Wireless communication transmission is divided into user plane transmission and control plane transmission.
  • User plane transmission can be used to transmit user plane data and user plane control information.
  • Control plane transmission can be used to transmit control plane signaling.
  • Control plane signaling can include RRC signaling. Order and so on.
  • the user plane data may refer to a user plane data PDU, and the user plane data PDU is used to carry communication content data.
  • the user plane data PDUs may include data PDUs of various protocol layers, such as SDAP data PDUs, PDCP data PDUs, RLC data PDUs, and the like.
  • the user plane control information may refer to the user plane control PDU.
  • the user plane control PDU is used to carry the control information that assists the transmission of the user plane data PDU, such as status report, robust header compression (robust header compression, RoHC) feedback, Ethernet header Compression (ethernet header compression, EHC) feedback.
  • the user plane control PDU may include control PDUs of various protocol layers, such as SDAP control PDU, PDCP control PDU, RLC control PDU, and the like.
  • control information such as a MAC control element (control element, CE) and a control PDU of a new protocol layer that may be defined in a future communication system.
  • the MAC PDU can be divided into downlink MAC PDU and uplink MAC PDU.
  • Figure 3B includes a schematic diagram of the composition of a downlink MAC PDU and an uplink MAC PDU.
  • the MAC PDU is composed of at least one MAC sub-PDU (MAC subPDU).
  • MAC subPDU MAC sub-PDU
  • the MAC layer can use the RLC PDU as a MAC SDU and encapsulate it into a MAC sub-PDU.
  • the MAC layer can generate a MAC CE and encapsulate it into a MAC sub-PDU.
  • the MAC sub-PDU may also include padding bits.
  • the MAC layer can combine multiple MAC sub-PDUs into a complete MAC PDU through the multiplexing function.
  • each MAC sub-PDU can also include a MAC sub-header (303).
  • Figure 3C is a schematic diagram of the MAC sub-header. As shown in Figure 3C, for a fixed-size MAC CE, the MAC sub-header can include field R and logical channel Identification (logical channel ID, LCID), where the field R is a reserved field. For a variable-sized MAC CE, the MAC subheader may include a field R, a field F, a logical channel identifier, and a field L, wherein the field F is a format field, and the field L is used to indicate the length of the MAC CE.
  • LCID logical channel Identification
  • the keys used in security processing are divided into non-access stratum keys and access stratum keys, and K AMF is the root key for deriving non-access stratum and access stratum.
  • the non-access stratum key is divided into non-access stratum integrity protection key K NASint and non-access stratum encryption key K NASenc ;
  • the access stratum key is divided into base station key K gNB , RRC Integrity protection key K RRCint , RRC encryption key K RRCenc , user plane integrity protection key K UPint , user plane encryption key K UPenc .
  • the RRC integrity protection key K RRCint the RRC encryption key K RRCenc , the user plane integrity protection key K UPint , and the user plane encryption key K Upenc are derived based on base station keys and different security algorithms. key.
  • the sender can perform encryption processing on the control plane signaling and user plane data PDU, and can further perform integrity protection processing on the control plane signaling, but does not support integrity protection processing on the user plane data PDU.
  • the 5G communication system considering the security of the user plane data PDU, a technical solution for integrity protection of the user plane data PDU and SDAP control PDU is introduced. That is to say, as shown in Figure 4, RRC signaling can be encrypted and integrity protected at the PDCP layer, PDCP data PDUs carried by data can be encrypted and integrity protected at the PDCP layer, and SDAP control PDUs can be supported at the PDCP layer. Integrity protection.
  • security processing has not yet been performed.
  • MAC CE may be used to control terminal equipment to switch serving cells. Once a fake base station counterfeit MAC layer switching signaling, it will cause wrong switching.
  • the embodiment of the present application provides a communication method, that is, the sending end can securely process the user plane control information at the MAC layer to obtain a MAC PDU, and send it to the receiving end; correspondingly, after the receiving end receives the MAC PDU, Corresponding security processing can be performed at the MAC layer, so that the security processing of the user plane control information can be implemented, and the security of the user plane control information can be improved.
  • the security processing performed by the sending end is referred to as the first security processing
  • the security processing performed by the receiving end is referred to as the second security processing.
  • the second security processing is the inverse process of the first security processing, such as the first security processing is encryption processing, then the second security processing can be decryption processing; for another example, the first security processing is integrity protection processing, then the second security processing is
  • the security processing may be integrity verification processing; for another example, the first security processing includes encryption processing and integrity protection processing, and the second security processing may include decryption processing and integrity verification processing.
  • the sending end may be the first communication device, and the receiving end may be the second communication device.
  • the first communication device may be an access network device or a communication device capable of supporting the access network device to implement the functions required by the method, such as a chip or a chip system set in the access network device;
  • the second communication The device may be a terminal device or a communication device capable of supporting the terminal device to implement the functions required by the method, such as a chip or a chip system provided in the terminal device.
  • the access device described below for executing the embodiment shown in Figure 5 may be the access network device in the system architecture shown in Figure 1 (such as the base station 110a), the terminal device described below for executing the embodiment shown in FIG. 5 may be a terminal device (such as the terminal device 120a) in the system architecture shown in FIG. 1 .
  • FIG. 5 is a schematic flowchart corresponding to the communication method provided in Embodiment 1 of the present application. As shown in FIG. 5, the method includes:
  • the access network device sends enabling information to the terminal device, where the enabling information is used to enable the terminal device to perform first security processing and/or second security processing at a MAC layer.
  • the terminal device receives enabling information from the access network device.
  • the enabling information is used to enable the terminal device to perform the first security processing and the second security processing at the MAC layer as an example.
  • the enabling information is used to enable the terminal device to perform the first security processing and the second security processing at the MAC layer In the second security processing, it may also be described as that the enabling information is used to enable the terminal device to perform security processing at the MAC layer.
  • the enabling information may be information of Boolean type. When the value is true (TURE), it means that the terminal device is allowed to perform the first security processing and the second security processing at the MAC layer (that is, enable the security processing function), When the value is false (FALSE), it means that the terminal device is not allowed to perform the first security processing and the second security processing at the MAC layer (that is, disable the security processing function).
  • the enabling information may also be information of an enumeration type.
  • allowing the terminal device to perform the first security processing and the second security processing at the MAC layer may refer to: when the terminal device acts as the sending end, allowing the terminal device to perform the first security processing at the MAC layer; and, when the terminal device acts as the receiving end When the terminal is used, the terminal device is allowed to perform the second security processing at the MAC layer.
  • the access network device may send the enabling information to the terminal device in various possible ways, for example, sending the enabling information through a configuration message, and the configuration message may be an RRC reconfiguration message.
  • the access network device may also send indication information to the terminal device, for example, sending indication information through a configuration message, where the indication information is used to indicate which user plane control information needs to be subjected to the first security processing.
  • the indication information may include type information of the user plane control information that requires the first security processing, where the type of the user plane control information may be divided according to the protocol layer, for example, the control PDU from the SDAP layer, the control PDU from the The control PDU of the PDCP layer, the control PDU from the RLC layer, the MAC CE generated by the MAC layer, etc.
  • the indication information indicates that the control PDU from the PDCP layer needs to be subjected to the first security processing
  • the MAC layer after receiving the RLC data PDU containing the PDCP control PDU, it can be learned that the RLC data PDU contains The PDCP controls the PDU, and then performs the first security processing on the RLC data PDU (that is, the MAC SDU).
  • the indication information may include a logical channel identifier, and the MAC CE corresponding to the logical channel identifier needs to perform the first security processing.
  • the terminal device can enable the security processing function, and then for downlink transmission, the access network device can perform the first security process at the MAC layer, and the terminal device can perform the second security process at the MAC layer.
  • the terminal device For details, see S503 to S505:
  • the terminal device For uplink transmission, the terminal device may perform the first security process at the MAC layer, and the access network device may perform the second security process at the MAC layer.
  • S506 to S508 For details, refer to S506 to S508.
  • the access network device performs first security processing on the first user plane control information at the MAC layer to obtain a first MAC PDU.
  • the first MAC PDU may include N first MAC sub-PDUs and M second MAC sub-PDUs, where N and M are integers greater than or equal to 1.
  • Each first MAC sub-PDU corresponds to at least one second MAC sub-PDU, and the second MAC sub-PDUs corresponding to different first MAC sub-PDUs are different, that is, N may be less than or equal to M.
  • the first MAC sub-PDU may be called a secure MAC sub-PDU
  • the second MAC sub-PDU may be called a protected MAC sub-PDU
  • the MAC CE included in the first MAC sub-PDU may be called Secure MAC CE
  • the MAC CE (or MAC SDU) included in the second MAC sub-PDU can be called a protected MAC CE (or MAC SDU).
  • the first MAC PDU includes X MAC sub-PDUs, and X is an integer
  • X can be greater than the sum of N and M, that is, except for N first MAC sub-PDUs and M second MAC sub-PDUs
  • the first MAC PDU can also include other MAC sub-PDUs, and other MAC sub-PDUs can be unprotected MAC sub-PDUs; or, X can also be equal to the sum of N and M, that is, except N first MAC sub-PDUs and M Except for the second MAC sub-PDU, the first MAC PDU does not include other MAC sub-PDUs.
  • the first MAC sub-PDU and the second MAC sub-PDU are introduced respectively below.
  • the first MAC sub-PDU is used by the terminal device to perform the second security processing on the second MAC sub-PDU corresponding to the first MAC sub-PDU.
  • the first MAC sub-PDU corresponds to a second MAC sub-PDU, and the first MAC sub-PDU is used by the terminal device to perform the second security processing on the second MAC sub-PDU; two MAC sub-PDUs, the first MAC sub-PDU is used by the terminal device to perform the second security processing on the multiple second MAC sub-PDUs.
  • the first MAC sub-PDU may include indication information, and the indication information is used to indicate the second MAC sub-PDU corresponding to the first MAC sub-PDU.
  • the indication information may be carried in the MAC sub-header of the first MAC sub-PDU, such as occupying some or all bits of the R field in the MAC sub-header; or, the indication information is carried in the MAC CE of the first MAC sub-PDU.
  • the MAC subheader of the first MAC sub-PDU may include a preset logical channel identifier. If the MAC subheader of a certain MAC sub-PDU includes a preset logical channel identifier, it indicates that the MAC sub-PDU is the first MAC sub-PDU.
  • the preset logical channel identifier is used to indicate that the MAC sub-PDU is the first MAC sub-PDU (or security MAC sub-PDU), or described as, the preset logical channel identifier is used to indicate that the MAC sub-PDU includes security MAC CE, or described as, the preset logical channel identifier is used to indicate that the MAC sub-PDU is a MAC sub-PDU for performing the second security processing on the second MAC sub-PDU.
  • the first MAC sub-PDU may include some or all of the input parameters and/or some or all of the output parameters (such as integrity protection parameters) of the first security process, which will be described in detail later.
  • the M second MAC sub-PDUs may include the first user plane control information or the first user plane control information after the first security processing.
  • the first user plane control information includes M MAC CEs and/or MAC SDUs, or the first user plane control information includes M MAC sub-PDUs; wherein, the MAC SDUs may include control PDUs from the PDCP layer and PDUs from the RLC layer. Control PDU or Control PDU from SDAP layer.
  • the M second MAC sub-PDUs may include encrypted first user plane control information; if the first security processing is integrity protection processing, then the M second MAC sub-PDUs The first user plane control information may be included; if the first security processing includes encryption processing and integrity protection processing, the M second MAC sub-PDUs may include the encrypted first user plane control information.
  • the first user plane control information includes MAC CE1; if the first security processing includes encryption processing and integrity protection processing, the second MAC sub-PDU may include MAC CE1' (MAC CE1' is encrypted Processed MAC CE1).
  • the first user plane control information includes MAC sub-PDU1
  • MAC sub-PDU1 includes MAC CE1 or MAC SDU1
  • the second MAC sub-PDU It may be MAC sub-PDU1' (MAC sub-PDU1' is encrypted MAC sub-PDU1).
  • the first user plane control information includes MAC CE1 and MAC CE2; if the first security processing includes encryption processing and integrity protection processing, then one of the second MAC sub-PDUs may include MAC CE1', Another second MAC sub-PDU may include MAC CE2' (MAC CE2' is encrypted MAC CE2).
  • the first user plane control information includes MAC sub-PDU1 and MAC sub-PDU2, MAC sub-PDU1 includes MAC CE1 or MAC SDU1, and MAC sub-PDU2 includes MAC CE2 or MAC SDU2; if the first security process includes Encryption processing and integrity protection processing, then one of the second MAC sub-PDUs can be MAC sub-PDU1', and the other second MAC sub-PDU can be MAC sub-PDU2' (MAC sub-PDU2' is the encrypted MAC sub-PDU2 ).
  • the first MAC sub-PDU may be located before all the second MAC sub-PDUs corresponding to the first MAC sub-PDU.
  • the receiving end such as a terminal device
  • the receiving end can know which MAC sub-PDUs are the second MAC sub-PDU according to the indication information included in the first MAC sub-PDU, and then parse the second MAC sub-PDU
  • the second security processing can be performed immediately after the PDU, so that no time delay is introduced and the processing efficiency is improved.
  • the first MAC sub-PDU may also be located after all second MAC sub-PDUs corresponding to the first MAC sub-PDU.
  • the first MAC PDU includes a first MAC sub-PDU1, and the first MAC sub-PDU1 corresponds to the second MAC sub-PDU1.
  • the first MAC sub-PDU1 is adjacent to the second MAC sub-PDU1, and the first MAC sub-PDU1 can be located before the second MAC sub-PDU1, or the first MAC sub-PDU1 can also be located in the second MAC sub-PDU1 after.
  • the first MAC PDU includes a first MAC sub-PDU1 and a first MAC sub-PDU2, the first MAC sub-PDU1 corresponds to the second MAC sub-PDU1, and the first MAC sub-PDU2 corresponds to the second MAC sub-PDU2.
  • the first MAC sub-PDU1 is adjacent to the second MAC sub-PDU1, and the first MAC sub-PDU2 is adjacent to the second MAC sub-PDU2; the first MAC sub-PDU1 can be located before the second MAC sub-PDU1, or, The first MAC sub-PDU1 may also be located after the second MAC sub-PDU1; the first MAC sub-PDU2 may be located before the second MAC sub-PDU2, or the first MAC sub-PDU2 may also be located after the second MAC sub-PDU2.
  • the first MAC PDU includes a first MAC sub-PDU1, and the first MAC sub-PDU1 corresponds to the second MAC sub-PDU1a, the second MAC sub-PDU1b, and the second MAC sub-PDU1c.
  • the first MAC sub-PDU1 may be adjacent to the second MAC sub-PDU1a, and located before the second MAC sub-PDU1a, the second MAC sub-PDU1b and the second MAC sub-PDU1c; or, the first MAC sub-PDU1 may be adjacent to the second MAC sub-PDU1a
  • the second MAC sub-PDU1c is adjacent and located behind the second MAC sub-PDU1a, the second MAC sub-PDU1b and the second MAC sub-PDU1c.
  • the first MAC sub-PDU may include indication information, and the indication information is used to indicate the second MAC sub-PDU corresponding to the first MAC sub-PDU.
  • indication information is used to indicate the second MAC sub-PDU corresponding to the first MAC sub-PDU.
  • the indication information may include 1 bit. For example, when the value of this bit is 0, it indicates that the second MAC sub-PDU corresponding to the first MAC sub-PDU is a MAC sub-PDU after the first MAC sub-PDU in the first MAC PDU.
  • PDU (for example, refer to the diagram shown above the dotted line in Figure 6A); when the value of this bit is 1, it means that the second MAC sub-PDU corresponding to the first MAC sub-PDU is located in the first MAC sub-PDU in the first MAC PDU A previous MAC sub-PDU (see, for example, the diagram illustrated below the dotted line in FIG. 6A ).
  • the indication information may include two bits. For example, when the value of the two bits is 00, it means that the second MAC sub-PDU corresponding to the first MAC sub-PDU is all MAC sub-PDUs in the first MAC PDU except the first MAC sub-PDU.
  • Sub-PDU when the value of the two bits is 01, it means that the second MAC sub-PDU corresponding to the first MAC sub-PDU is located before the first MAC sub-PDU in the first MAC PDU and adjacent to the first MAC sub-PDU A MAC sub-PDU; when the value of the two bits is 10, it means that the second MAC sub-PDU corresponding to the first MAC sub-PDU is located after the first MAC sub-PDU in the first MAC PDU and is the same as the first MAC sub-PDU An adjacent MAC sub-PDU; when the value of the two bits is 11, it means that the second MAC sub-PDU corresponding to the first MAC sub-PDU is all MACs containing MAC CE in the MAC PDU except the first MAC sub-PDU Sub-PDUs.
  • the indication information may indicate a value K, indicating that the second MAC sub-PDU corresponding to the first MAC sub-PDU is K MAC sub-PDUs located before or after the first MAC sub-PDU in the first MAC PDU.
  • K a value indicating that the second MAC sub-PDU corresponding to the first MAC sub-PDU is K MAC sub-PDUs located before or after the first MAC sub-PDU in the first MAC PDU.
  • whether it is "before” or “after” may be pre-agreed by the protocol, or it may be notified by the sender to the receiver, or it may be indicated by an additional bit (for example, the value of this bit is 0 means "before", and a value of 1 means “after”; or vice versa).
  • the number of bits included in the indication information may be set according to actual needs.
  • the indication information may include a variable-length bitmap, and a bit in the bitmap corresponds to a MAC sub-PDU in the first MAC PDU.
  • the bits in the bitmap correspond to the first MAC in sequence from low to high.
  • Each MAC sub-PDU from left to right in the PDU that is, the lowest bit in the bitmap corresponds to the first MAC sub-PDU from the left in the first MAC PDU, and so on, the highest bit in the bitmap Corresponds to the first MAC sub-PDU from the right in the first MAC PDU.
  • the bits in the bitmap correspond to the MAC sub-PDUs from right to left in the first MAC PDU in order from low to high, that is, the lowest bit in the bitmap corresponds to the sub-PDUs from the right in the first MAC PDU.
  • the highest bit in the bitmap corresponds to the first MAC sub-PDU from the left in the first MAC PDU.
  • a bit in the bitmap has a value of 1, indicating that the MAC sub-PDU corresponding to the bit is the second MAC sub-PDU corresponding to the first MAC sub-PDU, and a value of 0, indicating that the MAC sub-PDU corresponding to the bit is not the first MAC sub-PDU.
  • the bits in the bitmap correspond to the MAC sub-PDUs in the first MAC PDU.
  • the bits in the bitmap can be related to the bits in the first MAC PDU.
  • the second MAC sub-PDUs in a MAC PDU correspond one-to-one.
  • the bits in the bitmap correspond to the second MAC sub-PDUs from left to right in the first MAC PDU in sequence from low to high.
  • the indication information may include an offset of each second MAC sub-PDU corresponding to the first MAC sub-PDU relative to the first MAC sub-PDU. For example, if the first MAC sub-PDU corresponds to the second MAC sub-PDU1, the indication information may include the first offset of the head of the second MAC sub-PDU1 relative to the head or tail of the first MAC sub-PDU, and the second MAC A second offset of the tail of sub-PDU1 relative to the head or tail of the first MAC sub-PDU.
  • the unit of the first offset and the second offset may be the number of bits or the number of bytes.
  • the first offset and the second offset can be negative; if the second MAC sub-PDU1 is located after the first MAC sub-PDU, the first offset Amount and second offset can be positive values.
  • the indication information may include an offset of each second MAC sub-PDU corresponding to the first MAC sub-PDU relative to the first MAC sub-PDU and a length of the second MAC sub-PDU. For example, if the first MAC sub-PDU corresponds to the second MAC sub-PDU1, the indication information may include the offset of the head of the second MAC sub-PDU1 relative to the head or tail of the first MAC sub-PDU and the offset of the second MAC sub-PDU. length.
  • the first MAC sub-PDU can still be determined according to the offset.
  • the first MAC sub-PDU may not include indication information, and in this case, the position of the second MAC sub-PDU corresponding to the first MAC sub-PDU may be stipulated through a protocol.
  • the second MAC sub-PDU corresponding to the first MAC sub-PDU is: a MAC sub-PDU adjacent to the first MAC sub-PDU and located before the first MAC sub-PDU.
  • "before” can also be replaced with “after”.
  • the second MAC sub-PDU corresponding to the first MAC sub-PDU includes: all MAC sub-PDUs before the first MAC sub-PDU.
  • “before” can also be replaced with “after”.
  • the second MAC sub-PDU corresponding to the first MAC sub-PDU is: all MAC sub-PDUs containing MAC CE before the first MAC sub-PDU.
  • “before” can also be replaced with “after”.
  • the first MAC PDU includes a first MAC sub-PDU
  • the second MAC sub-PDU corresponding to the first MAC sub-PDU is stipulated by the agreement as: the first MAC PDU included, except the first MAC sub-PDU All MAC sub-PDUs.
  • the first MAC PDU includes a first MAC sub-PDU
  • the second MAC sub-PDU corresponding to the first MAC sub-PDU is stipulated by the agreement as: the first MAC PDU included, except the first MAC sub-PDU All MAC sub-PDUs containing MAC CE.
  • the first security processing performed by the access network device on the first user plane control information is introduced below.
  • the input parameters used by the access network device to perform the first security processing on the first user plane control information may include at least one of the following: a first key; User plane control information; security processing parameters used to prevent replay; logical channel identification corresponding to the first user plane control information; transmission direction; preset logical channel identification in the MAC subheader of the first MAC sub-PDU; synchronization An identifier of a signal block (synchronization signal block, SSB); an identifier of a serving cell that sends the first user plane control information; an identifier of a set of control resources used to schedule the first user plane control information.
  • a signal block synchronization signal block, SSB
  • the first key may include a first subkey, or include a second subkey, or include a first subkey and a second subkey.
  • the first subkey is used to perform encryption/decryption processing on the first user plane control information at the MAC layer
  • the second subkey is used to perform integrity protection/verification processing on the first user plane control information at the MAC layer.
  • the first key may reuse an existing access layer key, for example, the first subkey is K UPenc , the second subkey is K UPint , and for example, the first subkey is K RRCenc , the second subkey is K RRCint .
  • the first key reuses the existing access layer key, there is no need to additionally determine the first key, which can effectively reduce the processing burden and speed up the efficiency of security processing.
  • the security processing parameters used to prevent replay may include at least one of the following: the sequence number (sequence number, SN) of the first user plane control information, the count value of the first user plane control information, and the time of the first user plane control information
  • the timestamp can be the lower N bits of the system frame number.
  • the sequence number can be maintained by the MAC layer for each MAC sub-PDU, and the MAC layer of the receiving end maintains the sequence number in the same way, so as to ensure that the sequence numbers determined by both sides are consistent.
  • Multiple MAC sub-PDUs can share a sequence number.
  • a MAC PDU corresponds to a sequence number
  • multiple MAC sub-PDUs included in the MAC PDU share the sequence number.
  • the serial number of the first user plane control information may refer to the serial number of the second MAC sub-PDU1
  • the second MAC sub-PDU1 includes MAC CE1 or MAC CE1' (MAC CE1' It is the encrypted MAC CE1).
  • the sequence number (or count value) of the second MAC sub-PDU1 can also be described as the sequence number (or count value) of MAC CE1 or MAC CE1'.
  • the count value may be maintained by the MAC layer for each MAC sub-PDU, or may be maintained for the MAC PDU.
  • the MAC entity at the sending end can maintain a count value for each data packet (such as a MAC sub-PDU), and when sending data, the sending end performs the first security processing in sequence according to the count value of the data packet in ascending order
  • the MAC entity at the receiving end maintains the count value for each data packet with the same calculation method, so as to ensure that when the data packet is submitted to the upper layer, the second security processing is performed in sequence according to the order of the count value of the data packet from small to large.
  • the count value of the MAC sub-PDU is determined according to the serial number of the MAC sub-PDU and the hyper frame number (hyper frame number, HFN) of the MAC layer, wherein the HFN of the MAC layer is determined by the access network device And the terminal equipment maintains itself, the initial value is 0, when the sequence number of the MAC sub-PDU reaches the maximum value, HFN is incremented by 1.
  • the input parameters for the first security processing of different data packets may be the same, resulting in the same output parameters. Therefore, from the receiver's point of view, duplicate packets are received. In this case, if the sender sends a data packet, other illegal base stations or terminals may forge a duplicate data packet and send it, but the receiver will mistakenly think that the sender sent a duplicate data packet, and cannot recognize Forged packets.
  • security processing parameters such as count values
  • the input parameters and output parameters of the first security processing for different data packets are also different, so that it can effectively Prevent illegal base stations or terminals from forging duplicate data packets.
  • the relevant implementation of the above S503 will be introduced in combination with two situations.
  • the first user plane control information includes a MAC CE (such as MAC CE1).
  • the access network device may perform first security processing (such as encryption processing and integrity protection processing) on MAC CE1 at the MAC layer to obtain MAC CE1' and integrity protection parameter 1 (such as MAC-I1), and then Use MAC CE1' as the load of the MAC sub-PDU, add a MAC sub-header, and encapsulate it into a MAC sub-PDU.
  • This MAC sub-PDU is the second MAC sub-PDU, which can be called the second MAC sub-PDU1.
  • the access network device encapsulates some or all of the input parameters (such as SN1 of MAC CE1) and integrity protection parameter 1 of the first security process into a MAC sub-PDU, and the MAC sub-PDU is the first MAC sub-PDU, which can be It is called the first MAC sub-PDU1.
  • the MAC subheader of the first MAC sub-PDU1 may include a preset logical channel identifier
  • the MAC CE may include SN1 and MAC-I1.
  • the MAC-I included in the first MAC sub-PDU may also be replaced with a truncated MAC-I.
  • the length of the truncated MAC-I may be predefined by a protocol, or the sending end may send the length of the truncated MAC-I to the receiving end. In this embodiment of the present application, description is made by taking the first MAC sub-PDU including MAC-I as an example.
  • the access network device can use MAC CE1 as the load of MAC sub-PDU1, and add a MAC sub-header to encapsulate it as MAC sub-PDU1, and then perform the first security processing on the MAC sub-PDU1 at the MAC layer (such as encryption processing and integrity protection processing), obtain MAC sub-PDU1' (being encrypted MAC sub-PDU1), integrity protection parameter 1 (such as MAC-I1), wherein, MAC sub-PDU1' is the second MAC
  • the sub-PDU may be called the second MAC sub-PDU1.
  • the access network device encapsulates some or all of the input parameters (such as SN1 of MAC CE1) and integrity protection parameter 1 of the first security process into a MAC sub-PDU, and the MAC sub-PDU is the first MAC sub-PDU, which can be It is called the first MAC sub-PDU1.
  • the access network device performs the first security processing on the first user plane control information (such as MAC CE) at the MAC layer, which may mean that the access network device performs the first security processing on the MAC CE at the MAC layer, or It may mean that the access network device performs first security processing on the MAC sub-PDU including the MAC CE at the MAC layer.
  • the first user plane control information such as MAC CE
  • the first user plane control information includes multiple MAC CEs (such as MAC CE1, MAC CE2).
  • the access network device can perform first security processing (such as encryption processing and integrity protection processing) on MAC CE1 at the MAC layer to obtain MAC CE1' and integrity protection parameter 1 (such as MAC-I1), Then MAC CE1' is used as the load of the MAC sub-PDU, and a MAC sub-header is added, and it is encapsulated into the second MAC sub-PDU1. Further, the access network device encapsulates part or all of the input parameters (such as SN1 of MAC CE1) and integrity protection parameter 1 of the first security process into the first MAC sub-PDU1.
  • first security processing such as encryption processing and integrity protection processing
  • the access network device can perform encryption processing and integrity protection processing on MAC CE2 at the MAC layer to obtain MAC CE2' and integrity protection parameter 2 (such as MAC-I2), and then use MAC CE2' as the load of the MAC sub-PDU , and add a MAC sub-header, and encapsulate it as the second MAC sub-PDU2. Further, the access network device encapsulates part or all of the input parameters (such as SN2 of MAC CE2) and integrity protection parameters 2 of the first security process into the first MAC sub-PDU2.
  • MAC CE2' and integrity protection parameter 2 such as MAC-I2
  • the access network device can independently perform the first security processing for each MAC CE (or a MAC sub-PDU containing the MAC CE) among the multiple MAC CEs, and for each An additional security MAC sub-PDU is added for each MAC CE.
  • the sequence numbers or count values of multiple MAC CEs can be the same or different.
  • the access network device can perform first security processing (such as encryption processing and integrity protection processing) on MAC CE1 and MAC CE2 at the MAC layer to obtain MAC CE1', MAC CE2', and integrity protection parameters a (such as MAC-Ia), and then use MAC CE1 ' as the load of the MAC sub-PDU, and increase a MAC sub-head, it is encapsulated as the second MAC sub-PDU1, and use MAC CE2 ' as the load of the MAC sub-PDU, and increase A MAC sub-header, which is encapsulated into a second MAC sub-PDU2.
  • first security processing such as encryption processing and integrity protection processing
  • the access network device encapsulates some or all of the input parameters of the first security process (such as SN1 of MAC CE1, where SN2 and SN1 of MAC CE2 are the same) and integrity protection parameter a into the first MAC sub-PDU1.
  • the access network device can perform the first security processing on multiple MAC CEs (such as MAC CE1 and MAC CE2), or the access network device can also perform the first security processing on multiple MAC CEs (such as MAC CE1 and MAC CE2).
  • Multiple MAC sub-PDUs (such as MAC sub-PDU1 containing MAC CE1 and MAC sub-PDU2 containing MAC CE2) are combined to perform the first security processing, thereby effectively saving the processing burden and improving the efficiency of security processing; and for multiple MAC CEs, It only needs to add an additional security MAC sub-PDU, which can effectively reduce the transmission overhead.
  • the sequence numbers or count values of multiple MAC CEs are the same, that is, they share one sequence number or count value, so as to facilitate the combined execution of the first security processing.
  • the access network device sends the first MAC PDU to the terminal device.
  • the terminal device receives the first MAC PDU from the access network device, and performs second security processing on the second MAC sub-PDU included in the first MAC PDU.
  • the terminal device performing the second security processing on the second MAC sub-PDU may refer to: the terminal device performs the second security processing on the second MAC sub-PDU as a whole, or may also refer to the terminal device performing the second security processing on the second MAC sub-PDU.
  • the load section undergoes a second security treatment. Specifically, if the access network device performs the first security processing on the MAC CE or MAC SDU, the terminal device can perform the second security processing on the payload of the second MAC sub-PDU; After performing the first security processing on the PDU, the terminal device may perform the second security processing on the entire second MAC sub-PDU.
  • the terminal device may send a message to the access network device
  • the notification information is used to notify that the second security processing of the second MAC sub-PDU included in the first MAC PDU fails.
  • the notification information may include the logical channel identifier corresponding to the second MAC sub-PDU that failed the second security process and/or the number of the second MAC sub-PDU that failed the second security process (or the number of the second MAC sub-PDU that failed the second security process frequency).
  • the failure of the second security processing performed by the terminal device on the second MAC sub-PDU indicates that there may be a security problem in the transmission of user plane control information. Therefore, the terminal device notifies the access network device of the failure of the second security processing, which facilitates Access network devices perform corresponding operations to improve security.
  • the terminal device performs first security processing on the second user plane control information at the MAC layer to obtain a second MAC PDU.
  • the second user plane control information refers to the above description about the first user plane control information.
  • the difference between the two is only that the second user plane control information is uplink user plane control information, while the first user plane control It is downlink user plane control information.
  • the second MAC PDU please refer to the above description about the first MAC PDU.
  • the difference between the two is only that the second MAC PDU is an uplink MAC PDU, while the first MAC PDU is a downlink MAC PDU.
  • MAC CE1 includes a buffer status report (buffer status report, BSR), since the content of the BSR needs to be determined according to the contents of other MAC sub-PDUs included in the second MAC PDU Therefore, the MAC sub-PDU containing MAC CE1 is generated later and will be arranged after other MAC sub-PDUs; if the MAC sub-PDU containing MAC CE1 needs to perform the first security processing together with other MAC sub-PDUs (for specific implementation, refer to the previous Implementation mode 2), then their corresponding first MAC sub-PDUs can be arranged at the end of the second MAC PDU.
  • BSR buffer status report
  • the terminal device sends the second MAC PDU to the access network device.
  • the access network device receives the first MAC PDU from the terminal device, and performs second security processing on the second MAC sub-PDU included in the second MAC PDU.
  • the terminal device when the access network device performs the second security processing on the second MAC sub-PDU included in the second MAC PDU, if it is determined that the second security processing of a certain second MAC sub-PDU fails, the terminal device may be released.
  • the RRC connection enables the terminal device to enter the idle state from the RRC connection state, or perform other possible operations, depending on the internal implementation of the access network device, which is not limited in this embodiment of the present application.
  • the MAC PDU generated may include N first MAC sub-PDUs and M second MAC sub-PDUs, N
  • the first MAC sub-PDU is an additionally generated MAC sub-PDU used to protect the M second MAC sub-PDUs, so that the user plane control information can be safely processed while the existing MAC PDU format is less affected , and can flexibly implement security processing on one or more MAC CEs or MAC SDUs in the MAC PDU.
  • the first MAC sub-PDU does not participate in the first security processing.
  • the first MAC sub-PDU may also participate in the first security processing.
  • the first security processing is integrity protection processing
  • the first MAC sub-PDU can also perform integrity protection processing together with the second MAC sub-PDU, and then output the integrity protection parameters, which can be carried in the In a MAC sub-PDU. If this method is adopted, for the terminal equipment, the integrity protection parameters can be taken out from the first MAC sub-PDU first, and then the first MAC sub-PDU (not including the integrity protection parameters) and the second MAC sub-PDU can be performed Integrity verification processing.
  • the access network device and the terminal device may agree in advance whether the first MAC sub-PDU participates in the first security process, or indicate in other ways whether the first MAC sub-PDU participates in the first security process.
  • the second MAC sub-PDU corresponding to the first MAC sub-PDU may also include the first MAC sub-PDU itself.
  • the above-described security processing parameters for preventing replay are optional input parameters for the first security processing. If the security processing parameters for preventing replay are not used during the first security processing, that is, the first If the input parameters of a security process do not include the security process parameters for preventing replay, the corresponding SN does not need to be carried in the first MAC sub-PDU in each of the above examples.
  • the access network device may also include separate nodes, as shown in FIG. 2B and FIG. 2C .
  • the access network device mentioned above in FIG. 5 can also be replaced by a DU, that is, the DU can perform the operations performed by the access network device in FIG. 5 .
  • the MAC layer is located in the DU.
  • the DU is deployed outdoors, and the physical security is poorer than that of the CU. Therefore, in order to further improve Security, in this embodiment of the application, the first key used by the DU to perform security processing at the MAC layer may be different from the key used by the CU to perform security processing.
  • FIG. 8 is a schematic flowchart corresponding to the communication method provided in the embodiment of the present application. As shown in FIG. 8, the method includes:
  • the CU receives a second key from a core network element.
  • the core network element may be an access and mobility management function (access and mobility management function, AMF) network element
  • the second key may include a base station key K gNB and/or a next hop (next hop, NH)
  • NH can refer to the definition in the existing protocol.
  • the CU deduces a third key and a fourth key according to the first key, the third key is used to perform the first security processing or the second security processing on the control plane signaling, and the fourth key is used to Perform the first security processing or the second security processing on the user plane data.
  • the third key may include the RRC integrity protection key K RRCint and/or the RRC encryption key K RRCenc
  • the fourth key may include the user plane integrity protection key K UPint and/or the user plane encryption key K UPenc .
  • the CU derives the first key according to at least one of the second key, the third key, and the fourth key.
  • the CU may perform deduction one or more times according to at least one of the second key, the third key, and the fourth key to obtain the first key.
  • the deduction here can be understood as the process of performing specific operations according to the input parameters and the security algorithm to obtain the output parameters.
  • the input parameters include at least one of the second key, the third key, and the fourth key
  • the output parameters are
  • the security algorithm may be a newly introduced security algorithm of the MAC layer.
  • non-access layer encryption algorithm As shown in Table 1, currently available algorithm types include non-access layer encryption algorithm, non-access layer integrity protection algorithm, RRC layer encryption algorithm, RRC layer integrity protection algorithm, user plane encryption algorithm 1.
  • the integrity protection algorithm of the user plane On this basis, the embodiment of the present application may introduce a security algorithm of the MAC layer, such as an encryption algorithm of the MAC layer and an integrity protection algorithm of the MAC layer.
  • Table 1 Examples of various security algorithm types
  • the CU may derive the first key according to the second key and the security algorithm of the MAC layer.
  • the CU may derive the first key according to the third key and the security algorithm of the MAC layer; or, the CU may derive the first key according to the third key and the random number.
  • the CU may derive the first key according to the fourth key and the security algorithm of the MAC layer; or, the CU may derive the first key according to the fourth key and the random number.
  • the CU sends the first key to the DU.
  • the CU can send the first key to the DU through a user context setup request (UE context setup request) message or a user context modification request (UE context modification request) message.
  • UE context setup request user context setup request
  • UE context modification request user context modification request
  • the DU receives the first key from the CU, and uses the first key to perform first security processing or second security processing at the MAC layer.
  • the DU can use the first key to perform first security processing on the first user plane control information at the MAC layer to obtain the first MAC PDU, or it can also use the first key to perform second security processing on the second MAC PDU at the MAC layer.
  • the security processing to obtain the second user plane control information refer to the description in the first embodiment above for details.
  • the terminal device can also derive the first key according to at least one of the second key, the third key, and the fourth key; and then use the first key to control the second user plane at the MAC layer.
  • the information is subjected to the first security processing to obtain the second MAC PDU, or the first key may be used to perform the second security processing on the first MAC PDU at the MAC layer to obtain the first user plane control information.
  • the key used by the DU for security processing at the MAC layer is different from the key used by the CU, so that key isolation can be achieved, and the security of the CU cannot be guaranteed after the DU key is stolen.
  • the access network device or the terminal device may include corresponding hardware structures and/or software modules for performing various functions.
  • the embodiments of the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a certain function is executed by hardware or computer software drives hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art may use different methods to implement the described functions for each specific application, but such implementation should not be regarded as exceeding the scope of the present application.
  • the embodiment of the present application can divide the functional units of the access network device or the terminal device according to the above method example, for example, each functional unit can be divided corresponding to each function, or two or more functions can be integrated into one unit .
  • the above-mentioned integrated units can be implemented in the form of hardware or in the form of software functional units.
  • FIG. 9 shows a possible exemplary block diagram of the device involved in the embodiment of the present application.
  • an apparatus 900 may include: a processing unit 902 and a communication unit 903 .
  • the processing unit 902 is used to control and manage the actions of the device 900 .
  • the communication unit 903 is used to support the communication between the apparatus 900 and other devices.
  • the communication unit 903 is also referred to as a transceiver unit, and may include a receiving unit and/or a sending unit, configured to perform receiving and sending operations respectively.
  • the device 900 may further include a storage unit 901 for storing program codes and/or data of the device 900.
  • the apparatus 900 may be the access network device in the foregoing embodiments, or may also be a chip provided in the access network device.
  • the processing unit 902 may support the apparatus 900 to execute the actions of the access network device in the above method examples (such as FIG. 5 or FIG. 8 ).
  • the processing unit 902 mainly executes internal actions of the access network device in the method example (such as FIG. 5 or FIG. 8 ), and the communication unit 903 may support communication between the apparatus 900 and other devices.
  • the processing unit 902 is configured to: perform first security processing on the user plane control information at the MAC layer to obtain a MAC PDU;
  • the communication unit 903 is configured to: send the MAC PDU to the terminal device; wherein, the The MAC PDU includes N first MAC sub-PDUs and M second MAC sub-PDUs, each first MAC sub-PDU corresponds to at least one second MAC sub-PDU, and the first MAC sub-PDU is used for the terminal device to The second MAC sub-PDU corresponding to the first MAC sub-PDU is subjected to the second security processing, and the M second MAC sub-PDUs include the user plane control information or the first user plane PDU after the first security processing.
  • Control information; N and M are integers greater than or equal to 1.
  • the communication unit 903 is configured to: receive a MAC PDU from a terminal device, the MAC PDU includes N first MAC sub-PDUs and M second MAC sub-PDUs, and each first MAC sub-PDU corresponds to At least one second MAC sub-PDU, the M second MAC sub-PDUs include user plane control information or the first user plane control information after the first security processing, where N and M are integers greater than or equal to 1;
  • the processing unit 902 is configured to: perform second security processing on the second MAC sub-PDU corresponding to the first MAC sub-PDU at the MAC layer according to the first MAC sub-PDU.
  • the apparatus 900 may be the terminal device in the foregoing embodiments, or may also be a chip provided in the terminal device.
  • the processing unit 902 may support the apparatus 900 to execute the actions of the terminal device in the above method examples (such as FIG. 5 ).
  • the processing unit 902 mainly executes internal actions of the terminal device in the method example (such as FIG. 5 ), and the communication unit 903 can support communication between the apparatus 900 and other devices.
  • the processing unit 902 is configured to: perform first security processing on the user plane control information at the MAC layer to obtain a MAC PDU;
  • the communication unit 903 is configured to: send the MAC PDU to the access network device; wherein , the MAC PDU includes N first MAC sub-PDUs and M second MAC sub-PDUs, each first MAC sub-PDU corresponds to at least one second MAC sub-PDU, and the first MAC sub-PDU is used for the access
  • the network access device performs second security processing on the second MAC sub-PDU corresponding to the first MAC sub-PDU, and the M second MAC sub-PDUs include the user plane control information or the first security processing of the First user plane control information; N and M are integers greater than or equal to 1.
  • the communication unit 903 is configured to: receive a MAC PDU from an access network device, the MAC PDU includes N first MAC sub-PDUs and M second MAC sub-PDUs, each first MAC sub-PDU The PDU corresponds to at least one second MAC sub-PDU, and the M second MAC sub-PDUs include user plane control information or the first user plane control information after the first security processing, and N and M are greater than or equal to 1 Integer; the processing unit 902 is configured to: perform second security processing on the second MAC sub-PDU corresponding to the first MAC sub-PDU at the MAC layer according to the first MAC sub-PDU.
  • each unit in the device can be implemented in the form of software called by the processing element; they can also be implemented in the form of hardware; some units can also be implemented in the form of software called by the processing element, and some units can be implemented in the form of hardware.
  • each unit can be a separate processing element, or it can be integrated in a certain chip of the device.
  • it can also be stored in the memory in the form of a program, which is called and executed by a certain processing element of the device. Function.
  • all or part of these units can be integrated together, or implemented independently.
  • the processing element mentioned here may also be a processor, which may be an integrated circuit with signal processing capability.
  • each operation of the above method or each unit above may be realized by an integrated logic circuit of hardware in the processor element, or implemented in the form of software called by the processing element.
  • the units in any of the above devices may be one or more integrated circuits configured to implement the above method, for example: one or more specific integrated circuits (application specific integrated circuit, ASIC), or, one or Multiple microprocessors (digital signal processor, DSP), or, one or more field programmable gate arrays (field programmable gate array, FPGA), or a combination of at least two of these integrated circuit forms.
  • ASIC application specific integrated circuit
  • DSP digital signal processor
  • FPGA field programmable gate array
  • the units in the device can be implemented in the form of a processing element scheduler
  • the processing element can be a processor, such as a general-purpose central processing unit (central processing unit, CPU), or other processors that can call programs.
  • CPU central processing unit
  • these units can be integrated together and implemented in the form of a system-on-a-chip (SOC).
  • the above unit for receiving is an interface circuit of the device for receiving signals from other devices.
  • the receiving unit is an interface circuit for the chip to receive signals from other chips or devices.
  • the above sending unit is an interface circuit of the device, and is used to send signals to other devices.
  • the sending unit is an interface circuit used by the chip to send signals to other chips or devices.
  • the access network device 100 may include one or more DUs 1001 and one or more CUs 1002.
  • the DU 1001 may include at least one antenna 10011, at least one radio frequency unit 10012, at least one processor 10013 and at least one memory 10014.
  • the DU 1001 part is mainly used for transmitting and receiving radio frequency signals, conversion of radio frequency signals and baseband signals, and part of baseband processing.
  • the CU 1002 may include at least one processor 10022 and at least one memory 10021 .
  • the CU 1002 is mainly used for baseband processing, controlling access network equipment, and the like.
  • the DU 1001 and the CU 1002 may be physically set together, or physically separated, that is, distributed base stations.
  • the CU 1002 is the control center of the access network equipment, and can also be called a processing unit, which is mainly used to complete the baseband processing function.
  • the CU 1002 may be used to control the access network device to execute the operation procedures related to the access network device in the foregoing method embodiments.
  • the access network device 100 may include one or more radio frequency units, one or more DUs, and one or more CUs.
  • the DU may include at least one processor 10013 and at least one memory 10014
  • the radio frequency unit may include at least one antenna 10011 and at least one radio frequency unit 10012
  • the CU may include at least one processor 10022 and at least one memory 10021.
  • the CU1002 can be composed of one or more single boards, and multiple single boards can jointly support a wireless access network (such as a 5G network) with a single access indication, or can separately support wireless access networks of different access standards.
  • Access network (such as LTE network, 5G network or other networks).
  • the memory 10021 and the processor 10022 may serve one or more single boards. That is to say, memory and processors can be set independently on each single board. It may also be that multiple single boards share the same memory and processor. In addition, necessary circuits can also be set on each single board.
  • the DU1001 can be composed of one or more single boards, and multiple single boards can jointly support a wireless access network (such as a 5G network) with a single access indication, or can separately support wireless access networks of different access standards (such as a 5G network). LTE network, 5G network or other networks).
  • the memory 10014 and the processor 10013 may serve one or more single boards. That is to say, memory and processors can be set independently on each single board. It may also be that multiple single boards share the same memory and processor. In addition, necessary circuits can also be set on each single board.
  • the access network device shown in FIG. 10 can implement various processes involving the access network device in the method embodiments shown in FIGS. 5 and 8 .
  • the operations and/or functions of the various modules in the access network device shown in FIG. 10 are respectively intended to implement the corresponding processes in the foregoing method embodiments.
  • the terminal device includes: an antenna 1110 , a radio frequency part 1120 , and a signal processing part 1130 .
  • the antenna 1110 is connected to the radio frequency part 1120 .
  • the radio frequency part 1120 receives the information sent by the network equipment through the antenna 1110, and sends the information sent by the network equipment to the signal processing part 1130 for processing.
  • the signal processing part 1130 processes the information of the terminal device and sends it to the radio frequency part 1120
  • the radio frequency part 1120 processes the information of the terminal device and sends it to the network device through the antenna 1110 .
  • the signal processing part 1130 may include a modulation and demodulation subsystem, which is used to realize the processing of each communication protocol layer of data; it may also include a central processing subsystem, which is used to realize the processing of the operating system and application layer of the terminal equipment; Including other subsystems, such as multimedia subsystems, peripheral subsystems, etc., wherein the multimedia subsystem is used to realize the control of the terminal equipment camera, screen display, etc., and the peripheral subsystem is used to realize the connection with other devices.
  • the modem subsystem can be a separate chip.
  • the modem subsystem may include one or more processing elements 1131, including, for example, a master CPU and other integrated circuits.
  • the modem subsystem may further include a storage element 1132 and an interface circuit 1133 .
  • the storage element 1132 is used to store data and programs, but the program used to execute the method executed by the terminal device in the above methods may not be stored in the storage element 1132, but stored in a memory outside the modem subsystem, When used, the modem subsystem is loaded and used.
  • Interface circuit 1133 is used to communicate with other subsystems.
  • the modem subsystem can be realized by a chip, and the chip includes at least one processing element and an interface circuit, wherein the processing element is used to execute each step of any method performed by the above terminal equipment, and the interface circuit is used to communicate with other devices.
  • the unit for the terminal device to implement each step in the above method may be implemented in the form of a processing element scheduler.
  • the device for the terminal device includes a processing element and a storage element, and the processing element calls the program stored in the storage element to Execute the method performed by the terminal device in the above method embodiment.
  • the storage element may be a storage element on the same chip as the processing element, that is, an on-chip storage element.
  • the program for executing the method executed by the terminal device in the above method may be stored in a storage element on a different chip from the processing element, that is, an off-chip storage element.
  • the processing element invokes or loads a program from the off-chip storage element on the on-chip storage element, so as to invoke and execute the method performed by the terminal device in the above method embodiment.
  • the unit of the terminal device that implements each step in the above method may be configured as one or more processing elements, and these processing elements are set on the modem subsystem, where the processing elements may be integrated circuits, For example: one or more ASICs, or one or more DSPs, or one or more FPGAs, or a combination of these types of integrated circuits. These integrated circuits can be integrated together to form a chip.
  • the units of the terminal device for implementing each step in the above method can be integrated together and implemented in the form of an SOC, and the SOC chip is used to implement the above method.
  • the chip may integrate at least one processing element and a storage element, and the processing element calls the stored program of the storage element to realize the method executed by the above terminal device; or, the chip may integrate at least one integrated circuit for realizing the above terminal
  • the method executed by the device; or, the above implementation manners may be combined, the functions of some units are implemented in the form of calling programs by processing elements, and the functions of some units are implemented in the form of integrated circuits.
  • the above apparatus for a terminal device may include at least one processing element and an interface circuit, where at least one processing element is configured to execute any method performed by the terminal device provided in the above method embodiments.
  • the processing element can perform some or all of the steps performed by the terminal device in the first way: that is, by calling the program stored in the storage element; or in the second way: through the integrated logic circuit of the hardware in the processor element combined with instructions Part or all of the steps performed by the terminal device may be performed in a manner; of course, some or all of the steps performed by the terminal device may also be performed in combination with the first method and the second method.
  • the processing elements here are the same as those described above, and may be implemented by a processor, and the functions of the processing elements may be the same as those of the processing unit described in FIG. 9 .
  • the processing element may be a general-purpose processor, such as a CPU, and may also be one or more integrated circuits configured to implement the above method, such as: one or more ASICs, or, one or more microprocessors DSP , or, one or more FPGAs, etc., or a combination of at least two of these integrated circuit forms.
  • the storage element may be implemented by a memory, and the function of the storage element may be the same as that of the storage unit described in FIG. 9 .
  • a storage element may be one memory, or a general term for multiple memories.
  • the terminal device shown in FIG. 11 can implement various processes related to the terminal device in the foregoing method embodiments.
  • the operations and/or functions of the various modules in the terminal device shown in FIG. 11 are respectively for implementing the corresponding processes in the foregoing method embodiments.
  • system and “network” in the embodiments of the present application may be used interchangeably.
  • “At least one” means one or more, and “plurality” means two or more.
  • “And/or” describes the association relationship of associated objects, indicating that there can be three types of relationships, for example, A and/or B, which can mean: A exists alone, A and B exist simultaneously, and B exists alone, where A, B can be singular or plural.
  • the character “/” generally indicates that the contextual objects are an “or” relationship.
  • “At least one of the following” or similar expressions refer to any combination of these items, including any combination of single or plural items. For example "at least one of A, B and C” includes A, B, C, AB, AC, BC or ABC. And, unless otherwise specified, ordinal numerals such as “first” and “second” mentioned in the embodiments of this application are used to distinguish multiple objects, and are not used to limit the order, timing, priority or importance of multiple objects degree.
  • the embodiments of the present application may be provided as methods, systems, or computer program products. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein.
  • computer-usable storage media including but not limited to disk storage, CD-ROM, optical storage, etc.
  • These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing apparatus to operate in a specific manner, such that the instructions stored in the computer-readable memory produce an article of manufacture comprising instruction means, the instructions
  • the device realizes the function specified in one or more procedures of the flowchart and/or one or more blocks of the block diagram.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本申请涉及通信技术领域，公开了一种通信方法及装置。其中方法包括：第一通信装置在MAC层对用户面控制信息进行第一安全处理，得到MAC PDU，并向第二通信装置发送该MAC PDU，该MAC PDU中可以包括N个第一MAC子PDU和M个第二MAC子PDU，N个第一MAC子PDU为额外生成的、用于保护M个第二MAC子PDU的MAC子PDU，从而能够在实现对用户面控制信息进行安全处理的同时，对现有的MAC PDU格式影响较小，且可以灵活实现对MAC PDU中的一个或多个MAC CE或MAC SDU进行安全处理。

Description

一种通信方法及装置
相关申请的交叉引用
本申请要求在2021年09月28日提交中国专利局、申请号为202111143477.1、申请名称为“一种通信方法及装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信技术领域，尤其涉及一种通信方法及装置。
背景技术
无线通信的传输分为用户面传输和控制面传输，用户面传输主要用于传输用户面数据，而控制面传输主要用于传输控制面信令。在无线通信过程中，为了通信过程的安全性，发送端和接收端可以对用户面数据和控制面信令进行安全处理。例如，发送端对数据进行加密处理，相应地，接收端对数据进行解密处理，防止数据被第三方读取；发送端对数据进行完整性保护处理，相应地，接收端对数据进行完整性验证处理，防止数据被第三方篡改。
此外，用户面传输还可以用于传输用户面控制信息。由于有些用户面控制信息比较重要，如果被不法基站或者终端加以利用，对相关的用户面控制信息进行伪造或者监控，将会对无线通信造成很大的安全隐患，因此，如何对用户面控制信息进行安全处理，仍需进一步研究。
发明内容
本申请提供了一种通信方法及装置，用于实现对用户面控制信息进行安全处理，提高用户面控制信息的安全性。
本申请提供的通信方法可以由两个通信装置来执行，分别为第一通信装置和第二通信装置。其中，第一通信装置为发送端，用于执行第一安全处理；第二通信装置为接收端，用于执行第二安全处理。第二安全处理为第一安全处理的逆过程，比如第一安全处理包括加密处理和/或完整性保护处理，第二安全处理包括解密处理和/或完整性校验处理。作为一种可能的实现，第一通信装置可以为接入网设备或者设置在接入网设备中的芯片，或者也可以为DU或者设置在DU中的芯片，第二通信装置可以为终端设备或者设置在终端设备中的芯片；或者，第一通信装置可以为终端设备或者设置在终端设备中的芯片，第二通信装置可以为接入网设备或者设置在接入网设备中的芯片，或者也可以为DU或者设置在DU中的芯片。
第一方面，本申请实施例提供一种通信方法，该方法可以应用于第一通信装置，在该方法中，第一通信装置在MAC层对用户面控制信息进行第一安全处理，得到MAC PDU，并向第二通信装置发送所述MAC PDU；其中，所述MAC PDU包括N个第一MAC子PDU和M个第二MAC子PDU，每个第一MAC子PDU对应至少一个第二MAC子PDU，所述第一MAC子PDU用于所述第二通信装置对所述第一MAC子PDU对应的第二MAC子 PDU进行第二安全处理，所述M个第二MAC子PDU包括所述用户面控制信息或经过第一安全处理后的所述第一用户面控制信息；N、M为大于或等于1的整数。
如此，由于第一通信装置对用户面控制信息执行第一安全处理所生成的MAC PDU中可以包括N个第一MAC子PDU和M个第二MAC子PDU，N个第一MAC子PDU为额外生成的、用于保护M个第二MAC子PDU的MAC子PDU，从而能够在实现对用户面控制信息进行安全处理的同时，对现有的MAC PDU格式影响较小，且可以灵活实现对MAC PDU中的一个或多个MAC CE或MAC SDU进行安全处理。
在一种可能的设计中，所述用户面控制信息包括M个MAC CE和/或MAC SDU，其中，MAC SDU包括来自PDCP层的控制PDU、来自RLC层的控制PDU或来自SDAP层的控制PDU。或者说，所述用户面控制信息包括以下至少一项：所述MAC层生成的MAC CE；来自PDCP层的控制PDU；来自RLC层的控制PDU；来自SDAP层的控制PDU。
在一种可能的设计中，所述第一MAC子PDU包括指示信息，所述指示信息用于指示所述第一MAC子PDU对应的第二MAC子PDU。
在一种可能的设计中，所述指示信息承载于所述第一MAC子PDU的MAC子头中，或者，所述指示信息承载于所述第一MAC子PDU的MAC CE中。
在一种可能的设计中，所述第一MAC子PDU的MAC子头包括预设的逻辑信道标识，所述预设的逻辑信道标识用于指示包括所述预设的逻辑信道标识的MAC子PDU为所述第一MAC子PDU。如此，接收端(比如第二通信装置)可以根据预设的逻辑信道标识快速识别出第一MAC PDU中的哪些MAC子PDU为第一MAC子PDU。
在一种可能的设计中，所述第一MAC子PDU的MAC CE包括以下至少一项：所述第一MAC子PDU对应的第二MAC子PDU的序列号；所述第一MAC子PDU对应的第二MAC子PDU的计数值；所述第一MAC子PDU对应的第二MAC子PDU的完整性保护参数。
在一种可能的设计中，若第一通信装置为接入网设备或者设置在接入网设备中的芯片，或者第一通信装置为DU或者设置在DU中的芯片，第二通信装置为终端设备或者设置在终端设备中的芯片，则所述方法还包括：所述第一通信装置向所述第二通信装置发送使能信息，所述使能信息用于使能所述第二通信装置在MAC层进行所述第一安全处理和/或所述第二安全处理；如此，第一通信装置可以灵活控制第二通信装置是否开启安全处理功能。和/或，所述方法还包括：接收来自所述第二通信装置的通知信息，所述通知信息用于通知所述MAC PDU所包括的第二MAC子PDU的第二安全处理失败，所述通知信息包括第二安全处理失败的第二MAC子PDU对应的逻辑信道标识和/或第二安全处理失败的第二MAC子PDU的个数。
在一种可能的设计中，若第一通信装置为终端设备或者设置在终端设备中的芯片，第二通信装置为接入网设备或者设置在接入网设备中的芯片，或者第二通信装置为DU或者设置在DU中的芯片，则所述方法还包括：接收来自所述第二通信装置的使能信息，所述使能信息用于使能所述第二通信装置在MAC层进行所述第一安全处理和/或所述第二安全处理。
在一种可能的设计中，所述第一通信装置在MAC层对用户面控制信息进行第一安全处理，包括：所述第一通信装置使用第一密钥在MAC层对用户面控制信息进行第一安全处理，所述第一密钥是根据第二密钥、第三密钥、第四密钥中的至少一项推演得到的；其 中，所述第二密钥用于推演得到所述第三密钥和所述第四密钥，所述第三密钥用于对控制面信令进行第一安全处理或第二安全处理，所述第四密钥用于对用户面数据进行第一安全处理或第二安全处理。如此，由于第一通信装置在MAC层进行安全处理所使用第一密钥不同于在PDCP层进行安全处理(控制面信令、用户面数据等均是在PDCP层进行安全处理)所使用的密钥，从而在CU-DU分离架构中，能够实现CU和DU的密钥隔离，避免DU所使用的第一密钥被窃取后，CU的安全性也无法保障的问题。
第二方面，本申请实施例提供一种通信方法，该方法可以应用于第二通信装置，在该方法中，第二通信装置接收来自第一通信装置的MAC PDU，所述MAC PDU包括N个第一MAC子PDU和M个第二MAC子PDU，每个第一MAC子PDU对应至少一个第二MAC子PDU，所述M个第二MAC子PDU包括用户面控制信息或经过第一安全处理后的所述第一用户面控制信息，N、M为大于或等于1的整数；所述第二通信装置根据所述第一MAC子PDU，在MAC层对所述第一MAC子PDU对应的第二MAC子PDU进行第二安全处理。
在一种可能的设计中，所述用户面控制信息包括以下至少一项：所述MAC层生成的MAC CE；来自PDCP层的控制PDU；来自RLC层的控制PDU；来自SDAP层的控制PDU。
在一种可能的设计中，所述第一MAC子PDU包括指示信息，所述指示信息用于指示所述第一MAC子PDU对应的第二MAC子PDU。
在一种可能的设计中，所述指示信息承载于所述第一MAC子PDU的MAC子头中，或者，所述指示信息承载于所述第一MAC子PDU的MAC CE中。
在一种可能的设计中，所述第一MAC子PDU的MAC子头包括预设的逻辑信道标识，所述预设的逻辑信道标识用于指示包括所述预设的逻辑信道标识的MAC子PDU为所述第一MAC子PDU。
在一种可能的设计中，所述第一MAC子PDU的MAC CE包括以下至少一项：所述第一MAC子PDU对应的第二MAC子PDU的序列号；所述第一MAC子PDU对应的第二MAC子PDU的计数值；所述第一MAC子PDU对应的第二MAC子PDU的完整性保护参数。
在一种可能的设计中，所述方法还包括：接收来自所述第一通信装置的使能信息，所述使能信息用于使能所述第二通信装置在MAC层进行所述第一安全处理和/或所述第二安全处理。
在一种可能的设计中，所述方法还包括：接收来自所述第二通信装置的通知信息，所述通知信息用于通知所述MAC PDU所包括的第二MAC子PDU的第二安全处理失败，所述通知信息包括第二安全处理失败的第二MAC子PDU对应的逻辑信道标识和/或第二安全处理失败的第二MAC子PDU的个数。
在一种可能的设计中，所述方法还包括：所述第二通信装置向所述第一通信装置发送使能信息，所述使能信息用于使能所述第一通信装置在MAC层进行所述第一安全处理和/或所述第二安全处理。
在一种可能的设计中，所述第二通信装置根据所述第一MAC子PDU，在MAC层对所述第一MAC子PDU对应的第二MAC子PDU进行第二安全处理，包括：所述第二通信装置根据所述第一MAC子PDU，使用第一密钥在MAC层对所述第一MAC子PDU对应的第二MAC子PDU进行第二安全处理，所述第一密钥是根据第二密钥、第三密钥、第 四密钥中的至少一项推演得到的；其中，所述第二密钥用于推演得到所述第三密钥和所述第四密钥，所述第三密钥用于对控制面信令进行第一安全处理或第二安全处理，所述第四密钥用于对用户面数据进行第一安全处理或第二安全处理。
需要说明的是，上述第二方面所描述的方法与第一方面所描述的方法相对应，第二方面所描述的方法中相关技术特征的有益效果可以参照第一方面，具体不再赘述。
第三方面，本申请实施例提供一种通信***，该通信***可以包括第一通信装置和第二通信装置，其中，第一通信装置用于执行上述第一方面所述的方法，第二通信装置用于执行上述第二方面所述的方法。
第四方面，本申请实施例提供一种通信***，该通信***可以包括CU和DU；CU用于：确定第一密钥，并向DU发送所述第一密钥；DU用于：接收所述第一密钥，采用所述第一密钥在MAC层进行第一安全处理和/或第二安全处理。
在一种可能的设计中，DU具体用于：采用所述第一密钥在MAC层对用户面控制信息进行第一安全处理，得到MAC PDU，并向终端设备发送所述MAC PDU；其中，所述MAC PDU包括N个第一MAC子PDU和M个第二MAC子PDU，每个第一MAC子PDU对应至少一个第二MAC子PDU，所述第一MAC子PDU用于所述第二通信装置对所述第一MAC子PDU对应的第二MAC子PDU进行第二安全处理，所述M个第二MAC子PDU包括所述用户面控制信息或加密后的所述第一用户面控制信息；N、M为大于或等于1的整数。
在一种可能的设计中，DU具体用于：接收来自终端设备的MAC PDU，所述MAC PDU包括N个第一MAC子PDU和M个第二MAC子PDU，每个第一MAC子PDU对应至少一个第二MAC子PDU，所述M个第二MAC子PDU包括用户面控制信息或经过第一安全处理后的所述第一用户面控制信息，N、M为大于或等于1的整数；根据所述第一MAC子PDU，采用所述第一密钥在MAC层对所述第一MAC子PDU对应的第二MAC子PDU进行第二安全处理。
在一种可能的设计中，CU具体用于：接收来自核心网网元的第二密钥；根据所述第一密钥推演得到第三密钥和第四密钥，所述第三密钥用于对控制面信令进行第一安全处理或第二安全处理，所述第四密钥用于对用户面数据进行第一安全处理或第二安全处理；根据所述第二密钥、所述第三密钥、所述第四密钥中的至少一项，推演得到所述第一密钥。
第五方面，本申请提供一种通信装置，所述通信装置具备实现上述第一方面的功能，比如，所述通信装置包括执行上述第一方面涉及操作所对应的模块或单元或手段(means)，所述模块或单元或手段可以通过软件实现，或者通过硬件实现，也可以通过硬件执行相应的软件实现。
在一种可能的设计中，所述通信装置包括处理单元、通信单元，其中，通信单元可以用于收发信号，以实现该通信装置和其它装置之间的通信，比如，通信单元用于接收来自终端设备的配置信息；处理单元可以用于执行该通信装置的一些内部操作。处理单元、通信单元执行的功能可以和上述第一方面涉及的操作相对应。
在一种可能的设计中，所述通信装置包括处理器，处理器可以用于与存储器耦合。所述存储器可以保存实现上述第一方面涉及的功能的必要计算机程序或指令。所述处理器可执行所述存储器存储的计算机程序或指令，当所述计算机程序或指令被执行时，使得所述通信装置实现上述第一方面中任意可能的设计或实现方式中的方法。
在一种可能的设计中，所述通信装置包括处理器和存储器，存储器可以保存实现上述第一方面涉及的功能的必要计算机程序或指令。所述处理器可执行所述存储器存储的计算机程序或指令，当所述计算机程序或指令被执行时，使得所述通信装置实现上述第一方面中任意可能的设计或实现方式中的方法。
在一种可能的设计中，所述通信装置包括处理器和接口电路，其中，处理器用于通过所述接口电路与其它装置通信，并执行上述第一方面中任意可能的设计或实现方式中的方法。
第六方面，本申请提供一种通信装置，所述通信装置具备实现上述第二方面涉及的功能，比如，所述通信装置包括执行上述第二方面涉及操作所对应的模块或单元或手段，所述功能或单元或手段可以通过软件实现，或者通过硬件实现，也可以通过硬件执行相应的软件实现。
在一种可能的设计中，所述通信装置包括处理单元、通信单元，其中，通信单元可以用于收发信号，以实现该通信装置和其它装置之间的通信，比如，通信单元用于向终端设备发送***信息；处理单元可以用于执行该通信装置的一些内部操作。处理单元、通信单元执行的功能可以和上述第二方面涉及的操作相对应。
在一种可能的设计中，所述通信装置包括处理器，处理器可以用于与存储器耦合。所述存储器可以保存实现上述第二方面涉及的功能的必要计算机程序或指令。所述处理器可执行所述存储器存储的计算机程序或指令，当所述计算机程序或指令被执行时，使得所述通信装置实现上述第二方面任意可能的设计或实现方式中的方法。
在一种可能的设计中，所述通信装置包括处理器和存储器，存储器可以保存实现上述第二方面涉及的功能的必要计算机程序或指令。所述处理器可执行所述存储器存储的计算机程序或指令，当所述计算机程序或指令被执行时，使得所述通信装置实现上述第二方面任意可能的设计或实现方式中的方法。
在一种可能的设计中，所述通信装置包括处理器和接口电路，其中，处理器用于通过所述接口电路与其它装置通信，并执行上述第二方面任意可能的设计或实现方式中的方法。
可以理解地，上述第五方面或第六方面中，处理器可以通过硬件来实现也可以通过软件来实现，当通过硬件实现时，该处理器可以是逻辑电路、集成电路等；当通过软件来实现时，该处理器可以是一个通用处理器，通过读取存储器中存储的软件代码来实现。此外，以上处理器可以为一个或多个，存储器可以为一个或多个。存储器可以与处理器集成在一起，或者存储器与处理器分离设置。在具体实现过程中，存储器可以与处理器集成在同一块芯片上，也可以分别设置在不同的芯片上，本申请实施例对存储器的类型以及存储器与处理器的设置方式不做限定。
第七方面，本申请提供一种计算机可读存储介质，所述计算机存储介质中存储有计算机可读指令，当计算机读取并执行所述计算机可读指令时，使得计算机执行上述第一方面或第二方面的任一种可能的设计中的方法。
第八方面，本申请提供一种计算机程序产品，当计算机读取并执行所述计算机程序产品时，使得计算机执行上述第一方面或第二方面的任一种可能的设计中的方法。
第九方面，本申请提供一种芯片，所述芯片包括处理器，所述处理器与存储器耦合，用于读取并执行所述存储器中存储的软件程序，以实现上述第一方面或第二方面的任一种可能的设计中的方法。
本申请的这些方面或其它方面在以下实施例的描述中会更加简明易懂。
附图说明
图1为本申请实施例适用的一种网络架构示意图；
图2A为本申请实施例提供的下行数据在各层间传输的示意图；
图2B为本申请实施例提供的基站的物理模块结构示意图；
图2C为本申请实施例提供的CU-DU分离架构示意图；
图3A为本申请实施例提供的完整性保护/验证处理示意图；
图3B为本申请实施例提供的MAC PDU组成示意图；
图3C为本申请实施例提供的MAC子头组成示意图；
图3D为本申请实施例提供的密钥层级示意图；
图4为本申请实施例提供的安全处理示意图；
图5为本申请实施例提供的通信方法所对应的一种流程示意图；
图6A、图6B、图6C为本申请实施例提供的第一MAC子PDU与第二MAC子PDU的位置关系示意图；
图7A、图7B、图7C为本申请实施例提供的第一MAC子PDU与第二MAC子PDU所包含的内容示意图；
图8为本申请实施例提供的通信方法所对应的又一种流程示意图；
图9为本申请实施例中所涉及的装置的可能的示例性框图；
图10为本申请实施例提供的一种接入网设备的结构示意图；
图11为本申请实施例提供的一种终端设备的结构示意图。
具体实施方式
图1为本申请实施例适用的通信***的架构示意图。如图1所示，通信***1000包括无线接入网(radio access network，RAN)100和核心网(core network，CN)200，可选的，通信***1000还可以包括数据网(data network，DN)。
RAN100可以包括至少一个无线接入网设备(也可称为接入网设备，如图1中的110a和110b)，还可以包括至少一个终端设备(如图1中的120a-120j)，终端设备可以通过无线的方式与无线接入网设备相连。终端设备和终端设备之间以及接入网设备和接入网设备之间可以通过有线或无线的方式相互连接。CN200中可以包括多个核心网网元，无线接入网设备可以通过无线或有线方式与核心网网元连接。核心网网元与无线接入网设备可以是独立的不同的物理设备，也可以是将核心网网元的功能与无线接入网设备的逻辑功能集成在同一个物理设备上，还可以是一个物理设备上集成了部分核心网网元的功能和部分的无线接入网设备的功能。
(1)终端设备、接入网设备
终端设备也可以称为终端、用户设备(user equipment，UE)、移动台、移动终端等。终端设备可以广泛应用于各种场景，例如，设备到设备(device-to-device，D2D)、车物(vehicle to everything，V2X)通信、机器类通信(machine-type communication，MTC)、物联网(internet of things，IOT)、虚拟现实、增强现实、工业控制、自动驾驶、远程医疗、 智能电网、智能家具、智能办公、智能穿戴、智能交通、智慧城市等。终端设备可以是手机、平板电脑、带无线收发功能的电脑、可穿戴设备、车辆、无人机、直升机、飞机、轮船、机器人、机械臂、智能家居设备等。本申请的实施例对终端设备所采用的具体技术和具体设备形态不做限定。
接入网设备可以是基站(base station)、演进型基站(evolved NodeB，eNodeB)、发送接收点(transmission reception point，TRP)、5G通信***中的下一代基站(next generation NodeB，gNB)、第六代(6th generation，6G)通信***中的下一代基站、未来通信***中的基站或WiFi***中的接入节点等；也可以是完成基站功能的模块或单元。接入网设备可以是宏基站(如图1中的110a)，也可以是微基站或室内站(如图1中的110b)，还可以是中继节点或施主节点等。本申请的实施例对接入网设备所采用的具体技术和具体设备形态不做限定。
需要说明的是：接入网设备和终端设备可以是固定位置的，也可以是可移动的。接入网设备和终端设备可以部署在陆地上，包括室内或室外、手持或车载；也可以部署在水面上；还可以部署在空中的飞机、气球和人造卫星上。本申请的实施例对接入网设备和终端设备的应用场景不做限定。此外，接入网设备和终端设备的角色可以是相对的，例如，图1中的直升机或无人机120i可以被配置成移动接入网设备，对于那些通过120i接入到无线接入网100的终端设备120j来说，120i是接入网设备；但对于接入网设备110a来说，120i是终端设备，即110a与120i之间是通过无线空口协议进行通信的。当然，110a与120i之间也可以是通过接入网设备与接入网设备之间的接口协议进行通信的，此时，相对于110a来说，120i也是接入网设备。因此，接入网设备和终端设备都可以统一称为通信装置，图1中的110a和110b可以称为具有接入网设备功能的通信装置，图1中的120a-120j可以称为具有终端设备功能的通信装置。
在本申请实施例中，接入网设备的功能也可以由接入网设备中的模块(如芯片)来执行，也可以由包含有接入网设备功能的控制子***来执行。这里的包含有接入网设备功能的控制子***可以是智能电网、工业控制、智能交通、智慧城市等上述应用场景中的控制中心。终端的功能也可以由终端中的模块(如芯片或调制解调器)来执行，也可以由包含有终端功能的装置来执行。
(2)协议层结构
接入网设备和终端设备之间的通信遵循一定的协议层结构，例如控制面协议层结构可以包括无线资源控制(radio resource control，RRC)层、分组数据汇聚层协议(packet data convergence protocol，PDCP)层、无线链路控制(radio link control，RLC)层、媒体接入控制(media access control，MAC)层和物理层(physical layer，PHY)；用户面协议层结构可以包括PDCP层、RLC层、MAC层和物理层，在一种可能的实现中，PDCP层之上还可以包括业务数据适配协议(service data adaptation protocol，SDAP)层。其中，SDAP层、PDCP层、RLC层、MAC层、物理层也可以统称为接入层。有关上述各个协议层的具体描述，可以参考第三代合作伙伴计划(3rd generation partnership project，3GPP)的相关技术规范。
以接入网设备和终端设备之间的数据传输为例，数据传输需要经过用户面协议层，比如经过SDAP层、PDCP层、RLC层、MAC层、物理层。以下行数据传输为例，图2A为下行数据在各层间传输的示意图，SDAP层实体自上层取得数据后，可以根据数据的服务 质量(quality of service，QoS)流标识(QoS flow indicator，QFI)将数据映射到相应的PDCP层实体，PDCP层实体可以将数据传送到该PDCP层实体对应的至少一个RLC层实体，进而由至少一个RLC层实体传输到对应的MAC层实体，再由MAC层实体生成传输块，然后通过对应的物理层实体进行无线传输。数据在各个层中进行相对应的封装，某一层从该层的上层收到的数据视为该层的服务数据单元(service data unit，SDU)，经过层封装后成为协议数据单元(protocol data unit，PDU)，再传递给下一个层。例如PDCP层实体从上层接收到的数据称为PDCP SDU，PDCP层实体发送到下层的数据称为PDCP PDU；RLC层实体从上层接收到的数据称为RLC SDU，RLC层实体发送到下层的数据称为RLC PDU。其中，不同层之间可以通过相应的通道来传输数据，比如RLC层实体与MAC层实体之间可以通过逻辑信道(logical channel，LCH)来传输数据，MAC层实体与物理层实体之间可以通过传输通道(transport channel)来传输数据。
(3)CU-DU分离架构
集中式单元(centralized unit，CU)-分布式单元(distributed unit，DU)分离架构是5G通信***新引入的基站架构。在4G通信***中，各个基站独立部署并分别与4G核心网连接；而在5G架构中，不同基站的DU部分独立部署，但是不同基站的CU部分可以集中部署，即多个DU可以由一个CU集中控制，其中CU连接核心网，DU通过F1接口连接CU。
如图2B所示，从物理模块结构上看，4G通信***中，基站内部分为基带单元(baseband unit，BBU)，射频拉远单元(remote radio unit，RRU)和天线等模块，每个基站都有一套BBU，并通过BBU直接连到核心网；而5G通信***的一种可能的设计中，原先的RRU和天线合并成有源天线单元(active antenna unit，AAU)，而BBU则拆分成DU和CU，每个基站都有一套DU，然后多个站点共用同一个CU进行集中式管理。
如图2C所示，从协议栈结构上看，在一种可能的设计中，CU可以包括PDCP层的功能、SDAP层的功能以及RRC层的功能，DU可以包括RLC层的功能、MAC层的功能和PHY层的部分功能。示例性地，DU可以包括PHY层中高层的功能。其中，PHY层中高层的功能可以包括循环冗余校验(cyclic redundancy check，CRC)功能、信道编码、速率匹配、加扰、调制、和层映射；或者，PHY层中高层的功能可以包括循环冗余校验、信道编码、速率匹配、加扰、调制、层映射和预编码。PHY层中低层的功能可以通过另一个与DU独立的网络实体(图2C中暂未示意)实现，其中，PHY层中低层的功能可以包括预编码、资源映射、物理天线映射和射频功能；或者，PHY层中低层的功能可以包括资源映射、物理天线映射和射频功能。本申请实施例对PHY层中高层和底层的功能划分不作限制。
在上述图2B或图2C所示意的架构中，CU产生的信令可以通过DU发送给终端设备，或者终端设备产生的信令可以通过DU发送给CU。DU可以不对该信令进行解析而直接通过协议层封装后透传给终端设备或CU。以下实施例中如果涉及这种信令在DU和终端设备之间的传输，此时，DU对信令的发送或接收包括这种场景。例如，RRC或PDCP层的信令最终会处理为物理层的数据发送给终端设备，或者，由接收到的物理层的数据转变而来。在这种架构下，该RRC或PDCP层的信令，即也可以认为是由DU发送的，或者，由DU和射频装置发送的。
可以理解的是，本申请实施例中的方案可以适用于多种可能的通信***中，比如5G 通信***或者6G通信***中。上述网元或者功能既可以是硬件设备中的网络元件，也可以是在专用硬件上运行软件功能，或者是平台(例如，云平台)上实例化的虚拟化功能。此外，图1只是示意图，该通信***中还可以包括其它网络设备，如还可以包括无线中继设备和无线回传设备。
下面先对本申请实施例涉及的相关技术特征进行解释说明。需要说明的是，这些解释是为了让本申请实施例更容易被理解，而不应该视为对本申请所要求的保护范围的限定。
(1)安全处理
为了通信过程的安全性，发送端和接收端可以对用户面数据和控制面信令进行安全处理。目前，接入层的安全处理可以在PDCP层进行，即发送端在PDCP层对用户面数据或者控制面信令进行安全处理，例如加密或完整性保护等；接收端同样在PDCP层对用户面数据或者控制面信令进行相应的安全处理，例如解密或完整性验证等，完整性验证也可以称为完整性校验。作为一种可能的实现，发送端为终端设备，接收端为接入网设备；或者，发送端为接入网设备，接收端为终端设备。
其中，加密处理是指发送端根据密钥等输入参数通过算法将数据明文通过计算处理变为密文，解密处理是指接收端根据密钥等输入参数通过算法将密文通过逆运算处理变为数据明文。当发送端所使用的输入参数与接收端所使用的输入参数相同时，可以实现在发送端经过了加密的信息，能够被接收端解密成功。
完整性保护处理是指发送端根据数据包以及密钥等输入参数，通过算法计算出完整性保护参数(比如参数A)；完整性验证是指接收端根据数据包以及密钥等输入参数，通过算法计算出参数B，如果参数A和B一致，则完整性验证成功，如果参数A和B不一致，则完整性验证失败。当发送端所使用的输入参数与接收端所使用的输入参数相同时，可以实现在发送端经过了完整性保护的信息，能够被接收端完整性验证成功。
比如，参见图3A所示，示意出了通过5G安全算法(integrity algorithm for 5G，NIA)进行完整性保护/验证的过程，其中，完整性保护/验证的输入参数可以包括计数值、密钥、信息(比如所要进行完整性保护/验证的消息本身)、传输方向(比如上行传输方向或下行传输方向)、无线承载的标识，其中完整性保护处理得到的输出参数(即参数A)可以包括完整性消息鉴权码(message authentication code-integrity，MAC-I)，完整性验证处理得到的输出参数(即参数B)可以包括预期完整性消息鉴权码(expected message authentication code-integrity，XMAC-I)。如果参数MAC-I和XMAC-I一致，则完整性验证成功，如果参数MAC-I和XMAC-I不一致，则完整性验证失败。
(2)用户面传输
无线通信的传输分为用户面传输和控制面传输，用户面传输可以用于传输用户面数据和用户面控制信息，控制面传输可以用于传输控制面信令，控制面信令可以包括RRC信令等。
其中，用户面数据可以是指用户面数据PDU，用户面数据PDU用于承载通信内容数据。用户面数据PDU可以包括各个协议层的数据PDU，例如SDAP数据PDU、PDCP数据PDU、RLC数据PDU等。
用户面控制信息可以是指用户面控制PDU，用户面控制PDU用于承载辅助用户面数据PDU传输的控制信息，例如状态报告，鲁棒性头压缩(robust header compression,RoHC) 反馈，以太网头压缩(ethernet header compression,EHC)反馈。用户面控制PDU可以包括各个协议层的控制PDU，例如SDAP控制PDU、PDCP控制PDU、RLC控制PDU等。除上述举例中的用户面控制PDU之外，还存在其他控制信息，例如MAC控制单元(control element，CE)以及未来通信***中可能定义的新协议层的控制PDU等。
(3)MAC PDU
MAC PDU可以分为下行MAC PDU和上行MAC PDU。图3B包括下行MAC PDU和上行MAC PDU的组成示意图，如图3B所示，MAC PDU由至少一个MAC子PDU(MAC subPDU)组成。比如，MAC层接收到RLC层递交过来的RLC PDU时，可以将RLC PDU作为MAC SDU并封装为MAC子PDU。又比如，MAC层可以生成MAC CE并封装为MAC子PDU。在其它可能的情形中，MAC子PDU也可以包括填充比特。MAC层通过复用功能可以将多个MAC子PDU组成一个完整的MAC PDU。
此外，每个MAC子PDU还可以包括一个MAC子头(303)，图3C为MAC子头示意图，如图3C所示，对于固定大小的MAC CE，MAC子头中可以包括字段R和逻辑信道标识(logical channal ID，LCID)，其中，字段R为预留字段。对于可变大小的MAC CE，MAC子头中可以包括字段R、字段F、逻辑信道标识和字段L，其中，字段F为格式字段，字段L用于指示MAC CE的长度。
(4)密钥层级
目前，安全处理所使用的密钥分为非接入层密钥和接入层密钥，K AMF是推演非接入层和接入层的根密钥。如图3D所示，非接入层密钥分为非接入层完整性保护密钥K NASint和非接入层加密密钥K NASenc；接入层密钥分为基站密钥K gNB、RRC完整性保护密钥K RRCint、RRC加密密钥K RRCenc、用户面完整性保护密钥K UPint、用户面加密密钥K UPenc。其中，RRC完整性保护密钥K RRCint、RRC加密密钥K RRCenc、用户面完整性保护密钥K UPint、用户面加密密钥K Upenc都是基于基站密钥和不同的安全算法推演出的不同密钥。
在无线通信中，对用户面和控制面传输的安全性要求越来越高。4G通信***中，发送端可以对控制面信令和用户面数据PDU执行加密处理，进一步还可以对控制面信令进行完整性保护处理，但是不支持对用户面数据PDU进行完整性保护处理。5G通信***中，考虑到用户面数据PDU的安全性，引入了对用户面数据PDU、SDAP控制PDU的完整性保护技术方案。也就是说，如图4所示，目前可支持RRC信令在PDCP层进行加密、完整性保护，支持数据承载的PDCP数据PDU在PDCP层进行加密、完整性保护，支持SDAP控制PDU在PDCP层进行完整性保护。对于除SDAP控制PDU之外的用户面控制PDU(比如PDCP控制PDU、RLC控制PDU、MAC CE)，目前尚未进行安全处理。
然而，由于用户面控制信息可能比较重要，如果被不法基站或者终端加以利用，对相关的用户面控制信息进行伪造或者监控，将会对无线通信造成很大的安全隐患。例如，MAC CE可能会被用来控制终端设备切换服务小区，一旦假基站仿冒MAC层切换信令，将会引起错误切换。
基于此，本申请将针对用户面控制信息的安全处理进行研究。具体来说，本申请实施例提供一种通信方法，即发送端可以在MAC层对用户面控制信息进行安全处理得到MAC PDU，并发送给接收端；相应地，接收端接收到MAC PDU后，可以在MAC层进行相应的安全处理，从而可以实现对用户面控制信息进行安全处理，提高用户面控制信息的安全 性。
为便于描述，本申请实施例中，将发送端所执行的安全处理称为第一安全处理，将接收端所执行的安全处理称为第二安全处理。其中，第二安全处理为第一安全处理的逆过程，比如第一安全处理为加密处理，则第二安全处理可以为解密处理；又比如，第一安全处理为完整性保护处理，则第二安全处理可以为完整性验证处理；又比如，第一安全处理包括加密处理和完整性保护处理，则第二安全处理可以包括解密处理和完整性验证处理。
本申请实施例中的发送端可以为第一通信装置，接收端可以为第二通信装置。在一个示例中，第一通信装置可以是接入网设备或能够支持接入网设备实现该方法所需的功能的通信装置，例如设置在接入网设备中的芯片或芯片***；第二通信装置可以是终端设备或能够支持终端设备实现该方法所需的功能的通信装置，例如设置在终端设备中的芯片或芯片***。
为了便于介绍，在下文中，以该方法由接入网设备和终端设备执行为例，也就是，以第一通信装置是接入网设备、第二通信装置是终端设备为例。如果将本申请实施例应用在图1所示的***架构，下文中所述的用于执行图5所示的实施例的接入设备可以是图1所示的***架构中的接入网设备(比如基站110a)，下文中所述的用于执行图5所示的实施例的终端设备可以是图1所示的***架构中的终端设备(比如终端设备120a)。
图5为本申请实施例一提供的通信方法所对应的流程示意图，如图5所示，该方法包括：
S501，接入网设备向终端设备发送使能信息，使能信息用于使能终端设备在MAC层进行第一安全处理和/或第二安全处理。
相应地，在S502中，终端设备接收来自接入网设备的使能信息。
本申请实施例中以使能信息用于使能终端设备在MAC层进行第一安全处理和第二安全处理为例，当使能信息用于使能终端设备在MAC层进行第一安全处理和第二安全处理时，也可以描述为，使能信息用于使能终端设备在MAC层进行安全处理。
在一个示例中，使能信息可以为布尔类型的信息，当取值为真(TURE)时，表示允许终端设备在MAC层进行第一安全处理和第二安全处理(即开启安全处理功能)，当取值为伪(FALSE)时，表示不允许终端设备在MAC层进行第一安全处理和第二安全处理(即关闭安全处理功能)。或者，使能信息也可以为枚举类型的信息，当取值为允许(Allowed)时，表示允许终端设备在MAC层进行第一安全处理和第二安全处理，当取值为不允许(Not allowed)时，表示不允许终端设备在MAC层进行第一安全处理和第二安全处理。其中，允许终端设备在MAC层进行第一安全处理和第二安全处理，可以是指：当终端设备作为发送端时，允许终端设备在MAC层进行第一安全处理；以及，当终端设备作为接收端时，允许终端设备在MAC层进行第二安全处理。
接入网设备可以通过多种可能的方式向终端设备发送使能信息，比如通过配置消息发送使能信息，配置消息可以为RRC重配置消息。
作为一种可能的实现，接入网设备还可以向终端设备发送指示信息，比如，通过配置消息发送指示信息，指示信息用于指示需要对哪些用户面控制信息进行第一安全处理。在一个示例中，指示信息可以包括需要进行第一安全处理的用户面控制信息的类型信息，其中，用户面控制信息的类型可以是根据协议层来划分的，例如来自SDAP层的控制PDU、来自PDCP层的控制PDU、来自RLC层的控制PDU、MAC层生成的MAC CE等。比如， 指示信息指示来自PDCP层的控制PDU需要进行第一安全处理，则对于MAC层来说，接收到包含有PDCP控制PDU的RLC数据PDU后，可以根据层间指示获知该RLC数据PDU包含有PDCP控制PDU，进而对该RLC数据PDU(即MAC SDU)进行第一安全处理。在又一个示例中，指示信息可以包括逻辑信道标识，该逻辑信道标识所对应的MAC CE需要进行第一安全处理。
通过执行上述S501和S502，终端设备可以开启安全处理功能，进而针对于下行传输，接入网设备可以在MAC层执行第一安全处理，终端设备可以在MAC层执行第二安全处理，具体可以参见S503至S505；针对于上行传输，终端设备可以在MAC层执行第一安全处理，接入网设备可以在MAC层执行第二安全处理，具体可以参见S506至S508。
需要说明的是，上述S501和S502为可选步骤，也可以通过其它可能的方式来使能终端设备的安全处理功能。
S503，接入网设备在MAC层对第一用户面控制信息进行第一安全处理，得到第一MAC PDU。
此处，第一MAC PDU可以包括N个第一MAC子PDU和M个第二MAC子PDU，N、M为大于或等于1的整数。每个第一MAC子PDU对应至少一个第二MAC子PDU，不同第一MAC子PDU对应的第二MAC子PDU不同，也就是说，N可以小于或等于M。本申请实施例中，第一MAC子PDU可以称为安全MAC子PDU，第二MAC子PDU可以称为被保护的MAC子PDU；进一步地，第一MAC子PDU所包括的MAC CE可以称为安全MAC CE，第二MAC子PDU所包括的MAC CE(或MAC SDU)可以称为被保护的MAC CE(或MAC SDU)。
需要说明的是，假设第一MAC PDU包括X个MAC子PDU，X为整数，则X可以大于N与M之和，即除N个第一MAC子PDU和M个第二MAC子PDU之外，第一MAC PDU还可以包括其它MAC子PDU，其它MAC子PDU可以为未被保护的MAC子PDU；或者，X也可以等于N与M之和，即除N个第一MAC子PDU和M个第二MAC子PDU之外，第一MAC PDU不再包括其它MAC子PDU。
下面分别对第一MAC子PDU和第二MAC子PDU进行介绍。
(1)第一MAC子PDU
第一MAC子PDU用于终端设备对第一MAC子PDU对应的第二MAC子PDU进行第二安全处理。比如，第一MAC子PDU对应一个第二MAC子PDU，则第一MAC子PDU用于终端设备对该第二MAC子PDU进行第二安全处理；又比如，第一MAC子PDU对应多个第二MAC子PDU，则第一MAC子PDU用于终端设备对这多个第二MAC子PDU进行第二安全处理。
作为一种可能的实现，第一MAC子PDU可以包括指示信息，指示信息用于指示第一MAC子PDU对应的第二MAC子PDU。指示信息可以承载于第一MAC子PDU的MAC子头中，比如占用MAC子头中的R字段的部分或全部比特；或者，指示信息承载于第一MAC子PDU的MAC CE中。
作为一种可能的实现，第一MAC子PDU的MAC子头中可以包括预设的逻辑信道标识。若某一MAC子PDU的MAC子头中包括预设的逻辑信道标识，则说明该MAC子PDU为第一MAC子PDU。也就是说，预设的逻辑信道标识用于指示该MAC子PDU为第一MAC子PDU(或安全MAC子PDU)，或者描述为，预设的逻辑信道标识用于指示该MAC 子PDU包括安全MAC CE，或者描述为，预设的逻辑信道标识用于指示该MAC子PDU为用于对第二MAC子PDU进行第二安全处理的MAC子PDU。
作为一种可能的实现，第一MAC子PDU可以包括第一安全处理的部分或全部输入参数，和/或，部分或全部输出参数(比如完整性保护参数)，具体在后文中描述。
(2)第二MAC子PDU
M个第二MAC子PDU可以包括第一用户面控制信息或经过第一安全处理后的第一用户面控制信息。比如，第一用户面控制信息包括M个MAC CE和/或MAC SDU，或者第一用户面控制信息包括M个MAC子PDU；其中，MAC SDU可以包括来自PDCP层的控制PDU、来自RLC层的控制PDU或来自SDAP层的控制PDU。
若第一安全处理为加密处理，则M个第二MAC子PDU可以包括经过加密处理后的第一用户面控制信息；若第一安全处理为完整性保护处理，则M个第二MAC子PDU可以包括第一用户面控制信息；若第一安全处理包括加密处理和完整性保护处理，则M个第二MAC子PDU可以包括经过加密处理后的第一用户面控制信息。
举个例子，M＝1，第一用户面控制信息包括MAC CE1；若第一安全处理包括加密处理和完整性保护处理，则第二MAC子PDU可以包括MAC CE1’(MAC CE1’为经过加密处理后的MAC CE1)。
再举个例子，M＝1，第一用户面控制信息包括MAC子PDU1，MAC子PDU1包括MAC CE1或者MAC SDU1；若第一安全处理包括加密处理和完整性保护处理，则第二MAC子PDU可以为MAC子PDU1’(MAC子PDU1’为经过加密处理后的MAC子PDU1)。
再举个例子，M＝2，第一用户面控制信息包括MAC CE1和MAC CE2；若第一安全处理包括加密处理和完整性保护处理，则其中一个第二MAC子PDU可以包括MAC CE1’，另一个第二MAC子PDU可以包括MAC CE2’(MAC CE2’为经过加密处理后的MAC CE2)。
再举个例子，M＝2，第一用户面控制信息包括MAC子PDU1和MAC子PDU2，MAC子PDU1包括MAC CE1或者MAC SDU1，MAC子PDU2包括MAC CE2或者MAC SDU2；若第一安全处理包括加密处理和完整性保护处理，则其中一个第二MAC子PDU可以为MAC子PDU1’，另一个第二MAC子PDU可以为MAC子PDU2’(MAC子PDU2’为经过加密处理后的MAC子PDU2)。
(3)第一MAC子PDU与第二MAC子PDU的位置关系
作为一种可能的实现，第一MAC子PDU可以位于第一MAC子PDU对应的所有第二MAC子PDU之前。如此，接收端(比如终端设备)在处理第二MAC子PDU之前，可以根据第一MAC子PDU所包括的指示信息获知哪些MAC子PDU为第二MAC子PDU，进而在解析到第二MAC子PDU后可立即进行第二安全处理，从而不会引入时延，提高处理效率。作为又一种可能的实现，第一MAC子PDU也可以位于第一MAC子PDU对应的所有第二MAC子PDU之后。
举个例子，第一MAC PDU包括第一MAC子PDU1，第一MAC子PDU1对应第二MAC子PDU1。参见图6A所示，第一MAC子PDU1与第二MAC子PDU1相邻，且第一MAC子PDU1可以位于第二MAC子PDU1之前，或者，第一MAC子PDU1也可以位于第二MAC子PDU1之后。
再举个例子，第一MAC PDU包括第一MAC子PDU1和第一MAC子PDU2，第一MAC子PDU1对应第二MAC子PDU1，第一MAC子PDU2对应第二MAC子PDU2。参 见图6B所示，第一MAC子PDU1与第二MAC子PDU1相邻，第一MAC子PDU2与第二MAC子PDU2相邻；第一MAC子PDU1可以位于第二MAC子PDU1之前，或者，第一MAC子PDU1也可以位于第二MAC子PDU1之后；第一MAC子PDU2可以位于第二MAC子PDU2之前，或者，第一MAC子PDU2也可以位于第二MAC子PDU2之后。
再举个例子，第一MAC PDU包括第一MAC子PDU1，第一MAC子PDU1对应第二MAC子PDU1a、第二MAC子PDU1b和第二MAC子PDU1c。参见图6C所示，第一MAC子PDU1可以与第二MAC子PDU1a相邻，位于第二MAC子PDU1a、第二MAC子PDU1b和第二MAC子PDU1c之前；或者，第一MAC子PDU1可以与第二MAC子PDU1c相邻，位于第二MAC子PDU1a、第二MAC子PDU1b和第二MAC子PDU1c之后。
如前文所述，第一MAC子PDU可以包括指示信息，指示信息用于指示第一MAC子PDU对应的第二MAC子PDU，具体的指示方式可以有多种，下面结合示例1至示例5对指示信息的几种可能的指示方式进行描述。
示例1
指示信息可以包括1个比特，比如，当该比特的取值为0时，表示第一MAC子PDU对应的第二MAC子PDU为第一MAC PDU中位于第一MAC子PDU之后的一个MAC子PDU(比如参见图6A中虚线上方所示意的图)；当该比特的取值为1时，表示第一MAC子PDU对应的第二MAC子PDU为第一MAC PDU中位于第一MAC子PDU之前的一个MAC子PDU(比如参见图6A中虚线下方所示意的图)。
示例2
指示信息可以包括两个比特，比如当两个比特的取值为00时，表示第一MAC子PDU对应的第二MAC子PDU为第一MAC PDU中除第一MAC子PDU之外的所有MAC子PDU；当两个比特的取值为01时，表示第一MAC子PDU对应的第二MAC子PDU为第一MAC PDU中位于第一MAC子PDU之前且与第一MAC子PDU相邻的一个MAC子PDU；当两个比特的取值为10时，表示第一MAC子PDU对应的第二MAC子PDU为第一MAC PDU中位于第一MAC子PDU之后且与第一MAC子PDU相邻的一个MAC子PDU；当两个比特的取值为11时，表示第一MAC子PDU对应的第二MAC子PDU为MAC PDU中除第一MAC子PDU之外的所有包含MAC CE的MAC子PDU。
示例3
指示信息可以指示一个数值K，表示第一MAC子PDU对应的第二MAC子PDU为第一MAC PDU中位于第一MAC子PDU之前或之后的K个MAC子PDU。其中，具体是“之前”还是“之后”可以是由协议预先约定的，或者也可以是由发送端通知给接收端的，又或者也可以通过一个额外的比特来指示(比如该比特的取值为0，表示“之前”，取值为1，表示“之后”；或者反之)。该示例中，指示信息所包括的比特个数可以根据实际需要设置。
示例4
指示信息可以包括可变长度的比特位图，比特位图中的一个比特对应第一MAC PDU中的一个MAC子PDU，比如比特位图中的比特按照从低到高的顺序依次对应第一MAC PDU中从左到右的各个MAC子PDU，即比特位图中最低位的比特对应第一MAC PDU中从左边起的第一个MAC子PDU，以此类推，比特位图中最高位的比特对应第一MAC PDU中从右边起的第一个MAC子PDU。又比如，比特位图中的比特按照从低到高的顺序依次对应第一MAC PDU中从右到左的各个MAC子PDU，即比特位图中最低位的比特对应第 一MAC PDU中从右边起的第一个MAC子PDU，以此类推，比特位图中最高位的比特对应第一MAC PDU中从左边起的第一个MAC子PDU。比特位图中某一个比特的取值为1，表示该比特对应的MAC子PDU为第一MAC子PDU对应的第二MAC子PDU，取值为0，表示该比特对应的MAC子PDU不是第一MAC子PDU对应的第二MAC子PDU。
可以理解地，上述示例4中是以比特位图中的比特与第一MAC PDU中的MAC子PDU一一对应为例进行描述，在其它可能的示例中，比特位图中的比特可以与第一MAC PDU中的第二MAC子PDU一一对应，比如比特位图中的比特按照从低到高的顺序依次对应第一MAC PDU中从左到右的各个第二MAC子PDU。
示例5
指示信息可以包括第一MAC子PDU对应的各个第二MAC子PDU相对于第一MAC子PDU的偏移量。比如，第一MAC子PDU对应第二MAC子PDU1，则指示信息可以包括第二MAC子PDU1的头部相对于第一MAC子PDU的头部或尾部的第一偏移量，以及第二MAC子PDU1的尾部相对于第一MAC子PDU的头部或尾部的第二偏移量。其中，第一偏移量和第二偏移量的单位可以为比特个数或字节个数。若第二MAC子PDU1位于第一MAC子PDU之前，则第一偏移量和第二偏移量可以为负值；若第二MAC子PDU1位于第一MAC子PDU之后，则第一偏移量和第二偏移量可以为正值。
或者，指示信息可以包括第一MAC子PDU对应的各个第二MAC子PDU相对于第一MAC子PDU的偏移量和第二MAC子PDU的长度。比如，第一MAC子PDU对应第二MAC子PDU1，则指示信息可以包括第二MAC子PDU1的头部相对于第一MAC子PDU的头部或尾部的偏移量以及第二MAC子PDU的长度。
采用示例5中的方式，当第二MAC子PDU包括加密后的MAC子PDU时，即使MAC子头被加密导致接收端无法确定MAC子PDU的边界，也依旧可以根据偏移量确定出第一MAC子PDU对应的第二MAC子PDU。
需要说明的是，在其它可能的情形中，第一MAC子PDU也可以不包括指示信息，此种情形下，可以通过协议约定第一MAC子PDU所对应的第二MAC子PDU的位置。
比如，通过协议约定第一MAC子PDU所对应的第二MAC子PDU为：与第一MAC子PDU相邻、且位于第一MAC子PDU之前的一个MAC子PDU。此处的“之前”也可以替换为“之后”。
又比如，通过协议约定第一MAC子PDU所对应的第二MAC子PDU包括：位于第一MAC子PDU之前的所有MAC子PDU。此处的“之前”也可以替换为“之后”。
又比如，通过协议约定第一MAC子PDU所对应的第二MAC子PDU为：位于第一MAC子PDU之前的、所有包含MAC CE的MAC子PDU。此处的“之前”也可以替换为“之后”。
又比如，第一MAC PDU包括一个第一MAC子PDU，通过协议约定第一MAC子PDU所对应的第二MAC子PDU为：第一MAC PDU所包含的、除第一MAC子PDU之外的所有MAC子PDU。
又比如，第一MAC PDU包括一个第一MAC子PDU，通过协议约定第一MAC子PDU所对应的第二MAC子PDU为：第一MAC PDU所包含的、除第一MAC子PDU之外的所有包含MAC CE的MAC子PDU。
下面对接入网设备对第一用户面控制信息进行第一安全处理进行介绍。
以第一安全处理包括加密处理和完整性保护处理为例，接入网设备对第一用户面控制信息进行第一安全处理所使用的输入参数可以包括以下至少一项：第一密钥；第一用户面控制信息；用于防止重放的安全处理参数；第一用户面控制信息对应的逻辑信道标识；传输方向；第一MAC子PDU的MAC子头中的预设的逻辑信道标识；同步信号块(synchronization signal block，SSB)的标识；发送第一用户面控制信息的服务小区的标识；用于调度第一用户面控制信息的控制资源集合的标识。
(1)第一密钥
第一密钥可以包括第一子密钥，或包括第二子密钥，或包括第一子密钥和第二子密钥。第一子密钥用于在MAC层对第一用户面控制信息进行加密/解密处理，第二子密钥用于在MAC层对第一用户面控制信息进行完整性保护/验证处理。
在一个示例中，第一密钥可以复用现有的接入层密钥，比如第一子密钥为K UPenc，第二子密钥为K UPint，又比如第一子密钥为K RRCenc，第二子密钥为K RRCint。采用该种方式，由于第一密钥复用现有的接入层密钥，从而无需额外确定第一密钥，能够有效降低处理负担，加快安全处理的效率。
(2)用于防止重放的安全处理参数
用于防止重放的安全处理参数可以包括以下至少一项：第一用户面控制信息的序列号(sequence number，SN)、第一用户面控制信息的计数值、第一用户面控制信息的时间戳，时间戳可以是***帧号的低N比特位。
其中，序列号可以是MAC层针对每个MAC子PDU来维护的，接收端的MAC层以相同的方式维护序列号，以保证两侧确定的序列号一致。多个MAC子PDU可以共用一个序列号。比如，一个MAC PDU对应一个序列号，该MAC PDU中所包括多个MAC子PDU共用该序列号。以第一用户面控制信息包括MAC CE1为例，第一用户面控制信息的序列号可以是指第二MAC子PDU1的序列号，第二MAC子PDU1包括MAC CE1或MAC CE1’(MAC CE1’为经过加密处理后的MAC CE1)。本申请实施例中，第二MAC子PDU1的序列号(或计数值)也可以描述为MAC CE1或MAC CE1’的序列号(或计数值)。
计数值可以是MAC层针对每个MAC子PDU来维护的，或者也可以是针对MAC PDU来维护的。具体来说，发送端的MAC实体可以针对每一个数据包(比如MAC子PDU)维护一个计数值，发送端在进行数据发送时，按照数据包的计数值从小到大的顺序依次进行第一安全处理；相应地，接收端的MAC实体以相同的计算方法针对每个数据包维护计数值，从而保证在向上层递交数据包的时候按照数据包的计数值从小到大的顺序依次进行第二安全处理。作为一种可能的实现，MAC子PDU的计数值是根据MAC子PDU的序列号和MAC层的超帧号(hyper frame number，HFN)来确定的，其中，MAC层的HFN由接入网设备和终端设备自行维护，初始值为0，当MAC子PDU的序列号达到最大值时，HFN加1。
在未引入用于防止重放的安全处理参数时，不同数据包进行第一安全处理的输入参数可能相同，从而导致输出参数也相同。因此，从接收端的角度来看，会接收到重复的数据包。此种情形下，若发送端发送了一个数据包，则可能有其它不法基站或终端伪造一个重复的数据包并发送，但接收端会误以为发送端发送了重复的数据包，而无法识别出伪造的数据包。当引入用于防止重放的安全处理参数(比如计数值)后，由于不同数据包的计数值不同，因此不同数据包进行第一安全处理的输入参数也不同，输出参数也不同，从而能 够有效避免不法基站或终端伪造重复的数据包。
下面以第一用户面控制信息包括MAC CE为例，结合两种情形对上述S503的相关实现进行介绍。
(1)情形1：第一用户面控制信息包括一个MAC CE(比如MAC CE1)。
在一个示例中，接入网设备可以在MAC层对MAC CE1进行第一安全处理(比如加密处理和完整性保护处理)，得到MAC CE1’、完整性保护参数1(比如MAC-I1)，进而将MAC CE1’作为MAC子PDU的负载，并增加一个MAC子头，将其封装为MAC子PDU，该MAC子PDU即为第二MAC子PDU，可称为第二MAC子PDU1。进一步地，接入网设备将第一安全处理的部分或全部输入参数(比如MAC CE1的SN1)和完整性保护参数1封装到MAC子PDU，该MAC子PDU即为第一MAC子PDU，可称为第一MAC子PDU1。比如，参见图7A所示，第一MAC子PDU1的MAC子头中可以包括预设的逻辑信道标识，MAC CE中可以包括SN1和MAC-I1。
需要说明的是，在其它可能的示例中，第一MAC子PDU所包括的MAC-I也可以替换为截短的MAC-I。当第一MAC子PDU包括截短的MAC-I时，可以通过协议预定义截短的MAC-I的长度，或者也可以由发送端向接收端发送截短的MAC-I的长度。本申请实施例中，以第一MAC子PDU包括MAC-I为例进行描述。
在又一个示例中，接入网设备可以将MAC CE1作为MAC子PDU1的负载，并增加一个MAC子头，将其封装为MAC子PDU1，进而在MAC层对该MAC子PDU1进行第一安全处理(比如加密处理和完整性保护处理)，得到MAC子PDU1’(即为加密后的MAC子PDU1)、完整性保护参数1(比如MAC-I1)，其中，MAC子PDU1’即为第二MAC子PDU，可称为第二MAC子PDU1。进一步地，接入网设备将第一安全处理的部分或全部输入参数(比如MAC CE1的SN1)和完整性保护参数1封装到MAC子PDU，该MAC子PDU即为第一MAC子PDU，可称为第一MAC子PDU1。
也就是说，接入网设备在MAC层对第一用户面控制信息(比如MAC CE)进行第一安全处理，可以是指接入网设备在MAC层对MAC CE进行第一安全处理，或者也可以是指接入网设备在MAC层对包含MAC CE的MAC子PDU进行第一安全处理。
(2)情形2：第一用户面控制信息包括多个MAC CE(比如MAC CE1、MAC CE2)。
针对于情形2，下面描述两种可能的实现方式，分别为实现方式1和实现方式2。
实现方式1
参见图7B所示，接入网设备可以在MAC层对MAC CE1进行第一安全处理(比如加密处理和完整性保护处理)，得到MAC CE1’、完整性保护参数1(比如MAC-I1)，进而将MAC CE1’作为MAC子PDU的负载，并增加一个MAC子头，将其封装为第二MAC子PDU1。进一步地，接入网设备将第一安全处理的部分或全部输入参数(比如MAC CE1的SN1)和完整性保护参数1封装到第一MAC子PDU1。以及，接入网设备可以在MAC层对MAC CE2进行加密处理和完整性保护处理，得到MAC CE2’、完整性保护参数2(比如MAC-I2)，进而将MAC CE2’作为MAC子PDU的负载，并增加一个MAC子头，将其封装为第二MAC子PDU2。进一步地，接入网设备将第一安全处理的部分或全部输入参数(比如MAC CE2的SN2)和完整性保护参数2封装到第一MAC子PDU2。
也就是说，在该种实现方式中，接入网设备可以针对多个MAC CE中的每个MAC CE(或者也可以是包含MAC CE的MAC子PDU)独立执行第一安全处理，并针对每个MAC  CE额外增加一个安全MAC子PDU。此外，多个MAC CE的序列号或计数值可以相同，也可以不同。
实现方式2
参见图7C所示，接入网设备可以在MAC层对MAC CE1、MAC CE2进行第一安全处理(比如加密处理和完整性保护处理)，得到MAC CE1’、MAC CE2’、完整性保护参数a(比如MAC-Ia)，进而将MAC CE1’作为MAC子PDU的负载，并增加一个MAC子头，将其封装为第二MAC子PDU1，以及将MAC CE2’作为MAC子PDU的负载，并增加一个MAC子头，将其封装为第二MAC子PDU2。进一步地，接入网设备将第一安全处理的部分或全部输入参数(比如MAC CE1的SN1，此处MAC CE2的SN2和SN1相同)和完整性保护参数a封装到第一MAC子PDU1中。
也就是说，在该种实现方式中，接入网设备可以对多个MAC CE(比如MAC CE1、MAC CE2)合并执行第一安全处理，或者接入网设备也可以对包含多个MAC CE的多个MAC子PDU(比如包含MAC CE1的MAC子PDU1、包含MAC CE2的MAC子PDU2)合并执行第一安全处理，从而能够有效节省处理负担，提高安全处理的效率；且针对多个MAC CE，只需额外新增一个安全MAC子PDU，能够有效降低传输开销。此外，多个MAC CE的序列号或计数值相同，即共用一个序列号或计数值，以便于合并执行第一安全处理。
S504，接入网设备向终端设备发送第一MAC PDU。
相应地，在S505中，终端设备接收来自接入网设备的第一MAC PDU，并对第一MAC PDU所包括的第二MAC子PDU进行第二安全处理。
此处，终端设备对第二MAC子PDU进行第二安全处理，可以是指：终端设备对第二MAC子PDU整体进行第二安全处理，或者也可以是指终端设备对第二MAC子PDU的负载部分进行第二安全处理。具体来说，若接入网设备是针对MAC CE或MAC SDU进行第一安全处理，则终端设备可以对第二MAC子PDU的负载部分进行第二安全处理；若接入网设备是针对MAC子PDU进行第一安全处理，则终端设备可以对第二MAC子PDU整体进行第二安全处理。
示例性地，终端设备对第一MAC PDU所包括的第二MAC子PDU进行第二安全处理后，若确定至少一个第二MAC子PDU的第二安全处理失败，则可以向接入网设备发送通知信息，通知信息用于通知第一MAC PDU所包括的第二MAC子PDU的第二安全处理失败。在一个示例中，通知信息可以包括第二安全处理失败的第二MAC子PDU对应的逻辑信道标识和/或第二安全处理失败的第二MAC子PDU的个数(或第二安全处理失败的次数)。此处，终端设备对第二MAC子PDU所执行的第二安全处理失败，说明用户面控制信息的传输可能存在安全问题，因此，终端设备将第二安全处理失败通知给接入网设备，便于接入网设备执行相应的操作以提高安全性。
S506，终端设备在MAC层对第二用户面控制信息进行第一安全处理，得到第二MAC PDU。
此处，第二用户面控制信息可以参见上文有关第一用户面控制信息的描述，二者的区别仅在于：第二用户面控制信息为上行用户面控制信息，而第一用户面控制信息为下行用户面控制信息。
第二MAC PDU可以参见上文有关第一MAC PDU的描述，二者的区别仅在于：第二MAC PDU为上行MAC PDU，而第一MAC PDU为下行MAC PDU。此外，针对于第二 MAC PDU，在一个示例中，假设MAC CE1包括缓存状态报告(buffer status report，BSR)，由于BSR的内容需要根据第二MAC PDU所包括的其它MAC子PDU的内容来确定，因此，包含MAC CE1的MAC子PDU生成时间较晚，会排列在其它MAC子PDU之后；如果包含MAC CE1的MAC子PDU需要和其它MAC子PDU一起进行第一安全处理(具体实现参照前文的实现方式2)，则它们对应的第一MAC子PDU可以排列在第二MAC PDU中的最后面。
终端设备在MAC层对第二用户面控制信息进行第一安全处理的实现可以参照上述S503的描述，不再赘述。
S507，终端设备向接入网设备发送第二MAC PDU。
相应地，在S508中，接入网设备接收来自终端设备的第一MAC PDU，并对第二MAC PDU所包括的第二MAC子PDU进行第二安全处理。
示例性地，接入网设备对第二MAC PDU所包括的第二MAC子PDU进行第二安全处理时，若确定某一第二MAC子PDU的第二安全处理失败，则可以释放终端设备的RRC连接，使得终端设备由RRC连接态进入空闲态，或者也可以执行其它可能的操作，具体取决于接入网设备的内部实现，本申请实施例对此不做限定。
采用上述方法，由于接入网设备(或终端设备)对用户面控制信息执行第一安全处理所生成的MAC PDU中可以包括N个第一MAC子PDU和M个第二MAC子PDU，N个第一MAC子PDU为额外生成的、用于保护M个第二MAC子PDU的MAC子PDU，从而能够在实现对用户面控制信息进行安全处理的同时，对现有的MAC PDU格式影响较小，且可以灵活实现对MAC PDU中的一个或多个MAC CE或MAC SDU进行安全处理。
此外，需要说明的是：
(1)上述内容是以第一MAC子PDU不参与第一安全处理为例进行描述的，在其它可能的示例中，第一MAC子PDU也可以参与第一安全处理。比如，当第一安全处理为完整性保护处理时，第一MAC子PDU也可以和第二MAC子PDU一起进行完整性保护处理，进而输出完整性保护参数，该完整性保护参数可以携带在第一MAC子PDU中。若采用该种方式，则对于终端设备来说，可以先从第一MAC子PDU中取出完整性保护参数，进而对第一MAC子PDU(不包括完整性保护参数)和第二MAC子PDU进行完整性验证处理。示例性地，接入网设备和终端设备可以预先约定第一MAC子PDU是否参与第一安全处理，或者也可以通过其它的方式指示第一MAC子PDU是否参与第一安全处理。此外，当第一MAC子PDU参与第一安全处理时，第一MAC子PDU对应的第二MAC子PDU还可以包括第一MAC子PDU自身。
(2)上述所描述的用于防止重放的安全处理参数是第一安全处理的可选输入参数，若在进行第一安全处理时，不使用用于防止重放的安全处理参数，即第一安全处理的输入参数不包括用于防止重放的安全处理参数，则上面各个例子中的第一MAC子PDU中也无需携带相应的SN。
上述内容是将接入网设备作为一个整体进行描述的，参见前文有关接入网设备的描述可知，接入网设备也可以包括分离的节点，比如参见图2B和图2C所示。当接入网设备包括分离的节点时，上述图5中所涉及的接入网设备也可以替换为DU，即可以由DU来执行图5中接入网设备所执行的操作。
考虑到当接入网设备包括分离的节点(比如CU和DU)时，MAC层位于DU，通常情况下，DU部署在室外，物理安全性相比于CU来说较差，因此，为了进一步提高安全性，本申请实施例中，DU在MAC层进行安全处理所使用的第一密钥可以不同于CU进行安全处理所使用的密钥。
图8为本申请实施例提供的通信方法所对应的流程示意图，如图8所示，该方法包括：
S801，CU接收来自核心网网元的第二密钥。
此处，核心网网元可以为接入和移动管理功能(access and mobility management function，AMF)网元，第二密钥可以包括基站密钥K gNB和/或下一跳(next hop，NH)，NH可以参考现有协议中的定义。
S802，CU根据所述第一密钥推演得到第三密钥和第四密钥，第三密钥用于对控制面信令进行第一安全处理或第二安全处理，第四密钥用于对用户面数据进行第一安全处理或第二安全处理。
比如，第三密钥可以包括RRC完整性保护密钥K RRCint和/或RRC加密密钥K RRCenc，第四密钥可以包括用户面完整性保护密钥K UPint和/或用户面加密密钥K UPenc。
S803，CU根据第二密钥、第三密钥、第四密钥中的至少一项，推演得到第一密钥。
此处，CU可以根据第二密钥、第三密钥、第四密钥中的至少一项进行一次或多次推演，得到第一密钥。这里的推演可以理解为，根据输入参数和安全算法进行特定运算，得到输出参数的过程，例如输入参数包括第二密钥、第三密钥、第四密钥中的至少一项，输出参数为第一密钥，安全算法可以为新引入的MAC层的安全算法。
参见表1所示，目前已有的算法类型包括非接入层的加密算法、非接入层的完整性保护算法、RRC层的加密算法、RRC层的完整性保护算法、用户面的加密算法、用户面的完整性保护算法，在此基础上，本申请实施例可以引入MAC层的安全算法，比如MAC层的加密算法、MAC层的完整性保护算法。
表1：多种安全算法类型示例
Figure PCTCN2022120943-appb-000001
Figure PCTCN2022120943-appb-000002
在一个示例中，CU可以根据第二密钥和MAC层的安全算法进行推演，得到第一密钥。
在又一个示例中，CU可以根据第三密钥和MAC层的安全算法进行推演，得到第一密钥；或者，CU可以根据第三密钥和随机数进行推演，得到第一密钥。
在又一个示例中，CU可以根据第四密钥和MAC层的安全算法进行推演，得到第一密钥；或者，CU可以根据第四密钥和随机数进行推演，得到第一密钥。
上述随机数也可以替换为协议预定义的数值。
S804，CU向DU发送第一密钥。
此处，CU向DU发送第一密钥的实现方式可以有多种，比如CU可以通过用户上下文建立请求(UE context setup request)消息或者用户上下文修改请求(UE context modification request)消息向DU发送第一密钥。
S805，DU接收来自CU的第一密钥，并采用第一密钥在MAC层进行第一安全处理或第二安全处理。
比如，DU可以采用第一密钥在MAC层对第一用户面控制信息进行第一安全处理，得到第一MAC PDU，或者也可以采用第一密钥在MAC层对第二MAC PDU进行第二安全处理，得到第二用户面控制信息，具体可以参照上述实施例一中的描述。相应地，终端设备也可以根据第二密钥、第三密钥、第四密钥中的至少一项，推演得到第一密钥；进而采用第一密钥在MAC层对第二用户面控制信息进行第一安全处理，得到第二MAC PDU，或者也可以采用第一密钥在MAC层对第一MAC PDU进行第二安全处理，得到第一用户面控制信息。
采用上述方式，DU在MAC层进行安全处理所使用的密钥不同于CU所使用的密钥，从而能够实现密钥隔离，避免DU密钥被窃取后，CU的安全性也无法保障的问题。
上述主要从设备交互的角度对本申请实施例提供的方案进行了介绍。可以理解的是，为了实现上述功能，接入网设备或终端设备可以包括执行各个功能相应的硬件结构和/或软件模块。本领域技术人员应该很容易意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，本申请的实施例能够以硬件或硬件和计算机软件的结合形式来实现。某个功能究竟以硬件还是计算机软件驱动硬件的方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
本申请实施例可以根据上述方法示例对接入网设备或终端设备进行功能单元的划分，例如，可以对应各个功能划分各个功能单元，也可以将两个或两个以上的功能集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
在采用集成的单元的情况下，图9示出了本申请实施例中所涉及的装置的可能的示例性框图。如图9所示，装置900可以包括：处理单元902和通信单元903。处理单元902用于对装置900的动作进行控制管理。通信单元903用于支持装置900与其他设备的通信。可选地，通信单元903也称为收发单元，可以包括接收单元和/或发送单元，分别用于执行接收和发送操作。装置900还可以包括存储单元901，用于存储装置900的程序代码和/或 数据。
该装置900可以为上述实施例中的接入网设备、或者还可以为设置在接入网设备中的芯片。处理单元902可以支持装置900执行上文中各方法示例(比如图5或图8)中接入网设备的动作。或者，处理单元902主要执行方法示例(比如图5或图8)中的接入网设备的内部动作，通信单元903可以支持装置900与其它设备之间的通信。
比如，在一个实施例中，处理单元902用于：在MAC层对用户面控制信息进行第一安全处理，得到MAC PDU；通信单元903用于：向终端设备发送所述MAC PDU；其中，所述MAC PDU包括N个第一MAC子PDU和M个第二MAC子PDU，每个第一MAC子PDU对应至少一个第二MAC子PDU，所述第一MAC子PDU用于所述终端设备对所述第一MAC子PDU对应的第二MAC子PDU进行第二安全处理，所述M个第二MAC子PDU包括所述用户面控制信息或经过第一安全处理后的所述第一用户面控制信息；N、M为大于或等于1的整数。
在又一个实施例中，通信单元903用于：接收来自终端设备的MAC PDU，所述MAC PDU包括N个第一MAC子PDU和M个第二MAC子PDU，每个第一MAC子PDU对应至少一个第二MAC子PDU，所述M个第二MAC子PDU包括用户面控制信息或经过第一安全处理后的所述第一用户面控制信息，N、M为大于或等于1的整数；处理单元902用于：根据所述第一MAC子PDU，在MAC层对所述第一MAC子PDU对应的第二MAC子PDU进行第二安全处理。
该装置900可以为上述实施例中的终端设备、或者还可以为设置在终端设备中的芯片。处理单元902可以支持装置900执行上文中各方法示例(比如图5)中终端设备的动作。或者，处理单元902主要执行方法示例(比如图5)中的终端设备的内部动作，通信单元903可以支持装置900与其它设备之间的通信。
比如，在一个实施例中，处理单元902用于：在MAC层对用户面控制信息进行第一安全处理，得到MAC PDU；通信单元903用于：向接入网设备发送所述MAC PDU；其中，所述MAC PDU包括N个第一MAC子PDU和M个第二MAC子PDU，每个第一MAC子PDU对应至少一个第二MAC子PDU，所述第一MAC子PDU用于所述接入网设备对所述第一MAC子PDU对应的第二MAC子PDU进行第二安全处理，所述M个第二MAC子PDU包括所述用户面控制信息或经过第一安全处理后的所述第一用户面控制信息；N、M为大于或等于1的整数。
在又一个实施例中，通信单元903用于：接收来自接入网设备的MAC PDU，所述MAC PDU包括N个第一MAC子PDU和M个第二MAC子PDU，每个第一MAC子PDU对应至少一个第二MAC子PDU，所述M个第二MAC子PDU包括用户面控制信息或经过第一安全处理后的所述第一用户面控制信息，N、M为大于或等于1的整数；处理单元902用于：根据所述第一MAC子PDU，在MAC层对所述第一MAC子PDU对应的第二MAC子PDU进行第二安全处理。
应理解以上装置中单元的划分仅仅是一种逻辑功能的划分，实际实现时可以全部或部分集成到一个物理实体上，也可以物理上分开。且装置中的单元可以全部以软件通过处理元件调用的形式实现；也可以全部以硬件的形式实现；还可以部分单元以软件通过处理元件调用的形式实现，部分单元以硬件的形式实现。例如，各个单元可以为单独设立的处理元件，也可以集成在装置的某一个芯片中实现，此外，也可以以程序的形式存储于存储器 中，由装置的某一个处理元件调用并执行该单元的功能。此外这些单元全部或部分可以集成在一起，也可以独立实现。这里所述的处理元件又可以成为处理器，可以是一种具有信号的处理能力的集成电路。在实现过程中，上述方法的各操作或以上各个单元可以通过处理器元件中的硬件的集成逻辑电路实现或者以软件通过处理元件调用的形式实现。
在一个例子中，以上任一装置中的单元可以是被配置成实施以上方法的一个或多个集成电路，例如：一个或多个特定集成电路(application specific integrated circuit，ASIC)，或，一个或多个微处理器(digital singnal processor，DSP)，或，一个或者多个现场可编程门阵列(field programmable gate array，FPGA)，或这些集成电路形式中至少两种的组合。再如，当装置中的单元可以通过处理元件调度程序的形式实现时，该处理元件可以是处理器，比如通用中央处理器(central processing unit，CPU)，或其它可以调用程序的处理器。再如，这些单元可以集成在一起，以片上***(system-on-a-chip，SOC)的形式实现。
以上用于接收的单元是一种该装置的接口电路，用于从其它装置接收信号。例如，当该装置以芯片的方式实现时，该接收单元是该芯片用于从其它芯片或装置接收信号的接口电路。以上用于发送的单元是一种该装置的接口电路，用于向其它装置发送信号。例如，当该装置以芯片的方式实现时，该发送单元是该芯片用于向其它芯片或装置发送信号的接口电路。
参见图10，为本申请实施例提供的一种接入网设备的结构示意图，该接入网设备(或基站)可应用于如图1所示的***架构中，执行上述方法实施例中接入网设备的功能。接入网设备100可包括一个或多个DU 1001和一个或多个CU 1002。所述DU 1001可以包括至少一个天线10011，至少一个射频单元10012，至少一个处理器10013和至少一个存储器10014。所述DU 1001部分主要用于射频信号的收发以及射频信号与基带信号的转换，以及部分基带处理。CU1002可以包括至少一个处理器10022和至少一个存储器10021。
所述CU 1002部分主要用于进行基带处理，对接入网设备进行控制等。所述DU 1001与CU 1002可以是物理上设置在一起，也可以物理上分离设置的，即分布式基站。所述CU 1002为接入网设备的控制中心，也可以称为处理单元，主要用于完成基带处理功能。例如所述CU 1002可以用于控制接入网设备执行上述方法实施例中关于接入网设备的操作流程。
此外，可选的，接入网设备100可以包括一个或多个射频单元，一个或多个DU和一个或多个CU。其中，DU可以包括至少一个处理器10013和至少一个存储器10014，射频单元可以包括至少一个天线10011和至少一个射频单元10012，CU可以包括至少一个处理器10022和至少一个存储器10021。
在一个实例中，所述CU1002可以由一个或多个单板构成，多个单板可以共同支持单一接入指示的无线接入网(如5G网)，也可以分别支持不同接入制式的无线接入网(如LTE网，5G网或其他网)。所述存储器10021和处理器10022可以服务于一个或多个单板。也就是说，可以每个单板上单独设置存储器和处理器。也可以是多个单板共用相同的存储器和处理器。此外每个单板上还可以设置有必要的电路。所述DU1001可以由一个或多个单板构成，多个单板可以共同支持单一接入指示的无线接入网(如5G网)，也可以分别支持不同接入制式的无线接入网(如LTE网，5G网或其他网)。所述存储器10014和处理器10013可以服务于一个或多个单板。也就是说，可以每个单板上单独设置存储器和处理器。也可以是多个单板共用相同的存储器和处理器。此外每个单板上还可以设置有必要的电路。
图10所示的接入网设备能够实现图5、图8所示意的方法实施例中涉及接入网设备的各个过程。图10所示的接入网设备中的各个模块的操作和/或功能，分别为了实现上述方法实施例中的相应流程。具体可参见上述方法实施例中的描述，为避免重复，此处适当省略详述描述。
参见图11，为本申请实施例提供的一种终端设备的结构示意图，用于实现以上实施例中终端设备的操作。如图11所示，该终端设备包括：天线1110、射频部分1120、信号处理部分1130。天线1110与射频部分1120连接。在下行方向上，射频部分1120通过天线1110接收网络设备发送的信息，将网络设备发送的信息发送给信号处理部分1130进行处理。在上行方向上，信号处理部分1130对终端设备的信息进行处理，并发送给射频部分1120，射频部分1120对终端设备的信息进行处理后经过天线1110发送给网络设备。
信号处理部分1130可以包括调制解调子***，用于实现对数据各通信协议层的处理；还可以包括中央处理子***，用于实现对终端设备操作***以及应用层的处理；此外，还可以包括其它子***，例如多媒体子***，周边子***等，其中多媒体子***用于实现对终端设备相机，屏幕显示等的控制，周边子***用于实现与其它设备的连接。调制解调子***可以为单独设置的芯片。
调制解调子***可以包括一个或多个处理元件1131，例如，包括一个主控CPU和其它集成电路。此外，该调制解调子***还可以包括存储元件1132和接口电路1133。存储元件1132用于存储数据和程序，但用于执行以上方法中终端设备所执行的方法的程序可能不存储于该存储元件1132中，而是存储于调制解调子***之外的存储器中，使用时调制解调子***加载使用。接口电路1133用于与其它子***通信。
该调制解调子***可以通过芯片实现，该芯片包括至少一个处理元件和接口电路，其中处理元件用于执行以上终端设备执行的任一种方法的各个步骤，接口电路用于与其它装置通信。在一种实现中，终端设备实现以上方法中各个步骤的单元可以通过处理元件调度程序的形式实现，例如用于终端设备的装置包括处理元件和存储元件，处理元件调用存储元件存储的程序，以执行以上方法实施例中终端设备执行的方法。存储元件可以为与处理元件处于同一芯片上的存储元件，即片内存储元件。
在另一种实现中，用于执行以上方法中终端设备所执行的方法的程序可以在与处理元件处于不同芯片上的存储元件，即片外存储元件。此时，处理元件从片外存储元件调用或加载程序于片内存储元件上，以调用并执行以上方法实施例中终端设备执行的方法。
在又一种实现中，终端设备实现以上方法中各个步骤的单元可以是被配置成一个或多个处理元件，这些处理元件设置于调制解调子***上，这里的处理元件可以为集成电路，例如：一个或多个ASIC，或，一个或多个DSP，或，一个或者多个FPGA，或者这些类集成电路的组合。这些集成电路可以集成在一起，构成芯片。
终端设备实现以上方法中各个步骤的单元可以集成在一起，以SOC的形式实现，该SOC芯片，用于实现以上方法。该芯片内可以集成至少一个处理元件和存储元件，由处理元件调用存储元件的存储的程序的形式实现以上终端设备执行的方法；或者，该芯片内可以集成至少一个集成电路，用于实现以上终端设备执行的方法；或者，可以结合以上实现方式，部分单元的功能通过处理元件调用程序的形式实现，部分单元的功能通过集成电路的形式实现。
可见，以上用于终端设备的装置可以包括至少一个处理元件和接口电路，其中至少一 个处理元件用于执行以上方法实施例所提供的任一种终端设备执行的方法。处理元件可以以第一种方式：即调用存储元件存储的程序的方式执行终端设备执行的部分或全部步骤；也可以以第二种方式：即通过处理器元件中的硬件的集成逻辑电路结合指令的方式执行终端设备执行的部分或全部步骤；当然，也可以结合第一种方式和第二种方式执行终端设备执行的部分或全部步骤。
这里的处理元件同以上描述，可以通过处理器实现，处理元件的功能可以和图9中所描述的处理单元的功能相同。示例性地，处理元件可以是通用处理器，例如CPU，还可以是被配置成实施以上方法的一个或多个集成电路，例如：一个或多个ASIC，或，一个或多个微处理器DSP，或，一个或者多个FPGA等，或这些集成电路形式中至少两种的组合。存储元件可以通过存储器实现，存储元件的功能可以和图9中所描述的存储单元的功能相同。存储元件可以是一个存储器，也可以是多个存储器的统称。
图11所示的终端设备能够实现上述方法实施例中涉及终端设备的各个过程。图11所示的终端设备中的各个模块的操作和/或功能，分别为了实现上述方法实施例中的相应流程。具体可参见上述方法实施例中的描述，为避免重复，此处适当省略详述描述。
本申请实施例中的术语“***”和“网络”可被互换使用。“至少一个”是指一个或者多个，“多个”是指两个或两个以上。“和/或”，描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A、同时存在A和B、单独存在B的情况，其中A，B可以是单数或者复数。字符“/”一般表示前后关联对象是一种“或”的关系。“以下至少一项(个)”或其类似表达，是指的这些项中的任意组合，包括单项(个)或复数项(个)的任意组合。例如“A，B和C中的至少一个”包括A，B，C，AB，AC，BC或ABC。以及，除非有特别说明，本申请实施例提及“第一”、“第二”等序数词是用于对多个对象进行区分，不用于限定多个对象的顺序、时序、优先级或者重要程度。
本领域内的技术人员应明白，本申请的实施例可提供为方法、***、或计算机程序产品。因此，本申请可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实施例的形式。而且，本申请可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、CD-ROM、光学存储器等)上实施的计算机程序产品的形式。
本申请是参照根据本申请的方法、设备(***)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个 方框或多个方框中指定的功能的步骤。
显然，本领域的技术人员可以对本申请进行各种改动和变型而不脱离本申请的精神和范围。这样，倘若本申请的这些修改和变型属于本申请权利要求及其等同技术的范围之内，则本申请也意图包含这些改动和变型在内。

Claims (29)

  1. 一种通信方法，其特征在于，所述方法包括：
    第一通信装置在媒体接入控制MAC层对用户面控制信息进行第一安全处理，得到MAC协议数据单元PDU；
    所述第一通信装置向第二通信装置发送所述MAC PDU；
    其中，所述MAC PDU包括N个第一MAC子PDU和M个第二MAC子PDU，所述N个第一MAC子PDU中的每个第一MAC子PDU对应所述M个第二MAC子PDU中的至少一个第二MAC子PDU，所述第一MAC子PDU用于所述第二通信装置对所述第一MAC子PDU对应的第二MAC子PDU进行第二安全处理，所述M个第二MAC子PDU包括所述用户面控制信息或经过第一安全处理后的所述第一用户面控制信息；
    N、M为大于或等于1的整数。
  2. 根据权利要求1所述的方法，其特征在于，所述用户面控制信息包括以下至少一项：
    所述MAC层生成的MAC控制单元CE；
    来自分组数据汇聚层协议PDCP层的控制PDU；
    来自无线链路控制RLC层的控制PDU；
    来自业务数据适配协议SDAP层的控制PDU。
  3. 根据权利要求1或2所述的方法，其特征在于，所述第一MAC子PDU包括指示信息，所述指示信息用于指示所述第一MAC子PDU对应的第二MAC子PDU。
  4. 根据权利要求3所述的方法，其特征在于，所述指示信息承载于所述第一MAC子PDU的MAC子头中，或者，所述指示信息承载于所述第一MAC子PDU的MAC CE中。
  5. 根据权利要求1至4中任一项所述的方法，其特征在于，所述第一MAC子PDU的MAC子头包括预设的逻辑信道标识，所述预设的逻辑信道标识用于指示包括所述预设的逻辑信道标识的MAC子PDU为所述第一MAC子PDU。
  6. 根据权利要求1至5中任一项所述的方法，其特征在于，所述第一MAC子PDU的MAC CE包括以下至少一项：
    所述第一MAC子PDU对应的第二MAC子PDU的序列号；
    所述第一MAC子PDU对应的第二MAC子PDU的计数值；
    所述第一MAC子PDU对应的第二MAC子PDU的完整性保护参数。
  7. 根据权利要求1至6中任一项所述的方法，其特征在于，所述方法还包括：
    所述第一通信装置向所述第二通信装置发送使能信息，所述使能信息用于使能所述第二通信装置在MAC层进行所述第一安全处理和/或所述第二安全处理。
  8. 根据权利要求7所述的方法，其特征在于，所述方法还包括：
    接收来自所述第二通信装置的通知信息，所述通知信息用于通知所述MAC PDU所包括的第二MAC子PDU的第二安全处理失败，所述通知信息包括第二安全处理失败的第二MAC子PDU对应的逻辑信道标识和/或第二安全处理失败的第二MAC子PDU的个数。
  9. 根据权利要求1至6中任一项所述的方法，其特征在于，所述方法还包括：
    接收来自所述第二通信装置的使能信息，所述使能信息用于使能所述第二通信装置在MAC层进行所述第一安全处理和/或所述第二安全处理。
  10. 根据权利要求1至9中任一项所述的方法，其特征在于，所述第一通信装置在MAC 层对用户面控制信息进行第一安全处理，包括：
    所述第一通信装置使用第一密钥在MAC层对用户面控制信息进行第一安全处理，所述第一密钥是根据第二密钥、第三密钥、第四密钥中的至少一项推演得到的；
    其中，所述第二密钥用于推演得到所述第三密钥和所述第四密钥，所述第三密钥用于对控制面信令进行第一安全处理或第二安全处理，所述第四密钥用于对用户面数据进行第一安全处理或第二安全处理。
  11. 一种通信方法，其特征在于，所述方法包括：
    第二通信装置接收来自第一通信装置的MAC PDU，所述MAC PDU包括N个第一MAC子PDU和M个第二MAC子PDU，所述N个第一MAC子PDU中的每个第一MAC子PDU对应所述M个第二MAC子PDU中的至少一个第二MAC子PDU，所述M个第二MAC子PDU包括用户面控制信息或经过第一安全处理后的所述第一用户面控制信息，N、M为大于或等于1的整数；
    所述第二通信装置根据所述第一MAC子PDU，在MAC层对所述第一MAC子PDU对应的第二MAC子PDU进行第二安全处理。
  12. 根据权利要求11所述的方法，其特征在于，所述用户面控制信息包括以下至少一项：
    所述MAC层生成的MAC CE；
    来自PDCP层的控制PDU；
    来自RLC层的控制PDU；
    来自SDAP层的控制PDU。
  13. 根据权利要求11或12所述的方法，其特征在于，所述第一MAC子PDU包括指示信息，所述指示信息用于指示所述第一MAC子PDU对应的第二MAC子PDU。
  14. 根据权利要求13所述的方法，其特征在于，所述指示信息承载于所述第一MAC子PDU的MAC子头中，或者，所述指示信息承载于所述第一MAC子PDU的MAC CE中。
  15. 根据权利要求11至14中任一项所述的方法，其特征在于，所述第一MAC子PDU的MAC子头包括预设的逻辑信道标识，所述预设的逻辑信道标识用于指示包括所述预设的逻辑信道标识的MAC子PDU为所述第一MAC子PDU。
  16. 根据权利要求11至15中任一项所述的方法，其特征在于，所述第一MAC子PDU的MAC CE包括以下至少一项：
    所述第一MAC子PDU对应的第二MAC子PDU的序列号；
    所述第一MAC子PDU对应的第二MAC子PDU的计数值；
    所述第一MAC子PDU对应的第二MAC子PDU的完整性保护参数。
  17. 根据权利要求11至16中任一项所述的方法，其特征在于，所述方法还包括：
    接收来自所述第一通信装置的使能信息，所述使能信息用于使能所述第二通信装置在MAC层进行所述第一安全处理和/或所述第二安全处理。
  18. 根据权利要求17所述的方法，其特征在于，所述方法还包括：
    接收来自所述第二通信装置的通知信息，所述通知信息用于通知所述MAC PDU所包括的第二MAC子PDU的第二安全处理失败，所述通知信息包括第二安全处理失败的第二MAC子PDU对应的逻辑信道标识和/或第二安全处理失败的第二MAC子PDU的个数。
  19. 根据权利要求11至16中任一项所述的方法，其特征在于，所述方法还包括：
    所述第二通信装置向所述第一通信装置发送使能信息，所述使能信息用于使能所述第一通信装置在MAC层进行所述第一安全处理和/或所述第二安全处理。
  20. 根据权利要求11至19中任一项所述的方法，其特征在于，所述第二通信装置根据所述第一MAC子PDU，在MAC层对所述第一MAC子PDU对应的第二MAC子PDU进行第二安全处理，包括：
    所述第二通信装置根据所述第一MAC子PDU，使用第一密钥在MAC层对所述第一MAC子PDU对应的第二MAC子PDU进行第二安全处理，所述第一密钥是根据第二密钥、第三密钥、第四密钥中的至少一项推演得到的；
    其中，所述第二密钥用于推演得到所述第三密钥和所述第四密钥，所述第三密钥用于对控制面信令进行第一安全处理或第二安全处理，所述第四密钥用于对用户面数据进行第一安全处理或第二安全处理。
  21. 一种通信装置，其特征在于，包括用于执行如权利要求1至10中任一项所述方法的模块。
  22. 一种通信装置，其特征在于，包括用于执行如权利要求11至20中任一项所述方法的模块。
  23. 一种通信装置，其特征在于，包括处理器和存储器，所述处理器和所述存储器耦合，所述处理器用于实现如权利要求1至10中任一项所述的方法。
  24. 一种通信装置，其特征在于，包括处理器和存储器，所述处理器和所述存储器耦合，所述处理器用于实现如权利要求11至20中任一项所述的方法。
  25. 一种通信装置，其特征在于，包括处理器和接口电路，所述接口电路用于接收来自所述通信装置之外的其它通信装置的信号并传输至所述处理器或将来自所述处理器的信号发送给所述通信装置之外的其它通信装置，所述处理器通过逻辑电路或执行代码指令用于实现如权利要求1至10中任一项所述的方法。
  26. 一种通信装置，其特征在于，包括处理器和接口电路，所述接口电路用于接收来自所述通信装置之外的其它通信装置的信号并传输至所述处理器或将来自所述处理器的信号发送给所述通信装置之外的其它通信装置，所述处理器通过逻辑电路或执行代码指令用于实现如权利要求11至20中任一项所述的方法。
  27. 一种通信***，其特征在于，所述通信***包括如权利要求21、23或25所述的通信装置，以及如权利要求22、24或26所述的通信装置。
  28. 一种计算机可读存储介质，其特征在于，所述存储介质中存储有计算机程序或指令，当所述计算机程序或指令被通信装置执行时，实现如权利要求1至20中任一项所述的方法。
  29. 一种计算机程序产品，其特征在于，所述计算机程序产品包括指令，当所述指令被计算机运行时，实现如权利要求1至20中任一项所述的方法。
PCT/CN2022/120943 2021-09-28 2022-09-23 一种通信方法及装置 WO2023051409A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202111143477.1A CN115884173A (zh) 2021-09-28 2021-09-28 一种通信方法及装置
CN202111143477.1 2021-09-28

Publications (1)

Publication Number Publication Date
WO2023051409A1 true WO2023051409A1 (zh) 2023-04-06

Family

ID=85763472

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/120943 WO2023051409A1 (zh) 2021-09-28 2022-09-23 一种通信方法及装置

Country Status (2)

Country Link
CN (1) CN115884173A (zh)
WO (1) WO2023051409A1 (zh)

Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2011021866A2 (en) * 2009-08-21 2011-02-24 Samsung Electronics Co., Ltd. Method and system for data transmission on an access link
US20120039471A1 (en) * 2009-04-21 2012-02-16 Sun Hee Kim Efficient security-related processing
CN106465183A (zh) * 2016-09-20 2017-02-22 北京小米移动软件有限公司 数据传输方法、装置及***
CN109586900A (zh) * 2017-09-29 2019-04-05 华为技术有限公司 数据安全处理方法及装置
CN111600831A (zh) * 2019-04-30 2020-08-28 维沃移动通信有限公司 信令传输的方法和设备
CN112166623A (zh) * 2018-06-14 2021-01-01 Oppo广东移动通信有限公司 一种控制安全功能的方法及装置、网络设备、终端设备
CN113273236A (zh) * 2019-01-18 2021-08-17 高通股份有限公司 媒体接入控制安全性

Patent Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20120039471A1 (en) * 2009-04-21 2012-02-16 Sun Hee Kim Efficient security-related processing
WO2011021866A2 (en) * 2009-08-21 2011-02-24 Samsung Electronics Co., Ltd. Method and system for data transmission on an access link
CN106465183A (zh) * 2016-09-20 2017-02-22 北京小米移动软件有限公司 数据传输方法、装置及***
CN109586900A (zh) * 2017-09-29 2019-04-05 华为技术有限公司 数据安全处理方法及装置
CN112166623A (zh) * 2018-06-14 2021-01-01 Oppo广东移动通信有限公司 一种控制安全功能的方法及装置、网络设备、终端设备
CN113273236A (zh) * 2019-01-18 2021-08-17 高通股份有限公司 媒体接入控制安全性
CN111600831A (zh) * 2019-04-30 2020-08-28 维沃移动通信有限公司 信令传输的方法和设备

Also Published As

Publication number Publication date
CN115884173A (zh) 2023-03-31

Similar Documents

Publication Publication Date Title
US10887942B2 (en) Method and apparatus for transmitting/receiving data in mobile communication system
US12010592B2 (en) Sidelink communications method and apparatus
US20200260355A1 (en) Data transmission system, method, and apparatus
US8670369B2 (en) Method, relay node, and system for processing data on relay link
AU2018202590A1 (en) Apparatus, system and method of securing communications of a user equipment (ue) in a wireless local area network
WO2018058687A1 (zh) 一种处理控制信令的方法、设备及***
EP3840518B1 (en) Rrc connection method and terminal
EP4114127A1 (en) Method, apparatus and system for configuring radio bearer
WO2018084202A1 (ja) 無線端末及び基地局
WO2023005929A1 (zh) 一种通信方法及装置
WO2023051409A1 (zh) 一种通信方法及装置
WO2021238813A1 (zh) 一种获取密钥的方法及装置
CN113455034B (zh) 一种通信方法及装置
WO2016136492A1 (ja) 無線端末及び基地局
CN115668822A (zh) 用信号通知网络编码操作的暂停和恢复的方法和设备
CN112640570B (zh) 一种下行数据早传方法及装置
WO2023213191A1 (zh) 安全保护方法及通信装置
WO2023098209A1 (zh) 一种数据传输保护方法、设备及***
WO2022267450A1 (zh) 数据传输方法、pdcp发送实体、网络设备以及存储介质
WO2022170545A1 (zh) 一种无线链路的重建方法和装置
EP4322606A1 (en) Communication method and device
KR20230047837A (ko) 통신 시스템에서 사용자 평면 보안을 위한 방법, 장치 및 시스템
CN116980838A (zh) 一种通信方法及装置
CN115174491A (zh) 一种通信方法及通信装置
CN116803114A (zh) 方法、基础设施设备和通信装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22874795

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE