WO2023125604A1 - 一种通信方法及装置 - Google Patents

一种通信方法及装置 Download PDF

Info

Publication number
WO2023125604A1
WO2023125604A1 PCT/CN2022/142614 CN2022142614W WO2023125604A1 WO 2023125604 A1 WO2023125604 A1 WO 2023125604A1 CN 2022142614 W CN2022142614 W CN 2022142614W WO 2023125604 A1 WO2023125604 A1 WO 2023125604A1
Authority
WO
WIPO (PCT)
Prior art keywords
system information
security
message
network device
terminal device
Prior art date
Application number
PCT/CN2022/142614
Other languages
English (en)
French (fr)
Inventor
酉春华
娄崇
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2023125604A1 publication Critical patent/WO2023125604A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3236—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/12—Detection or prevention of fraud
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/30—Security of mobile devices; Security of mobile applications

Definitions

  • the present application relates to the technical field of communication, and in particular to a communication method and device.
  • the system information is mainly composed of a master system block (master information block, MIB) and multiple system information blocks (system information block, SIB).
  • the SIB mainly includes SIB1 and other SIBs. Among them, MIB and SIB1 are broadcast periodically, and other SIBs can be broadcast periodically or on demand.
  • the MIB mainly includes cell barred status information and the physical layer necessary information for receiving subsequent SIBs, for example, control resource set (control resource set#0, CORESET#0) configuration.
  • SIB1 mainly includes scheduling information of other system information and initial access information.
  • the system information obtained by the terminal device Information may be tampered with, posing a security risk.
  • Embodiments of the present application provide a communication method and device, which prevent system information from being tampered with and improve system information security.
  • an embodiment of the present application provides a communication method, which is applied to a terminal device, or a chip in a terminal device, including: receiving first indication information and security parameter information sent by a first network device, the first The indication information is used to indicate that the system information acquisition mechanism based on security verification is allowed to be used, and the security parameter information is used to perform security verification on the system information; a first message is sent to the second network device, and the first message uses for requesting first system information based on security verification.
  • a system information acquisition mechanism based on security verification is used to request system information from a network device. Since SRB1 has security protection after SRB1 recovers, the network device transmits system information with security protection through SRB1 to avoid tampering of system information and improve the security of system information.
  • second indication information of the second network device is received, where the second indication information is used to indicate that the second network device supports the security check-based system information.
  • the second indication information is used to inform the terminal device that it can request system information based on security verification.
  • the first message is a radio resource control RRC system information request message or a dedicated system information request message.
  • a second message sent by the second network device is received, the second message includes the first system information, and the second message is for security protection; according to the security Parameter information, performing security check on the second message.
  • the first system information sent by the second network device is received, and the first system information is not protected by security.
  • the hash security instruction sent by the second network device is received, the hash security instruction includes a hash parameter, and the hash parameter is used to determine a hash of the first system information. Hash value; sending a hash value of the first system information to the second network device, where the hash value of the first system information is used to determine whether the first system information received by the terminal device is tamper. In the case that the first system information received by the terminal device is not protected, by calculating the hash value of the first system information, it is determined whether the received first system information has been tampered with, thereby improving the security of the system information sex.
  • receiving a third message sent by the second network device the third message is for security protection; performing security check on the third message according to the security protection parameters .
  • the security of the third information is ensured by performing a security check on the third message.
  • the third message includes third indication information, where the third indication information is used to indicate whether the first system information received by the terminal device has been tampered with. Whether the first system information received by the terminal device has been tampered with is indicated through the third indication information, so as to prompt the security of the received first system information.
  • the third message when the first system information received by the terminal device is tampered with, the third message includes the first system information that has not been tampered with. In the case that the first system information is tampered with, the security of the system information is ensured by retransmitting the first system information.
  • the embodiment of the present application provides a communication method, the method is applied to the second network device, or a chip in the second network device, the method includes: receiving a first message sent by the terminal device, the first A message is used to request first system information based on security verification; and send the first system information to the terminal device.
  • a system information acquisition mechanism based on security verification is used to request system information from a network device. Since SRB1 has security protection after SRB1 recovers, the network device transmits system information with security protection through SRB1 to avoid tampering of system information and improve the security of system information.
  • second indication information is sent to the terminal device, where the second indication information is used to indicate that the second network device supports the security check-based system information.
  • the second indication information is used to inform the terminal device that it can request system information based on security verification.
  • the first message is a radio resource control RRC system information request message or a dedicated system information request message.
  • the first system information is included in a second message, and the second message is secured.
  • the security protection on the second message the security of the first system information is ensured, and the first system information is prevented from being tampered with.
  • a first request is sent to the first network device; and a first response sent by the first network device is received, where the first response includes security protection parameters, and the security protection parameters are Determined by the parameter information, the security protection parameters are used to perform security protection on the second message.
  • the second network device requests security protection parameters from the first network device, and then performs security protection on the second message according to the security protection parameters, so as to ensure the security of the first system information transmitted to the terminal device, Prevent the information of the first system from being tampered with.
  • the first request includes a cause value, where the cause value is the terminal device requesting the first system information based on security verification, and the cause value is used to indicate that the first A network device determines whether to perform an anchor bit.
  • the first response is also used to indicate to perform an anchor position.
  • the second message is included, the second message includes the first system information, and the second message is for security protection.
  • the first network device performs security protection on the first system information to ensure the security of the first system information transmitted to the terminal device and prevent the first system information from being tampered with.
  • the second request includes a cause value, where the cause value is the terminal device requesting the first system information based on security verification, and the cause value is used to indicate that the first A network device determines whether to perform an anchor bit.
  • the second response is also used to indicate not to perform an anchor position.
  • the first system information is not protected.
  • a third request is sent to the first network device, where the third request is used to request a hash parameter for security verification; and a third response sent by the first network device is received, and the The third response includes a third message including the hash parameter.
  • the terminal device receives the first system information without security protection, it requests the hash parameter from the first network device to perform security verification on the first system information to ensure the security of the first system information and avoid the first system Information has been tampered with.
  • the third request includes a cause value, where the cause value is the terminal device requesting the first system information based on security verification, and the cause value is used to indicate that the first A network device determines whether to perform an anchor bit.
  • the third response is also used to indicate not to perform an anchor position.
  • send a hash security instruction to the terminal device where the hash security instruction includes a hash parameter, and the hash parameter is used to determine a hash value of the first system information;
  • Receive a hash value of the first system information sent by the terminal device where the hash value of the first system information is used to determine whether the first system information received by the terminal device has been tampered with.
  • the second network device determines whether the first system information has been tampered with by calculating the hash value of the first system information and the received hash value of the terminal device, so as to ensure the security of the first system information and prevent the first system information from being tampered with.
  • a third message is sent to the terminal device, and the third message is for security protection. Security of information is ensured by performing security protection on the third message.
  • the third message includes third indication information, where the third indication information is used to indicate whether the first system information received by the terminal device has been tampered with.
  • the third message when the first system information received by the terminal device is tampered with, the third message includes the first system information that has not been tampered with.
  • the embodiment of the present application provides a communication method, the method is applied to the first network device, or a chip in the first network device, the method includes: the method includes: obtaining security parameter information;
  • the device sends first indication information and security parameter information, where the first indication information is used to indicate that a system information acquisition mechanism based on security verification is allowed to be used, and the security parameter information is used to perform security verification on the system information.
  • a system information acquisition mechanism based on security verification is used to request system information from a network device. Since SRB1 has security protection after SRB1 recovers, the network device transmits system information with security protection through SRB1 to avoid tampering of system information and improve the security of system information.
  • the first request sent by the second network device is received; and a first response is sent to the second network device, where the first response includes a security protection parameter, and the security protection parameter is based on the The security parameter information is determined, and the security protection parameter is used for security protection of system information.
  • the second network device requests security protection parameters from the first network device, and then performs security protection on the second message according to the security protection parameters, so as to ensure the security of the first system information transmitted to the terminal device, Prevent the information of the first system from being tampered with.
  • the first request includes a cause value, where the cause value is the terminal device requesting the first system information based on security verification, and the cause value is used to indicate that the first A network device determines whether to perform an anchor bit.
  • the first response is also used to indicate to perform an anchor position.
  • the first network device performs security protection on the first system information to ensure the security of the first system information transmitted to the terminal device and prevent the first system information from being tampered with.
  • the second request includes a cause value, where the cause value is the terminal device requesting the first system information based on security verification, and the cause value is used to indicate that the first A network device determines whether to perform an anchor bit.
  • the second response is also used to indicate not to perform an anchor position.
  • the third response includes a third message including the hash parameters.
  • the third request includes a cause value, where the cause value is the terminal device requesting the first system information based on security verification, and the cause value is used to indicate that the first A network device determines whether to perform an anchor bit.
  • the third response is also used to indicate not to perform an anchor position.
  • an embodiment of the present application provides a communication method, the method is applied to a terminal device, or a chip in a terminal device, and the method includes: the method includes: sending a first message to the network device, the first A message is used to request the first system information based on the security verification; and receive the first system information of the NAS security protection.
  • the method includes: sending a first message to the network device, the first A message is used to request the first system information based on the security verification; and receive the first system information of the NAS security protection.
  • network devices transmit system information through NAS messages, and terminal devices use NAS security mechanisms to perform security checks on system information, preventing terminal devices from receiving tampered system information and improving the security of system information .
  • indication information sent by a network device is received, where the indication information is used to indicate that the network device supports the security check-based system information.
  • the terminal device is notified through the indication information that it can request system information based on security verification.
  • security verification is performed on the received first system information through NAS security.
  • the NAS security is used to verify the first system information, preventing the terminal device from receiving tampered first system information, and improving the security of the system information.
  • the embodiment of the present application provides a communication method, the method is applied to a network device, or a chip in the network device, and the method includes: receiving a first message sent by a terminal device, the first message being used for Requesting the first system information based on security verification; sending the first system information of NAS security protection to the terminal device.
  • a communication method the method is applied to a network device, or a chip in the network device, and the method includes: receiving a first message sent by a terminal device, the first message being used for Requesting the first system information based on security verification; sending the first system information of NAS security protection to the terminal device.
  • RRC IDLE terminal devices network devices transmit system information through NAS messages, and terminal devices use NAS security mechanisms to perform security checks on system information to prevent terminal devices from receiving tampered system information and improve the security of system information.
  • indication information is sent to the terminal device, where the indication information is used to indicate that the network device supports the security check-based system information.
  • the terminal device is notified through the indication information that it can request system information based on security verification.
  • a fourth request is sent to the core network device, where the fourth request includes the first system information requested by the terminal device; and a fourth response sent by the core network device is received, and the fourth request includes the first system information requested by the terminal device;
  • the four responses include first system information for NAS security protection.
  • the embodiment of the present application provides a communication method, the method is applied to a terminal device, or a chip in a terminal device, and the method includes: sending a first message to the network device, and the first message is used to request Based on the first system information of security verification; receiving a security activation command sent by a network device, where the security activation command is used to activate AS security.
  • AS security is not activated, and terminal devices can request NAS to activate AS security.
  • Network devices protect system information through AS security, and terminal devices perform security verification on system information through activated AS security, which prevents terminal devices from receiving tampered system information and improves the security of system information.
  • indication information sent by a network device is received, where the indication information is used to indicate that the network device supports the security check-based system information.
  • the terminal device is notified through the indication information that it can request system information based on security verification.
  • a security activation complete message is sent to the network device.
  • the first system information may be transmitted based on the activated AS security by sending a security activation complete message to inform that activation of the AS security has been completed.
  • the embodiment of the present application provides a communication method, the method is applied to a network device, or a chip in the network device, and the method includes: receiving a first message sent by a terminal device, the first message being used for Requesting to send a security activation command to the terminal device based on the first system information of the security verification, where the security activation command is used to activate AS security.
  • AS security is not activated, and terminal devices can request NAS to activate AS security.
  • Network devices protect system information through AS security, and terminal devices perform security verification on system information through activated AS security to prevent terminal devices from receiving tampered system information and improve the security of system information.
  • indication information is sent to the terminal device, where the indication information is used to indicate that the network device supports the security check-based system information.
  • the terminal device is notified through the indication information that it can request system information based on security verification.
  • a fifth request is sent to the core network device, where the fifth request includes a cause value, and the cause value is that the terminal device requests the first system information based on security verification; the receiving core network device sends
  • the fifth response is an AS security activation command.
  • the AS security of the terminal equipment in RRC IDLE is activated through the AS security activation command.
  • the security activation completion message sent by the terminal device is received.
  • the first system information may be transmitted based on the activated AS security by sending a security activation complete message to inform that activation of the AS security has been completed.
  • the embodiment of the present application provides a communication device, including:
  • a receiving module configured to receive first indication information and security parameter information sent by the first network device, where the first indication information is used to indicate that the system information acquisition mechanism based on security verification is allowed to be used, and the security parameter information is used for Perform security checks on system information;
  • a sending module configured to send a first message to the second network device, where the first message is used to request first system information based on security verification.
  • the receiving module is further configured to receive second indication information from the second network device, where the second indication information is used to indicate that the second network device supports the security check-based Checked system information.
  • the first message is a radio resource control RRC system information request message or a dedicated system information request message.
  • the receiving module is further configured to receive a second message sent by the second network device, the second message includes the first system information, and the second message is to perform security protection;
  • the device also includes:
  • a processing module configured to perform security check on the second message according to the security parameter information.
  • the receiving module is further configured to receive the first system information sent by the second network device, and the first system information is not protected by security.
  • the receiving module is further configured to receive a hash security instruction sent by the second network device, the hash security instruction includes a hash parameter, and the hash parameter is used to determine a hash value of the first system information;
  • the sending module is further configured to send a hash value of the first system information to the second network device, where the hash value of the first system information is used to determine the first system information received by the terminal device. Whether the information has been tampered with.
  • the receiving module is further configured to receive a third message sent by the second network device, and the third message is for security protection;
  • the device also includes:
  • a processing module configured to perform security check on the third message according to the security protection parameters.
  • the third message includes third indication information, where the third indication information is used to indicate whether the first system information received by the terminal device has been tampered with.
  • the third message when the first system information received by the terminal device is tampered with, the third message includes the first system information that has not been tampered with.
  • the embodiment of the present application provides a communication device, including:
  • a receiving module configured to receive a first message sent by the terminal device, where the first message is used to request first system information based on security verification;
  • a sending module configured to send the first system information to the terminal device.
  • the sending module is further configured to send second indication information to the terminal device, where the second indication information is used to indicate that the second network device supports the security check-based system message.
  • the first message is a radio resource control RRC system information request message or a dedicated system information request message.
  • the first system information is included in a second message, and the second message is secured.
  • the sending module is further configured to send the first request to the first network device
  • the receiving module is further configured to receive a first response sent by the first network device, the first response includes a security protection parameter, the security protection parameter is determined according to security parameter information, and the security protection parameter uses for performing security protection on the second message.
  • the first request includes a cause value, where the cause value is the terminal device requesting the first system information based on security verification, and the cause value is used to indicate that the first A network device determines whether to perform an anchor bit.
  • the first response is also used to indicate to perform an anchor position.
  • the sending module is further configured to send a second request to the first network device, where the second request includes the first system information
  • the receiving module is further configured to receive a second response sent by the first network device, the second response includes the second message, the second message includes the first system information, and the second Messages are secured.
  • the second request includes a cause value, where the cause value is the terminal device requesting the first system information based on security verification, and the cause value is used to indicate that the first A network device determines whether to perform an anchor bit.
  • the second response is also used to indicate not to perform an anchor position.
  • the first system information is not protected.
  • the sending module is further configured to send a third request to the first network device, where the third request is used to request a hash parameter for security verification;
  • the receiving module is further configured to receive a third response sent by the first network device, the third response includes a third message, and the third message includes the hash parameter.
  • the third request includes a cause value, where the cause value is the terminal device requesting the first system information based on security verification, and the cause value is used to indicate that the first A network device determines whether to perform an anchor bit.
  • the third response is also used to indicate not to perform an anchor position.
  • the sending module is further configured to send a hash security instruction to the terminal device, where the hash security instruction includes a hash parameter, and the hash parameter is used to determine the first A hash value of system information;
  • the receiving module is further configured to receive a hash value of the first system information sent by the terminal device, where the hash value of the first system information is used to determine the first system information received by the terminal device. Whether the system information has been tampered with.
  • the sending module is further configured to send a third message to the terminal device, where the third message is secured.
  • the third message includes third indication information, where the third indication information is used to indicate whether the first system information received by the terminal device has been tampered with.
  • the third message when the first system information received by the terminal device is tampered with, the third message includes the first system information that has not been tampered with.
  • the embodiment of the present application provides a communication device, including:
  • An acquisition module configured to acquire security parameter information
  • a sending module configured to send first indication information and security parameter information to the terminal device, where the first indication information is used to indicate that the system information acquisition mechanism based on security verification is allowed to be used, and the security parameter information is used for system information Perform a security check.
  • the acquiring module is further configured to receive the first request sent by the second network device;
  • the sending module is further configured to send a first response to the second network device, the first response includes a security protection parameter, the security protection parameter is determined according to the security parameter information, and the security protection parameter Used for security protection of system information.
  • the first request includes a cause value, where the cause value is the terminal device requesting the first system information based on security verification, and the cause value is used to indicate that the first A network device determines whether to perform an anchor bit.
  • the first response is also used to indicate to perform an anchor position.
  • the acquiring module is further configured to receive a second request sent by a second network device, where the second request includes the first system information;
  • the sending module is further configured to send a second response to the second network device, the second response includes a second message, the second message includes the first system information, and the second message is based on The security parameter information is protected.
  • the second request includes a cause value, where the cause value is the terminal device requesting the first system information based on security verification, and the cause value is used to indicate that the first A network device determines whether to perform an anchor bit.
  • the second response is also used to indicate not to perform an anchor position.
  • the acquiring module is further configured to receive a third request sent by the second network device, where the third request includes a hash parameter requesting security verification;
  • the sending module is further configured to send a third response to the second network device, the third response includes a third message, and the third message includes the hash parameter.
  • the third request includes a cause value, where the cause value is the terminal device requesting the first system information based on security verification, and the cause value is used to indicate that the first A network device determines whether to perform an anchor bit.
  • the third response is also used to indicate not to perform an anchor position.
  • the embodiment of the present application provides a communication device, including:
  • a sending module configured to send a first message to the network device, where the first message is used to request first system information based on security verification;
  • the receiving module is configured to receive the first system information of NAS security protection.
  • the receiving module is further configured to receive indication information sent by a network device, where the indication information is used to indicate that the network device supports the security check-based system information.
  • the device further includes a processing module
  • the processing module is configured to perform security verification on the received first system information through NAS security.
  • the embodiment of the present application provides a communication device, including:
  • a receiving module configured to receive a first message sent by the terminal device, where the first message is used to request first system information based on security verification;
  • a sending module configured to send the first system information of NAS security protection to the terminal device.
  • the sending module is further configured to send indication information to the terminal device, where the indication information is used to indicate that the network device supports the security check-based system information.
  • the sending module is further configured to send a fourth request to the core network device, where the fourth request includes the first system information requested by the terminal device; the receiving module is also configured to After receiving the fourth response sent by the core network device, the fourth response includes the first system information of NAS security protection.
  • the embodiment of the present application provides a communication device, including:
  • a sending module configured to send a first message to the network device, where the first message is used to request first system information based on security verification;
  • the receiving module is configured to receive a security activation command sent by the network device, and the security activation command is used to activate AS security.
  • the receiving module is further configured to receive indication information sent by a network device, where the indication information is used to indicate that the network device supports the security check-based system information.
  • the sending module is further configured to send a security activation completion message to the network device.
  • the embodiment of the present application provides a communication party device, including:
  • a receiving module configured to receive a first message sent by the terminal device, where the first message is used to request first system information based on security verification;
  • a sending module configured to send a security activation command to the terminal device, where the security activation command is used to activate AS security.
  • the sending module is further configured to send indication information to the terminal device, where the indication information is used to indicate that the network device supports the security check-based system information.
  • the sending module is further configured to send a fifth request to the core network device, where the fifth request includes a reason value, and the reason is that the terminal device requests the first system based on security verification.
  • the receiving module is further configured to receive a fifth response sent by a core network device, where the fifth response is an AS security activation command.
  • the receiving module is further configured to receive a security activation completion message sent by the terminal device.
  • the embodiment of the present application provides a communication device, the communication device is configured to implement the first aspect, the fourth aspect, the sixth aspect, and any of the first aspect, the fourth aspect, and the sixth aspect
  • the methods and functions performed by the terminal device in a possible design are implemented by hardware/software, and the hardware/software includes modules corresponding to the above functions.
  • an embodiment of the present application provides a communication device configured to implement the method performed by the second network device in the first aspect and any possible design of the first aspect and functions are realized by hardware/software, and the hardware/software includes modules corresponding to the above-mentioned functions.
  • an embodiment of the present application provides a communication device configured to implement the method performed by the first network device in any possible design of the above third aspect and any possible design of the third aspect and functions are realized by hardware/software, and the hardware/software includes modules corresponding to the above-mentioned functions.
  • the present application provides a communication device.
  • the device may be a terminal device, or a device in the terminal device, or a device that can be matched with the terminal device.
  • the communication device may also be a system on a chip.
  • the communication device can execute the method described in the first aspect.
  • the functions of the communication device may be realized by hardware, or may be realized by executing corresponding software by hardware.
  • the hardware or software includes one or more modules corresponding to the above functions. This module can be software and/or hardware.
  • the present application provides a communication device, which may be a second network device, or a device in the second network device, or a device that can be used in conjunction with the second network device.
  • the communication device may also be a system on a chip.
  • the communication device can execute the method described in the second aspect.
  • the functions of the communication device may be realized by hardware, or may be realized by executing corresponding software by hardware.
  • the hardware or software includes one or more modules corresponding to the above functions. This module can be software and/or hardware.
  • the present application provides a communication device.
  • the device may be the first network device, or a device in the first network device, or a device that can be matched with the first network device.
  • the communication device may also be a system on a chip.
  • the communication device can execute the method described in the third aspect.
  • the functions of the communication device may be realized by hardware, or may be realized by executing corresponding software by hardware.
  • the hardware or software includes one or more modules corresponding to the above functions. This module can be software and/or hardware.
  • the present application provides a communication device, the communication device includes a processor, when the processor calls the computer program in the memory, as described in any one of the first to seventh aspects method is executed.
  • the present application provides a communication device, the communication device includes a processor and a memory, the memory is used to store a computer program; the processor is used to execute the computer program stored in the memory so that The communication device executes the method according to any one of the first aspect to the seventh aspect.
  • the present application provides a communication device, the communication device includes a processor, a memory, and a transceiver, the transceiver is used to receive a channel or a signal, or send a channel or a signal; the memory, It is used to store a computer program; the processor is used to call the computer program from the memory to execute the method according to any one of the first aspect to the seventh aspect.
  • the present application provides a communication device, the communication device includes a processor and an interface circuit, the interface circuit is used to receive a computer program and transmit it to the processor; the processor runs the The above computer program is used to execute the method according to any one of the first aspect to the seventh aspect.
  • the present application provides a computer-readable storage medium, the computer-readable storage medium is used to store a computer program, and when the computer program is executed, the Any one of the described methods is implemented.
  • the present application provides a computer program product including a computer program.
  • the computer program When the computer program is executed, the method according to any one of the first aspect to the seventh aspect is implemented.
  • the embodiment of the present application provides a communication system, the communication system includes at least one terminal device and at least one network device, and the terminal device is used to implement the first aspect, the fourth aspect, and the sixth aspect
  • the steps in the above-mentioned second aspect, the third aspect, the fifth aspect and the seventh aspect are performed by the network device.
  • FIG. 1(A) is a schematic structural diagram of a communication system provided by an embodiment of the present application.
  • FIG. 1(B) is a schematic structural diagram of another communication system provided by an embodiment of the present application.
  • Fig. 2 is a schematic diagram of recovering from RRC inactive to RRC connected state
  • FIG. 3 is a schematic flowchart of a communication method provided in an embodiment of the present application.
  • FIG. 4 is a schematic flowchart of another communication method provided by an embodiment of the present application.
  • FIG. 5 is a schematic flowchart of another communication method provided by an embodiment of the present application.
  • FIG. 6 is a schematic flowchart of another communication method provided by an embodiment of the present application.
  • FIG. 7 is a schematic flowchart of another communication method provided by an embodiment of the present application.
  • FIG. 8 is a schematic structural diagram of a communication device provided by an embodiment of the present application.
  • FIG. 9 is a schematic structural diagram of a communication device provided by an embodiment of the present application.
  • FIG. 10 is a schematic structural diagram of a communication device provided by an embodiment of the present application.
  • FIG. 11 is a schematic structural diagram of a terminal device provided by an embodiment of the present application.
  • FIG. 12 is a schematic structural diagram of a second network device provided by an embodiment of the present application.
  • Fig. 13 is a schematic structural diagram of a first network device provided by an embodiment of the present application.
  • FIG. 1(A) is a schematic structural diagram of a communication system provided by an embodiment of the present application.
  • the communication system includes two parts: Next generation radio access network (NG-RAN) and core network (5GC, 5rd generation core network).
  • NG-RAN is used to implement functions related to wireless access.
  • NG-RAN mainly includes RAN nodes.
  • the core network mainly includes an access and mobility management function (access and mobility management function, AMF) entity, and a user plane function (user plane function, UPF) entity. in:
  • AMF access and mobility management function
  • UPF user plane function
  • the RAN node provides wireless access equipment for terminal equipment, and the RAN node includes a 5G base station (next generation node B, gNB) or an LTE base station (not next generation evolved Node B, ng-eNB).
  • gNB it provides the termination point of new radio (new radio, NR) user plane and control plane protocol
  • ng-eNB it provides evolved UMTS terrestrial radio access network (Evolved UMTS terrestrial radio access network, E-UTRAN) users The termination point of the protocol stack of the control plane and the control plane.
  • gNB and gNB, gNB and ng-eNB, and ng-eNB and ng-eNB are connected through the Xn interface.
  • gNB and ng-eNB are connected to 5GC through the next generation (NG) interface. Specifically, it is connected with the AMF entity through the NG-C interface, and is connected with the UPF entity through the NR-U interface.
  • NG next generation
  • the AMF entity is mainly responsible for mobility management in the mobile network, such as user location update, user registration network, user handover, etc.
  • the UPF entity is mainly responsible for processing user packets, such as forwarding and charging.
  • FIG. 1(B) is a schematic structural diagram of another communication system provided by an embodiment of the present application.
  • the communication system 100 may include a network device 110 and terminal devices 101 - 106 . It should be understood that more or less network devices or terminal devices may be included in the communication system 100 to which the method of the embodiment of the present application can be applied.
  • a network device or a terminal device may be hardware, or functionally divided software, or a combination of the above two. Network devices and terminal devices can communicate through other devices or network elements.
  • the network device 110 can send downlink data to the terminal devices 101 - 106 .
  • the terminal devices 101 - 106 may also send uplink data to the network device 110 .
  • Terminal equipment 101 ⁇ terminal equipment 106 can be cellular phone, smart phone, portable computer, handheld communication device, handheld computing device, satellite radio device, global positioning system, palm computer (personal digital assistant, PDA) and/or be used in wireless Any other suitable device for communicating over the communication system 100, and the like.
  • the network device 110 may be a long term evolution (long term evolution, LTE) and/or NR network device, specifically a base station (NodeB), an evolved base station (eNodeB), a base station in a 5G mobile communication system, a next-generation mobile Communication base station (Next generation Node B, gNB), the base station in the future mobile communication system or the access node in the Wi-Fi system.
  • LTE long term evolution
  • NR network device specifically a base station (NodeB), an evolved base station (eNodeB), a base station in a 5G mobile communication system, a next-generation mobile Communication base station (Next generation Node B, gNB), the base station in the future mobile communication system or the access node in
  • the communication system 100 may adopt public land mobile network (public land mobile network, PLMN), vehicle networking (vehicle to everything, V2X), device-to-device (device-to-device, D2D) network, machine to machine (machine to machine, M2M) network, Internet of things (IoT) or other networks.
  • PLMN public land mobile network
  • V2X vehicle networking
  • device-to-device device-to-device
  • D2D device-to-device
  • M2M machine to machine
  • IoT Internet of things
  • the terminal device 104 to the terminal device 106 may also form a communication system.
  • the terminal device 105 can send downlink data to the terminal device 104 or the terminal device 106 .
  • the method in the embodiment of the present application may be applied to the communication system 100 shown in FIG. 1(B).
  • the third generation partnership project (3rd generation partnership project, 3GPP) introduced three RRC states in the 5G network: RRC idle state (RRC IDLE), RRC inactive state (RRC INACTIVE), and RRC connected state (RRC CONNECTED ).
  • the dedicated RRC connection may be a data radio bearer (data radio bearers, DRB) or a signaling radio bearer 1 (signalling radio bearers1, SRB1 connection.
  • the terminal device In the RRC idle state, the terminal device does not have a dedicated RRC connection with the network device.
  • the terminal device moves under the network device without notifying the network device.
  • the terminal device saves its own context, and finally the base station (Last serving gNB) that provides services for the terminal device saves the context of the terminal device and the NG connection with the AMF entity and UPF.
  • the dedicated RRC connection between the terminal device and the network device is suspended and can be resumed later.
  • the terminal equipment performs cell reselection in the RRC inactive state.
  • the RRC inactive state is a new RRC state added to 5G, and the purpose is to enable the terminal device to quickly return to the RRC connection state without re-connection.
  • the RRC inactive state is similar to the RRC idle state, both of which can only receive content broadcast (paging) of the public search space, and can perform cell reselection, and the principle of cell reselection is the same as that of the RRC idle state.
  • the power consumption level similar to that in the RRC idle state can be obtained, because the terminal device in the RRC inactive state will suspend data processing, and if the terminal device moves in the same network device, it does not need to communicate with Network devices exchange information.
  • the UE in the RRC inactive state can have a lower data transmission recovery delay, because the UE in the RRC inactive state can quickly migrate to the RRC connected state through the RRC resume (resume) process.
  • RAN notification area RNA
  • Figure 2 is a schematic diagram of restoring from RRC inactive to RRC connected state.
  • the UE is the terminal device
  • the Last serving gNB is the second base station for description.
  • the second base station saves the context of the UE, the UE moves out of the coverage of the second base station, enters the coverage of the first base station, and initiates an RRC recovery process.
  • the terminal device When the terminal device is in an inactive state, it sends an RRC resume request (RRC resume request) to the first base station, and the RRC resume request may carry an inactive radio network temporary identity (I-RNTI).
  • RRC resume request RRC resume request
  • I-RNTI inactive radio network temporary identity
  • the first base station sends a UE context request (retrieve UE context request) to the second base station.
  • the request for obtaining the context of the UE may include the I-RNTI.
  • the second base station may determine the context of the terminal device according to the I-RNTI.
  • the second base station sends a response to obtain the context of the UE (retrieve UE context response) to the first base station.
  • the response for obtaining the context of the UE includes the context of the UE.
  • the first base station sends an RRC resume (RRC resume) message to the terminal device. After receiving the RRC resume message, the UE enters the RRC connected state, and the RRC connection resumes.
  • RRC resume RRC resume
  • the UE sends an RRC resume complete (RRC resume complete) message to the first base station.
  • the first base station sends an Xn-U address indication (Xn-U address indication) to the second base station.
  • the Xn-U address indicates a tunnel address for notifying the second base station of data forwarding, and the data is mainly downlink data.
  • the second base station has downlink data of the UE, it can send the downlink data to the first base station, and then the first base station sends the downlink data to the UE.
  • the first base station sends a path switch request (path switch request) to the AMF entity, and the path switch request is used to switch paths, and the connection between the UPF entity and the second base station is switched to the connection between the UPF entity and the first base station, and the subsequent The downlink data is sent directly to the first base station by the UPF entity instead of the second base station.
  • path switch request path switch request
  • the AMF entity sends a path switch response (path switch response) to the first base station.
  • the first base station sends a UE context release (UE context release) message to the second base station.
  • the context release message of the UE is used to notify the second base station to release the context of the UE.
  • the signaling process for switching from the RRC idle state to the RRC connected state is actually the initial access process of the UE, including random access, RRC connection establishment, and initial context establishment. Comparing this signaling process with the signaling process of switching from the RRC inactive state to the RRC connected state, it can be found that the RRC recovery process in the RRC inactive state can save a lot of signaling interaction, for example, reducing the RRC replay on the Uu interface.
  • the configuration process and security mode configuration process reduce the context establishment process and authentication process on the NG interface. This enables the UE to access the network faster in the RRC inactive state than in the RRC idle state.
  • SIB mainly includes SIB1 and other SIBs.
  • SIB1 mainly includes scheduling information and initial access information of other system information.
  • Other SIBs mainly include the following information: (1) SIB2, including the information of the serving cell Cell reselection information; (2) SIB3, including cell reselection information of the serving frequency point and neighboring cells of the same frequency point; (3) SIB4, including cell reselection information of different frequency points; (4) SIB5, including E- UTRA frequency point and cell reselection information of neighboring cells; (5) SIB6, including the main notification of the earthquake and tsunami warning system (ETWS); (6) SIB7, including the secondary notification of ETWS; (7) ) SIB8, including commercial mobile alert system (CMAS) warning notification; (8) SIB9, including global positioning system (global positioning system, GPS) time and coordinated universal time (coordinated universal time, UTC) information ; (9) SIB10, including human-readable network names (human-readable network names) information of non-
  • MSG1-based SI request MSG3-based SI request
  • dedicated SI Request MSG1-based SI request
  • the terminal device sends a preamble to the network device, and the preamble corresponds to the requested SIB. 2.
  • the terminal device receives the random access response. 3.
  • the terminal device receives the requested SIB by broadcasting.
  • the terminal device sends a preamble sequence to the network device. 2. The terminal device receives the random access response. 3. The terminal device sends MSG3 to the network device, where the MSG3 indicates the requested SIB information. 4. The terminal device receives the contention resolution information. 5. The terminal device receives the requested SIB by broadcasting.
  • the terminal device sends a dedicated Request to the network device. 2.
  • the terminal device receives system information through unicast.
  • dedicated SI Request it can be used to obtain system information of UE in RRC connection state, with security check.
  • the embodiments of the present application provide the following solutions.
  • FIG. 3 is a schematic flowchart of a communication method provided in an embodiment of the present application.
  • the embodiment of this application may include the following steps:
  • the terminal device receives first indication information and security parameter information sent by the first network device, where the first indication information is used to indicate that the system information acquisition mechanism based on security verification is allowed to be used, and the security parameter information is used for System information is checked for security.
  • the first network device may obtain security parameter information, and then send the first indication information and the security parameter information to the terminal device.
  • the terminal device may learn the mechanism for obtaining system information based on security verification.
  • the terminal device may determine the security protection parameters according to the security parameter information. Subsequent terminal devices can use the security protection parameters to perform security verification on the received system information.
  • the security parameter information may be a next chaining counter (NCC), and the NCC is used to identify a security key.
  • NCC next chaining counter
  • the first network device may be a base station (Last serving gNB) that provided service for the terminal device last time.
  • the terminal equipment is currently in the RRC inactive state, and in the RRC inactive state, the dedicated RRC connection is suspended.
  • the dedicated RRC connection may be a data radio bearer (data radio bearers, DRB) or a signaling radio bearer 1 (signalling radio bearers1, SRB1) connection.
  • the terminal device receives second indication information sent by the second network device, where the second indication information is used to indicate that the second network device supports the security check-based system information.
  • the terminal device sends a first message to the second network device, where the first message is used to request first system information based on security verification.
  • the first message may be an RRC system information request message (RRC system information request) or a dedicated system information request message (dedicated SIB request).
  • RRC system information request message is transmitted through SRB0
  • the dedicated system information request message is transmitted through SRB1.
  • the first system information may be MIB or SIB1, and the SIB1 may be used to transmit scheduling information of other system information.
  • other system information may be on demand system information.
  • the terminal device may send an RRC resume request (RRC resume request) to the second network device.
  • the RRC recovery request may include a cause value, and the cause value is that the terminal device requests the first system information based on security verification.
  • SRB1 is established between the terminal device and the second network device. Wherein, the RRC recovery request is transmitted through SRB0.
  • the first message and the RRC recovery request may be in the same message, for example, random access message 3 (MSG3), or in different messages.
  • MSG3 random access message 3
  • the second network device sends the first request to the first network device.
  • the first request includes a reason value
  • the reason value is that the terminal device requests the first system information based on security verification.
  • the first network device may determine whether to perform anchor relocation according to the cause value.
  • the first network device determines to perform an anchor bit.
  • the embodiment of the present application is applicable to a scenario where a small data transmission (small data transmission, SDT) performs an anchor location (with anchor relocation).
  • the first request may be a request to obtain a UE context (retrieve UE context request).
  • the first network device sends a first response to the second network device.
  • the first response may include the context and security protection parameters of the terminal device
  • the context of the terminal device may include packet data convergence protocol (packet data convergence protocol, PDCP) configuration, radio link control layer protocol (radio link control, RLC) configuration , service data adaptation protocol (service data adaptation protocol, SDAP) configuration, etc.
  • the security protection parameters are determined by the first network device according to the security parameter information.
  • the first response may also be used to indicate to perform an anchor position.
  • a field in the first response includes a bit, and when the bit is 1, it indicates to perform an anchor bit.
  • the first response may be a response to obtain UE context (retrieve UE context response).
  • the second network device performs a path switch (path switch) process with the AMF entity.
  • the second network device may send an Xn-U address indication (Xn-U address indication) to the first network device.
  • the Xn-U address indicates a tunnel address for notifying the first network device of data forwarding.
  • the second network device sends a path switch request (path switch request) to the AMF entity, and the path switch request is used to switch paths, switching the connection between the UPF entity and the first network device to the connection between the UPF entity and the second network device , the subsequent downlink data is directly sent by the UPF entity to the second network device instead of the first network device.
  • the AMF entity sends a path switch response (path switch response) to the second network device.
  • the second network device determines to keep the terminal device in an RRC inactive state, encapsulates the first system information in a second message, and sends the second message to the terminal device.
  • the second message includes the first system information, and the second message is protected by using the above-mentioned received security protection parameters.
  • the second message may be an RRC release (RRC release) message, and the second message is transmitted through SRB1.
  • the terminal device performs security verification on the received second message according to the security protection parameters determined in S301.
  • the security protection may be integrity protection
  • the security verification may be integrity verification.
  • Integrity protection can be understood as: the second network device calculates one or more bits according to the security protection parameters, and sends one or more bits to the terminal device together with the second message, and one or more bits contribute to the integrity of the first message The role of protection.
  • Integrity verification can be understood as: the terminal device calculates one or more bits according to the security protection parameters, if the calculated one or more bits are the same as the received one or more bits, the integrity verification passes, indicating The received first system information is safe and has not been tampered with.
  • the second network device may send a UE context release (UE context release) message to the first network device.
  • the context release message of the UE is used to notify the first network device to release the context of the UE.
  • a system information acquisition mechanism based on security verification is used to request system information from a network device. Since SRB1 has security protection after SRB1 recovers, network devices transmit system information with security protection through SRB1, preventing terminal devices from receiving tampered system information and improving system information security.
  • the embodiment of this application is applicable to the scenario of SDT with anchor relocation.
  • FIG. 4 is a schematic flowchart of a communication method provided in an embodiment of the present application.
  • the embodiment of this application may include the following steps:
  • the terminal device receives first indication information and security parameter information sent by the first network device, where the first indication information is used to indicate that the system information acquisition mechanism based on security verification is allowed to be used, and the security parameter information is used for System information is checked for security.
  • the first network device may obtain security parameter information, and then send the first indication information and the security parameter information to the terminal device.
  • the terminal device may learn the mechanism for obtaining system information based on security verification.
  • the terminal device may determine the security protection parameters according to the security parameter information. Subsequent terminal devices can use the security protection parameters to perform security verification on the received system information.
  • the security parameter information may be a next chaining counter (NCC), and the NCC is used to identify a security key.
  • NCC next chaining counter
  • the first network device may be a base station (Last serving gNB) that provided service for the terminal device last time.
  • the terminal device is currently in the RRC inactive state, and in the RRC inactive state, the dedicated RRC connection is suspended.
  • the dedicated RRC connection may be a data radio bearer (data radio bearers, DRB) or a signaling radio bearer 1 (signalling radio bearers1, SRB1) connection.
  • the terminal device receives second indication information sent by the second network device, where the second indication information is used to indicate that the second network device supports the security check-based system information.
  • the terminal device sends a first message to the second network device, where the first message is used to request first system information based on security verification.
  • the first message may be an RRC system information request message (RRC system information request) or a dedicated system information request message (dedicated SIB request).
  • RRC system information request message is transmitted through SRB0
  • the dedicated system information request message is transmitted through SRB1.
  • the first system information may be MIB or SIB1, and the SIB1 may be used to transmit scheduling information of other system information.
  • other system information may be on demand system information.
  • the terminal device may send an RRC resume request (RRC resume request) to the second network device.
  • the RRC recovery request may include a cause value, and the cause value is that the terminal device requests the first system information based on security verification.
  • SRB1 is established between the terminal device and the second network device. Wherein, the RRC recovery request is transmitted through SRB0.
  • the first message and the RRC recovery request may be in the same message, for example, message 3 of random access. Can also be in a different message.
  • the second network device sends a second request to the first network device.
  • the second request includes a reason value
  • the reason value is that the terminal device requests the first system information based on security verification.
  • the first network device may determine whether to perform anchor relocation according to the cause value.
  • the second request further includes the first system information requested by the terminal device.
  • the first request may be a request to obtain a UE context (retrieve UE context request).
  • the first network device determines not to perform the anchor bit.
  • the embodiment of this application is applicable to the scenario of SDT without anchor relocation.
  • the first network device sends a second response to the second network device.
  • the second response may include a part of the context of the terminal device and a second message
  • the second message includes the first system information that has undergone security protection
  • the part of the context of the terminal device may include a radio link control layer protocol (radio link control, RLC) configuration etc.
  • the second message may be an RRC release (RRC release) message.
  • the first network device determines a security protection parameter according to the security parameter information, and then uses the security protection parameter to perform security protection on the first system information. Then encapsulate the security-protected first system information in the second message or other messages.
  • the second message or other messages are transmitted through SRB1.
  • the second response may also be used to indicate not to perform anchoring.
  • a field in the second response includes a bit, and when the bit is 0, it indicates that no anchor bit is performed.
  • the second response may be a response to obtain UE context (retrieve UE context response).
  • the second network device determines to keep the terminal device in an RRC inactive state, and sends a second message to the terminal device.
  • the second message includes the first system information, and the first system information is for security protection.
  • the second message may be an RRC release (RRC release) message, and the second message is transmitted through SRB1.
  • the terminal device performs security verification on the received first system information according to the security protection parameters determined in S401. If the security check passes, it means that the received first system information is safe.
  • the second network device may send a UE context release (UE context release) message to the first network device.
  • the context release message of the UE is used to notify the first network device to release the context of the UE.
  • a system information acquisition mechanism based on security verification is used to request system information from a network device. Since SRB1 has security protection after SRB1 recovers, network devices transmit system information with security protection through SRB1, preventing terminal devices from receiving tampered system information and improving system information security.
  • FIG. 5 is a schematic flowchart of a communication method provided in an embodiment of the present application.
  • the embodiment of this application may include the following steps:
  • the terminal device receives first indication information and security parameter information sent by the first network device, where the first indication information is used to indicate that the system information acquisition mechanism based on security verification is allowed to be used, and the security parameter information is used for System information is checked for security.
  • the first network device may obtain security parameter information, and then send the first indication information and the security parameter information to the terminal device.
  • the terminal device may learn the mechanism for obtaining system information based on security verification.
  • the terminal device may determine the security protection parameters according to the security parameter information. Subsequent terminal devices can use the security protection parameters to perform security verification on the received system information.
  • the security parameter information may be a next chaining counter (NCC), and the NCC is used to identify a security key.
  • NCC next chaining counter
  • the first network device may be a base station (Last serving gNB) that provided service for the terminal device last time.
  • the terminal device is currently in the RRC inactive state, and in the RRC inactive state, the dedicated RRC connection is suspended.
  • the dedicated RRC connection may be a data radio bearer (data radio bearers, DRB) or a signaling radio bearer 1 (signalling radio bearers1, SRB1) connection.
  • the terminal device receives second indication information sent by the second network device, where the second indication information is used to indicate that the second network device supports the security check-based system information.
  • the terminal device sends a first message to the second network device, where the first message is used to request first system information based on security verification.
  • the first message may be an RRC system information request message (RRC system information request) or a dedicated system information request message (dedicated SIB request).
  • RRC system information request message is transmitted through SRB0
  • the dedicated system information request message is transmitted through SRB1.
  • the first system information may be MIB or SIB1, and the SIB1 may be used to transmit scheduling information of other system information.
  • other system information may be on demand system information.
  • the terminal device may send an RRC resume request (RRC resume request) to the second network device.
  • the RRC recovery request may include a cause value, and the cause value is that the terminal device requests the first system information based on security verification.
  • SRB1 is established between the terminal device and the second network device. Wherein, the RRC recovery request is transmitted through SRB0.
  • the first message and the RRC recovery request may be in the same message, for example, message 3 of random access, or in different messages.
  • the second network device sends the first system information to the terminal device, where the first system information is not protected.
  • the second network device sends a third request to the first network device.
  • the third request is used to request a hash parameter (hash key) for security verification.
  • the third request may further include a reason value, and the reason value is that the terminal device requests the first system information based on security verification.
  • the first network device may determine whether to perform anchor relocation according to the cause value.
  • the third request may be a request to obtain a UE context (retrieve UE context request).
  • the first network device determines not to perform the anchor bit.
  • the embodiment of this application is applicable to the scenario of SDT without anchor relocation.
  • the second network device receives a third response sent by the first network device, where the third response includes a third message, and the third message includes the hash parameter.
  • the third response may also include partial context information of the terminal device, and the partial context of the terminal device may include the partial context of the terminal device may include radio link control layer protocol (radio link control, RLC) configuration and the like.
  • radio link control layer protocol radio link control
  • the third message may be an RRC release (RRC release) message.
  • the third message is transmitted via SRB1.
  • the third response may also be used to indicate not to perform anchoring.
  • a field in the third response includes a bit, and when the bit is 1, it indicates to perform an anchor bit.
  • the second network device sends a hash security instruction to the terminal device, where the hash security instruction includes a hash parameter, and the hash parameter is used to determine a hash value of the first system information.
  • the terminal device determines the hash value of the first system information according to the hash parameter.
  • the hash security instruction is transmitted through SRB1.
  • the terminal device sends the hash value of the first system information to the second network device, where the hash value of the first system information is used to determine whether the first system information received by the terminal device is tampered with.
  • the second network device calculates the hash value of the first system information by itself according to the received hash parameter of the first network device, and uses the calculated Compare the hash value of the first system information with the received hash value of the first system information calculated by the terminal device, if the two are the same, determine that the first system information received by the terminal device has not been tampered with, if the two are not If they are the same, it is determined that the first system information received by the terminal device has been tampered with.
  • the hash value of the first system information is transmitted through SRB1.
  • the second network device sends a third message to the terminal device, where the third message is for security protection.
  • the third message includes third indication information
  • the third indication information is used to indicate whether the first system information received by the terminal device has been tampered with.
  • the first indication information may be a bit, if the bit is 1, it is determined that the first system information received by the terminal device has been tampered with, and if the bit is 0, it is determined that the first system information received by the terminal device The first system information has not been tampered with.
  • the third message includes first system information that has not been tampered with.
  • the terminal device performs security check on the third message according to the security protection parameters determined in S501. If the security check passes, it means that the received first system information is safe.
  • the second network device may send a UE context release (UE context release) message to the first network device.
  • the context release message of the UE is used to notify the first network device to release the context of the UE.
  • a system information acquisition mechanism based on security verification is used to request system information from a network device. Since SRB1 has security protection after SRB1 recovers, network devices transmit hash parameters through SIB1 to perform security checks on system information, preventing terminal devices from receiving tampered system information and improving system information security.
  • FIG. 6 is a schematic flowchart of a communication method provided in an embodiment of the present application.
  • the embodiment of this application may include the following steps:
  • the terminal device receives indication information sent by a network device, where the indication information is used to indicate that the network device supports the security check-based system information, where the system information may be transmitted through an SDT.
  • the terminal device sends a first message to the network device, where the first message is used to request first system information based on security verification.
  • the first message may be an RRC system information request message (RRC system information request) or a dedicated system information request message (dedicated SIB request).
  • RRC system information request message is transmitted through SRB0
  • the dedicated system information request message is transmitted through SRB1.
  • the first system information may be MIB or SIB1, and the SIB1 may be used to transmit scheduling information of other system information.
  • other system information may be on demand system information.
  • the terminal device may send an RRC small data transmission request (RRC SDT request) to the network device.
  • RRC SDT request may include a cause value, and the cause value is to request the terminal device to request the first system information based on security verification.
  • RRC SDT request is transmitted through SRB0.
  • the first message and the RRC small data transmission request may be in the same message, for example, message 3 of random access, or in different messages.
  • the first system information may be MIB or SIB1
  • the SIB1 may be used to transmit scheduling information of other system information.
  • other system information may be on demand system information.
  • the network device sends a fourth request to the core network device, where the fourth request includes the first system information requested by the terminal device.
  • the fourth request may be a small data transmission uplink non-access stratum message transfer (SDT UL NAS message transfer) message.
  • the core network device may include an AMF entity, a security anchor function (security anchor function, SEAF) entity, and the like.
  • the core network device performs NAS security protection on the first system information, and sends a fourth response to the network device.
  • the fourth response includes the first system information of the NAS security protection.
  • the fourth response may be a small data transmission downlink non-access stratum message transfer (SDT DL NAS message transfer) message.
  • SDT DL NAS message transfer small data transmission downlink non-access stratum message transfer
  • the network device sends a fourth message to the terminal device.
  • the fourth message may be an RRC small data transmission response (RRC SDT response).
  • the RRC SDT response may include first system information for NAS security protection.
  • the first system information of the NAS security protection is included in the SDT DL NAS message transfer message.
  • the terminal device performs security verification on the received first system information through NAS security.
  • the network equipment transmits system information through NAS messages, and the terminal equipment uses the NAS security mechanism to perform security checks on the system information, preventing the terminal equipment from receiving tampered system information. Improved system information security.
  • FIG. 7 is a schematic flowchart of a communication method provided in an embodiment of the present application.
  • the embodiment of this application may include the following steps:
  • the terminal device receives indication information sent by a network device, where the indication information is used to indicate that the network device supports the security check-based system information, where the system information may be transmitted through an SDT.
  • the terminal device sends a first message to the network device, where the first message is used to request first system information based on security verification.
  • the first message may be an RRC system information request message (RRC system information request) or a dedicated system information request message (dedicated SIB request).
  • RRC system information request message is transmitted through SRB0
  • the dedicated system information request message is transmitted through SRB1.
  • the first system information may be MIB or SIB1, and the SIB1 may be used to transmit scheduling information of other system information.
  • other system information may be on demand system information.
  • the terminal device may send an RRC small data transmission request (RRC SDT request) to the network device.
  • RRC SDT request may include a cause value, and the cause value is to request the terminal device to request the first system information based on security verification.
  • RRC SDT request is transmitted through SRB0.
  • the first message and the RRC small data transmission request may be in the same message, for example, message 3 of random access, or in different messages.
  • the first system information may be MIB or SIB1
  • the SIB1 may be used to transmit scheduling information of other system information.
  • other system information may be on demand system information.
  • the network device sends a fifth request to the core network device.
  • the fifth request includes a reason value, and the reason value is that the terminal device requests the first system information based on security verification.
  • the fifth request may be a small data transmission uplink non-access stratum message transfer (SDT UL NAS message transfer) message.
  • the core network device may include an AMF entity, a security anchor function (security anchor function, SEAF) entity, and the like.
  • the core network device sends a fifth response to the network device.
  • the fifth response may be an access stratum (access stratum, AS) security activation command.
  • the network device sends a security activation command to the terminal device.
  • the terminal device activates AS security according to the AS security activation command. After finishing activating AS security, the terminal device may send a security activation complete message to the network device. The security activation complete message is used to notify that the AS security has been activated.
  • the terminal device receives the first system information through the activated AS security.
  • AS security is not activated, and the terminal device can request the NAS to activate the AS security.
  • Network devices protect system information through AS security, and terminal devices perform security verification on system information through activated AS security to prevent terminal devices from receiving tampered system information and improve the security of system information.
  • the methods and operations implemented by the terminal equipment can also be implemented by components (such as chips or circuits) that can be used in the terminal equipment, and the methods and operations implemented by the network equipment can also be implemented by A component (such as a chip or a circuit) implementation that can be used in a network device.
  • components such as chips or circuits
  • a component such as a chip or a circuit
  • each network element such as a transmitting end device or a receiving end device, includes a corresponding hardware structure and/or software module for performing each function in order to realize the above functions.
  • the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a certain function is executed by hardware or computer software drives hardware depends on the specific application and design constraints of the technical solution. Skilled artisans may use different methods to implement the described functions for each specific application, but such implementation should not be regarded as exceeding the scope of the present application.
  • the embodiments of the present application may divide the functional modules of the terminal device or network device according to the above method example, for example, each functional module may be divided corresponding to each function, or two or more functions may be integrated into one processing module.
  • the above-mentioned integrated modules can be implemented in the form of hardware or in the form of software function modules. It should be noted that the division of modules in the embodiment of the present application is schematic, and is only a logical function division, and there may be other division methods in actual implementation. In the following, the description will be made by taking the division of each functional module corresponding to each function as an example.
  • FIG. 8 is a schematic structural diagram of a communication device provided by an embodiment of the present application.
  • the communication device may include a receiving module 801 , a processing module 802 and a sending module 803 .
  • the receiving module 801 and the sending module 803 can communicate with the outside, and the processing module 802 is used for processing, such as performing security checks and the like.
  • the receiving module 801 and the sending module 803 may also be referred to as a communication interface, a transceiver unit or a transceiver module.
  • the receiving module 801 and the sending module 803 may be used to perform the actions performed by the terminal device in the above method embodiments.
  • the receiving module 801 and the sending module 803 may also be referred to as a transceiver module or a transceiver unit (including a receiving unit and/or a sending unit), which are respectively used to perform the steps of sending and receiving by the terminal device in the above method embodiments.
  • the communication device may implement the steps or processes corresponding to the execution of the terminal device in the above method embodiments, for example, it may be the terminal device, or a chip or circuit configured in the terminal device.
  • the receiving module 801 and the sending module 803 are configured to perform transceiving-related operations on the terminal device side in the above method embodiments, and the processing module 802 is configured to perform processing-related operations on the terminal device in the above method embodiments.
  • the receiving module 801 is configured to receive first indication information and security parameter information sent by the first network device, the first indication information is used to indicate that the system information acquisition mechanism based on security verification is allowed to be used, and the security parameter information is used For security verification of system information;
  • the sending module 803 is configured to send a first message to the second network device, where the first message is used to request first system information based on security verification.
  • the receiving module 801 is further configured to receive second indication information of the second network device, where the second indication information is used to indicate that the second network device supports the security check-based system information.
  • the first message is a radio resource control RRC system information request message or a dedicated system information request message.
  • the receiving module 801 is further configured to receive a second message sent by the second network device, the second message includes the first system information, and the second message is for security protection;
  • the processing module 802 is configured to perform security check on the second message according to the security parameter information.
  • the receiving module 801 is further configured to receive the first system information sent by the second network device, and the first system information is not protected by security.
  • the receiving module 801 is further configured to receive a hash security instruction sent by the second network device, the hash security instruction includes a hash parameter, and the hash parameter is used to determine the first system information hash value;
  • the sending module 803 is further configured to send a hash value of the first system information to the second network device, where the hash value of the first system information is used to determine the first system information received by the terminal device whether it has been tampered with.
  • the receiving module 801 is further configured to receive a third message sent by the second network device, and the third message is for security protection;
  • the processing module 802 is configured to perform security check on the third message according to the security protection parameters.
  • the third message includes third indication information, where the third indication information is used to indicate whether the first system information received by the terminal device has been tampered with.
  • the third message includes first system information that has not been tampered with.
  • each module may also refer to corresponding descriptions of the method embodiments shown in FIGS. 3-7 , and execute the methods and functions performed by the terminal device in the foregoing embodiments.
  • FIG. 9 is a schematic structural diagram of a communication device provided by an embodiment of the present application.
  • the communication device may include a receiving module 901 and a sending module 902, and the receiving module 901 and the sending module 902 may communicate with the outside.
  • the receiving module 901 and the sending module 902 may also be referred to as a communication interface, a transceiver module or a transceiver unit.
  • the receiving module 901 and the sending module 902 may be configured to perform actions performed by the second network device in the above method embodiments.
  • the receiving module 901 and the sending module 902 may also be referred to as a transceiver module or a transceiver unit (including a sending unit and/or a receiving unit), which are respectively used to perform the steps of sending and receiving by the second network device in the above method embodiments.
  • the communication device can implement the steps or processes corresponding to the execution of the second network device in the above method embodiments, for example, it can be the second network device, or a device configured in the second network device chip or circuit.
  • the receiving module 901 and the sending module 902 are configured to perform transceiving-related operations on the second network device side in the above method embodiments.
  • a receiving module 901 configured to receive a first message sent by a terminal device, where the first message is used to request first system information based on security verification;
  • a sending module 902 configured to send the first system information to the terminal device.
  • the sending module 902 is further configured to send second indication information to the terminal device, where the second indication information is used to indicate that the second network device supports the security check-based system information.
  • the first message is a radio resource control RRC system information request message or a dedicated system information request message.
  • the first system information is included in a second message, and the second message is for security protection.
  • the first request includes a cause value, where the cause value is the terminal device requesting the first system information based on security verification, and the cause value is used to instruct the first network device to determine whether Perform anchoring.
  • the first response is also used to indicate to perform an anchor position.
  • the sending module 902 is further configured to send a second request to the first network device, where the second request includes the first system information;
  • the receiving module 901 is further configured to receive a second response sent by the first network device, the second response includes the second message, the second message includes the first system information, and the second message It is for security protection.
  • the second request includes a cause value, where the cause value is the terminal device requesting the first system information based on security verification, and the cause value is used to instruct the first network device to determine whether Perform anchoring.
  • the second response is also used to indicate not to perform anchoring.
  • the first system information is not protected.
  • a sending module 902 configured to send a third request to the first network device, where the third request is used to request a hash parameter for security verification;
  • the receiving module 901 is configured to receive a third response sent by the first network device, where the third response includes a third message, and the third message includes the hash parameter.
  • the third request includes a cause value
  • the cause value is the terminal device requesting the first system information based on security verification
  • the cause value is used to instruct the first network device to determine whether Perform anchoring.
  • the third response is also used to indicate not to perform anchoring.
  • the sending module 902 is configured to send a hash security instruction to the terminal device, where the hash security instruction includes a hash parameter, and the hash parameter is used to determine a hash value of the first system information ;
  • the receiving module 901 is configured to receive a hash value of the first system information sent by the terminal device, where the hash value of the first system information is used to determine the first system information received by the terminal device whether it has been tampered with.
  • the sending module 902 is configured to send a third message to the terminal device, where the third message is for security protection.
  • the third message includes third indication information, where the third indication information is used to indicate whether the first system information received by the terminal device has been tampered with.
  • the third message includes first system information that has not been tampered with.
  • each module may also refer to the corresponding descriptions of the method embodiments shown in FIGS. 3-7 , and execute the methods and functions performed by the second network device or the network device in the above embodiments.
  • FIG. 10 is a schematic structural diagram of a communication device provided by an embodiment of the present application.
  • the communication device may include an acquiring module 1001 and a sending module 1002, and the acquiring module 1001 and the sending module 1002 may communicate with the outside.
  • the acquiring module 1001 and the sending module 1002 may also be referred to as a communication interface, a transceiver module or a transceiver unit.
  • the obtaining module 1001 and the sending module 1002 may be configured to perform the actions performed by the first network device in the above method embodiments.
  • the acquisition module 1001 and the sending module 1002 may also be called a transceiver module or a transceiver unit (including a sending unit and/or a receiving unit), and are respectively used to perform the steps of sending and receiving by the first network device in the above method embodiments.
  • the communication device can implement the steps or processes corresponding to the steps or processes performed by the first network device in the above method embodiments, for example, it can be the first network device, or the chip or circuit.
  • the obtaining module 1001 and the sending module 1002 are configured to perform transceiving-related operations on the side of the first network device in the method embodiments above.
  • a sending module 1002 configured to send first indication information and security parameter information to the terminal device, where the first indication information is used to indicate that the system information acquisition mechanism based on security verification is allowed to be used, and where the security parameter information is used for system Information is checked for security.
  • the acquiring module 1001 is also configured to receive the first request sent by the second network device;
  • the sending module 1002 is further configured to send a first response to the second network device, the first response includes a security protection parameter, the security protection parameter is determined according to the security parameter information, and the security protection parameter uses For the security protection of system information.
  • the first request includes a cause value, where the cause value is the terminal device requesting the first system information based on security verification, and the cause value is used to instruct the first network device to determine whether Perform anchoring.
  • the first response is also used to indicate to perform an anchor position.
  • the acquiring module 1001 is further configured to receive a second request sent by a second network device, where the second request includes the first system information;
  • the sending module 1002 is further configured to send a second response to the second network device, the second response includes a second message, the second message includes the first system information, and the second message is Security protection is performed according to the security parameter information.
  • the second request includes a cause value, where the cause value is the terminal device requesting the first system information based on security verification, and the cause value is used to instruct the first network device to determine whether Perform anchoring.
  • the second response is also used to indicate not to perform anchoring.
  • the acquiring module 1001 is further configured to receive a third request sent by the second network device, the third request including a hash parameter requesting security verification;
  • the sending module 1002 is further configured to send a third response to the second network device, the third response includes a third message, and the third message includes the hash parameter.
  • the third request includes a cause value
  • the cause value is the terminal device requesting the first system information based on security verification
  • the cause value is used to instruct the first network device to determine whether Perform anchoring.
  • the third response is also used to indicate not to perform anchoring.
  • each module can also refer to the corresponding descriptions of the method embodiments shown in FIGS. 3-7 , and execute the methods and functions performed by the first network device or the network device in the above embodiments.
  • FIG. 11 is a schematic structural diagram of a terminal device provided by an embodiment of the present application.
  • the terminal device can be applied to the system shown in Figure 1(A) and Figure 1(B) to perform the functions of the terminal device in the above method embodiments, or implement the steps or processes performed by the terminal device in the above method embodiments.
  • the terminal device includes a processor 1101 and a transceiver 1102 .
  • the terminal device further includes a memory 1103 .
  • the processor 1101, the transceiver 1102, and the memory 1103 can communicate with each other through an internal connection path, and transmit control and/or data signals. Call and run the computer program to control the transceiver 1102 to send and receive signals.
  • the terminal device may further include an antenna, configured to send the uplink data or uplink control signaling output by the transceiver 1102 through wireless signals.
  • the processor 1101 and the memory 1103 may be combined into a processing device, and the processor 1101 is configured to execute the program codes stored in the memory 1103 to realize the above functions.
  • the memory 1103 may also be integrated in the processor 1101 , or be independent of the processor 1101 .
  • the processor 1101 may correspond to the processing module in FIG. 8 .
  • the above-mentioned transceiver 1102 may correspond to the receiving module and the sending module in FIG. 8 , and may also be called a transceiver unit or a transceiver module.
  • the transceiver 1102 may include a receiver (or called a receiver, a receiving circuit) and a transmitter (or called a transmitter, a transmitting circuit). Among them, the receiver is used to receive signals, and the transmitter is used to transmit signals.
  • the terminal device shown in FIG. 11 can implement various processes involving the terminal device in the method embodiments shown in FIGS. 3 to 7 .
  • the operations and/or functions of the various modules in the terminal device are respectively for realizing the corresponding processes in the foregoing method embodiments.
  • the above-mentioned processor 1101 can be used to execute the actions implemented inside the terminal device described in the previous method embodiments, and the transceiver 1102 can be used to execute the actions described in the previous method embodiments that the terminal device sends to or receives from the network device. action.
  • the transceiver 1102 can be used to execute the actions described in the previous method embodiments that the terminal device sends to or receives from the network device. action.
  • the processor 1101 may be a central processing unit, a general purpose processor, a digital signal processor, an application specific integrated circuit, a field programmable gate array or other programmable logic devices, transistor logic devices, hardware components or any combination thereof. It can implement or execute the various illustrative logical blocks, modules and circuits described in connection with the present disclosure.
  • the processor 1101 may also be a combination that implements computing functions, for example, a combination of one or more microprocessors, a combination of a digital signal processor and a microprocessor, and the like.
  • the communication bus 1104 may be a peripheral component interconnection standard PCI bus or an extended industry standard structure EISA bus or the like. The bus can be divided into address bus, data bus, control bus and so on.
  • the communication bus 1104 is used to realize connection communication between these components.
  • the transceiver 1102 is used for signaling or data communication with other node devices.
  • the memory 1103 may include a volatile memory, such as nonvolatile random access memory (nonvolatile random access memory, NVRAM), phase change random access memory (phase change RAM, PRAM), magnetoresistive random access memory (magetoresistive) RAM, MRAM), etc., can also include non-volatile memory, such as at least one magnetic disk storage device, electronically erasable programmable read-only memory (electrically erasable programmable read-only memory, EEPROM), flash memory devices, such as reverse or flash memory (NOR flash memory) or NAND flash memory (NAND flash memory), semiconductor devices, such as solid state disk (solid state disk, SSD) and so on.
  • nonvolatile random access memory nonvolatile random access memory
  • phase change RAM phase change RAM
  • PRAM phase change RAM
  • MRAM magnetoresistive random access memory
  • MRAM magnetoresistive random access memory
  • MRAM magnetoresistive random access memory
  • non-volatile memory such as at least one magnetic disk storage device, electronically erasable
  • the memory 1103 may also be at least one storage device located away from the aforementioned processor 1101 .
  • a set of computer program codes or configuration information may also be stored in the memory 1103 .
  • the processor 1101 may also execute programs stored in the memory 1103 .
  • the processor may cooperate with the memory and the transceiver to execute any method and function of the terminal device in the foregoing application embodiments.
  • Fig. 12 is a schematic structural diagram of a second network device provided by an embodiment of the present application.
  • the second network device can be applied to the system shown in Figure 1(A) and Figure 1(B), to perform the function of the second network device in the above method embodiment, or to realize the second network device in the above method embodiment The steps or processes to be performed.
  • the second network device includes a processor 1201 and a transceiver 1202 .
  • the second network device further includes a memory 1203 .
  • the processor 1201, the transceiver 1202, and the memory 1203 can communicate with each other through an internal connection path, and transmit control and/or data signals. Call and run the computer program to control the transceiver 1202 to send and receive signals.
  • the second network device may further include an antenna, configured to send the uplink data or uplink control signaling output by the transceiver 1202 through wireless signals.
  • the processor 1201 and the memory 1203 may be combined into a processing device, and the processor 1201 is configured to execute the program codes stored in the memory 1203 to realize the above functions.
  • the memory 1203 may also be integrated in the processor 1201 , or be independent of the processor 1201 .
  • the above-mentioned transceiver 1202 may correspond to the receiving module and the sending module in FIG. 9 , and may also be called a transceiver unit or a transceiver module.
  • the transceiver 1202 may include a receiver (or called a receiver, a receiving circuit) and a transmitter (or called a transmitter, a transmitting circuit). Among them, the receiver is used to receive signals, and the transmitter is used to transmit signals.
  • the second network device shown in FIG. 12 can implement various processes involving the second network device in the method embodiments shown in FIGS. each process.
  • the operations and/or functions of the various modules in the second network device are respectively for realizing the corresponding processes in the foregoing method embodiments.
  • the above-mentioned processor 1201 can be used to execute the actions implemented by the second network device described in the previous method embodiments, and the transceiver 1202 can be used to perform the sending or receiving from the second network device to the terminal device described in the previous method embodiments.
  • the action received by the end device please refer to the description in the foregoing method embodiments, and details are not repeated here.
  • the processor 1201 may be various types of processors mentioned above.
  • the communication bus 1204 may be a peripheral component interconnection standard PCI bus or an extended industry standard structure EISA bus or the like. The bus can be divided into address bus, data bus, control bus and so on. For ease of representation, only one thick line is used in FIG. 12 , but it does not mean that there is only one bus or one type of bus.
  • the communication bus 1204 is used to realize connection communication between these components.
  • the transceiver 1202 of the device in the embodiment of the present application is used for signaling or data communication with other devices.
  • the memory 1203 may be various types of memory mentioned above. Optionally, the memory 1203 may also be at least one storage device located away from the aforementioned processor 1201 .
  • a set of computer program codes or configuration information is stored in the memory 1203 , and the processor 1201 executes the programs in the memory 1203 .
  • the processor may cooperate with the memory and the transceiver to execute any method and function of the second network device in the above application embodiments.
  • Fig. 13 is a schematic structural diagram of a first network device provided by an embodiment of the present application.
  • the first network device can be applied to the system shown in Figure 1(A) and Figure 1(B), to perform the function of the first network device in the above method embodiment, or to realize the first network device in the above method embodiment The steps or processes to be performed.
  • the first network device includes a processor 1301 and a transceiver 1302 .
  • the first network device further includes a memory 1303 .
  • the processor 1301, the transceiver 1302, and the memory 1303 can communicate with each other through an internal connection path, and transmit control and/or data signals. Call and run the computer program to control the transceiver 1302 to send and receive signals.
  • the first network device may further include an antenna, configured to send the uplink data or uplink control signaling output by the transceiver 1302 through wireless signals.
  • the processor 1301 and the memory 1303 may be combined into a processing device, and the processor 1301 is configured to execute the program codes stored in the memory 1303 to realize the above functions.
  • the memory 1303 may also be integrated in the processor 1301 , or be independent of the processor 1301 .
  • the above-mentioned transceiver 1302 may correspond to the acquisition module and the sending module in FIG. 10 , and may also be called a transceiver unit or a transceiver module.
  • the transceiver 1302 may include a receiver (or receiver, receiving circuit) and a transmitter (or transmitter, transmitting circuit). Among them, the receiver is used to receive signals, and the transmitter is used to transmit signals.
  • the first network device shown in FIG. 13 can implement various processes involving the first network device in the method embodiments shown in FIGS. each process.
  • the operations and/or functions of the various modules in the first network device are respectively for implementing the corresponding processes in the foregoing method embodiments.
  • the above-mentioned processor 1301 can be used to execute the actions described in the previous method embodiments implemented internally by the first network device, and the transceiver 1302 can be used to execute the first network device described in the previous method embodiments to send to or from the terminal device The action received by the end device.
  • the transceiver 1302 can be used to execute the first network device described in the previous method embodiments to send to or from the terminal device The action received by the end device.
  • the processor 1301 may be various types of processors mentioned above.
  • the communication bus 1304 may be a peripheral component interconnection standard PCI bus or an extended industry standard structure EISA bus or the like. The bus can be divided into address bus, data bus, control bus and so on. For ease of representation, only one thick line is used in FIG. 13 , but it does not mean that there is only one bus or one type of bus.
  • the communication bus 1304 is used to realize connection communication between these components.
  • the transceiver 1302 of the device in the embodiment of the present application is used for signaling or data communication with other devices.
  • the memory 1303 may be various types of memory mentioned above. Optionally, the memory 1303 may also be at least one storage device located away from the aforementioned processor 1301 .
  • a set of computer program codes or configuration information is stored in the memory 1303 , and the processor 1301 executes the programs in the memory 1303 .
  • the processor may cooperate with the memory and the transceiver to execute any method and function of the first network device in the foregoing application embodiments.
  • An embodiment of the present application also provides a chip system, which includes a processor, configured to support terminal devices or network devices to implement the functions involved in any of the above embodiments, such as generating or processing the SDT data.
  • the chip system may further include a memory, and the memory is used for necessary program instructions and data of a terminal device or a network device.
  • the system-on-a-chip may consist of chips, or may include chips and other discrete devices. Wherein, the input and output of the chip system respectively correspond to the receiving and sending operations of the terminal device or the network device in the method embodiment.
  • the embodiment of the present application also provides a processing device, including a processor and an interface.
  • the processor may be used to execute the methods in the foregoing method embodiments.
  • the above processing device may be a chip.
  • the processing device may be a field programmable gate array (field programmable gate array, FPGA), an application specific integrated circuit (ASIC), or a system chip (system on chip, SoC). It can be a central processor unit (CPU), a network processor (network processor, NP), a digital signal processing circuit (digital signal processor, DSP), or a microcontroller (micro controller unit) , MCU), can also be a programmable controller (programmable logic device, PLD) or other integrated chips.
  • CPU central processor unit
  • NP network processor
  • DSP digital signal processor
  • microcontroller micro controller unit
  • PLD programmable logic device
  • each step of the above method can be completed by an integrated logic circuit of hardware in a processor or an instruction in the form of software.
  • the steps of the methods disclosed in connection with the embodiments of the present application may be directly implemented by a hardware processor, or implemented by a combination of hardware and software modules in the processor.
  • the software module can be located in a mature storage medium in the field such as random access memory, flash memory, read-only memory, programmable read-only memory or electrically erasable programmable memory, register.
  • the storage medium is located in the memory, and the processor reads the information in the memory, and completes the steps of the above method in combination with its hardware. To avoid repetition, no detailed description is given here.
  • the processor in the embodiment of the present application may be an integrated circuit chip, which has a signal processing capability.
  • each step of the above-mentioned method embodiment can be completed by an integrated logic circuit of hardware in a processor or an instruction in the form of software.
  • the above-mentioned processor may be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components .
  • DSP digital signal processor
  • ASIC application-specific integrated circuit
  • FPGA field-programmable gate array
  • a general-purpose processor may be a microprocessor, or the processor may be any conventional processor, or the like.
  • the steps of the method disclosed in connection with the embodiments of the present application may be directly implemented by a hardware decoding processor, or implemented by a combination of hardware and software modules in the decoding processor.
  • the software module can be located in a mature storage medium in the field such as random access memory, flash memory, read-only memory, programmable read-only memory or electrically erasable programmable memory, register.
  • the storage medium is located in the memory, and the processor reads the information in the memory, and completes the steps of the above method in combination with its hardware.
  • the present application also provides a computer program product, the computer program product including: a computer program, when the computer program is run on the computer, the computer is made to execute the implementation shown in Figure 3- Figure 7 The method of any one embodiment in the example.
  • the present application also provides a computer-readable medium, the computer-readable medium stores a computer program, and when the computer program is run on the computer, the computer is made to execute the computer shown in Figures 3-7. The method of any one of the embodiments is illustrated.
  • the present application further provides a communication system, which includes the foregoing one or more terminal devices and one or more network devices.
  • all or part of them may be implemented by software, hardware, firmware or any combination thereof.
  • software When implemented using software, it may be implemented in whole or in part in the form of a computer program product.
  • the computer program product includes one or more computer instructions. When the computer instructions are loaded and executed on the computer, the processes or functions according to the embodiments of the present application will be generated in whole or in part.
  • the computer can be a general purpose computer, a special purpose computer, a computer network, or other programmable devices.
  • the computer instructions may be stored in or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be transmitted from a website, computer, server or data center Transmission to another website site, computer, server or data center by wired (such as coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (such as infrared, wireless, microwave, etc.).
  • the computer-readable storage medium may be any available medium that can be accessed by a computer, or a data storage device such as a server or a data center integrated with one or more available media.
  • the available medium may be a magnetic medium (for example, a floppy disk, a hard disk, a magnetic tape), an optical medium (for example, a high-density digital video disc (digital video disc, DVD)), or a semiconductor medium (for example, a solid state disk (solid state disc, SSD)) etc.
  • a magnetic medium for example, a floppy disk, a hard disk, a magnetic tape
  • an optical medium for example, a high-density digital video disc (digital video disc, DVD)
  • a semiconductor medium for example, a solid state disk (solid state disc, SSD)
  • the network equipment in each of the above device embodiments corresponds to the terminal equipment and the network equipment or terminal equipment in the method embodiments, and the corresponding modules or units perform corresponding steps, such as the receiving module and the sending module (transceiver) in the method embodiments.
  • the step of receiving or sending, other steps besides sending and receiving may be performed by a processing module (processor).
  • processors for the functions of the specific modules, reference may be made to the corresponding method embodiments. Wherein, there may be one or more processors.
  • a component may be, but is not limited to being, a process running on a processor, a processor, an object, an executable, a thread of execution, a program, and/or a computer.
  • an application running on a computing device and the computing device can be components.
  • One or more components can reside within a process and/or thread of execution and a component can be localized on one computer and/or distributed between two or more computers.
  • these components can execute from various computer readable media having various data structures stored thereon.
  • a component may, for example, be based on a signal having one or more packets of data (e.g., data from two components interacting with another component between a local system, a distributed system, and/or a network, such as the Internet via a signal interacting with other systems). Communicate through local and/or remote processes.
  • packets of data e.g., data from two components interacting with another component between a local system, a distributed system, and/or a network, such as the Internet via a signal interacting with other systems.
  • the disclosed systems, devices and methods may be implemented in other ways.
  • the device embodiments described above are only illustrative.
  • the division of the units is only a logical function division. In actual implementation, there may be other division methods.
  • multiple units or components can be combined or May be integrated into another system, or some features may be ignored, or not implemented.
  • the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces, and the indirect coupling or communication connection of devices or units may be in electrical, mechanical or other forms.
  • the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place, or may be distributed to multiple network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.
  • each functional module in each embodiment of the present application may be integrated into one processing module, each module may exist separately physically, or two or more modules may be integrated into one module.
  • the functions described above are realized in the form of software function units and sold or used as independent products, they can be stored in a computer-readable storage medium.
  • the technical solution of the present application is essentially or the part that contributes to the prior art or the part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including Several instructions are used to make a computer device (which may be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the methods described in the various embodiments of the present application.
  • the aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (read-only memory, ROM), random access memory (random access memory, RAM), magnetic disk or optical disc and other media that can store program codes. .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本申请实施例公开了一种通信方法及装置。该方法包括：终端设备接收第一网络设备发送的第一指示信息和安全参数信息，所述第一指示信息用于指示允许使用基于安全校验的***信息的获取机制，所述安全参数信息用于对***信息进行安全校验；向第二网络设备发送第一消息，所述第一消息用于请求基于安全校验的第一***信息。采用本申请实施例，通过获取基于安全校验的***信息，防止***信息被篡改，提高了***信息的安全性。

Description

一种通信方法及装置
本申请要求于2021年12月29日提交中国国家知识产权局、申请号为202111648311.5、发明名称为“一种通信方法及装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信技术领域，尤其涉及一种通信方法及装置。
背景技术
***信息主要由主***块(master information block，MIB)和多个***信息块(system information block，SIB)组成，SIB主要包括SIB1和其他SIB。其中，MIB和SIB1是周期性广播的，其他SIB是可以周期性广播，也可以请求(on demand)广播的。MIB主要包括小区禁止状态(cell barred status)信息、以及接收后续SIB的物理层必要信息，例如，控制资源集(control resource set#0，CORESET#0)配置。SIB1主要包括其他***信息的调度信息和初始接入的信息。对于处于无线资源控制空闲态(radio resource control IDLE，RRC IDLE)或RRC非激活态(RRC INACTIVE)的终端设备，由于获取的***信息都是没有安全校验的，从而导致终端设备获取到的***信息可能被篡改，存在安全风险。
发明内容
本申请实施例提供一种通信方法及装置，避免***信息被篡改，提高了***信息的安全性。
第一方面，本申请实施例提供了一种通信方法，该方法应用于终端设备，或终端设备中的芯片，包括：接收第一网络设备发送的第一指示信息和安全参数信息，所述第一指示信息用于指示允许使用基于安全校验的***信息的获取机制，所述安全参数信息用于对***信息进行安全校验；向第二网络设备发送第一消息，所述第一消息用于请求基于安全校验的第一***信息。对于处于RRC非激活态的终端设备，使用基于安全校验的***信息的获取机制向网络设备请求***信息。由于在SRB1恢复后SRB1是有安全保护的，网络设备通过SRB1传输具有安全保护的***信息，避免***信息被篡改，提高了***信息的安全性。
在一种可能的设计中，接收所述第二网络设备的第二指示信息，所述第二指示信息用于指示所述第二网络设备支持所述基于安全校验的***信息。通过第二指示信息告知终端设备可以请求基于安全校验的***信息。
在另一种可能的设计中，所述第一消息为无线资源控制RRC***信息请求消息或专用***信息请求消息。
在另一种可能的设计中，接收所述第二网络设备发送的第二消息，所述第二消息包括所述第一***信息，所述第二消息是进行安全保护的；根据所述安全参数信息，对所述第二消息进行安全校验。通过对第二消息进行安全校验，保障获取到的第一***信息安全，避免***信息被篡改，提高了***信息的安全性。
在另一种可能的设计中，接收所述第二网络设备发送的所述第一***信息，所述第一系 统信息是未进行安全保护的。
在另一种可能的设计中，接收所述第二网络设备发送的哈希安全指令，所述哈希安全指令包括哈希参数，所述哈希参数用于确定所述第一***信息的哈希值；向所述第二网络设备发送所述第一***信息的哈希值，所述第一***信息的哈希值用于确定所述终端设备接收到的所述第一***信息是否被篡改。在终端设备接收到的第一***信息是未进行安全保护的情况下，通过计算第一***信息的哈希值，确定接收到的所述第一***信息是否被篡改，提高了***信息的安全性。
在另一种可能的设计中，接收所述第二网络设备发送的第三消息，所述第三消息是进行安全保护的；根据所述安全保护参数，对所述第三消息进行安全校验。通过对第三消息进行安全校验，保障第三信息的安全性。
在另一种可能的设计中，所述第三消息包括第三指示信息，所述第三指示信息用于指示所述终端设备接收到的所述第一***信息是否被篡改。通过第三指示信息指示终端设备接收到的第一***信息是否被篡改，以便提示接收到的第一***信息的安全性。
在另一种可能的设计中，当所述终端设备接收到的所述第一***信息被篡改时，所述第三消息包括未被篡改的第一***信息。在第一***信息被篡改的情况下，通过重新传输第一***信息，保障***信息的安全性。
第二方面，本申请实施例提供了一种通信方法，该方法应用于第二网络设备，或第二网络设备中的芯片，所述方法包括：接收终端设备发送的第一消息，所述第一消息用于请求基于安全校验的第一***信息；向所述终端设备发送所述第一***信息。对于处于RRC非激活态的终端设备，使用基于安全校验的***信息的获取机制向网络设备请求***信息。由于在SRB1恢复后SRB1是有安全保护的，网络设备通过SRB1传输具有安全保护的***信息，避免***信息被篡改，提高了***信息的安全性。
在一种可能的设计中，向所述终端设备发送第二指示信息，所述第二指示信息用于指示所述第二网络设备支持所述基于安全校验的***信息。通过第二指示信息告知终端设备可以请求基于安全校验的***信息。
在另一种可能的设计中，所述第一消息为无线资源控制RRC***信息请求消息或专用***信息请求消息。
在另一种可能的设计中，所述第一***信息包含于第二消息中，所述第二消息是进行安全保护的。通过对第二消息进行安全保护，保障第一***信息的安全性，避免第一***信息被篡改。
在另一种可能的设计中，向第一网络设备发送第一请求；接收所述第一网络设备发送的第一响应，所述第一响应包括安全保护参数，所述安全保护参数为根据安全参数信息确定的，所述安全保护参数用于对所述第二消息进行安全保护。在进行锚定位的情况下，第二网络设备通过向第一网络设备请求安全保护参数，然后根据安全保护参数对第二消息进行安全保护，保障传输给终端设备的第一***信息的安全性，避免第一***信息被篡改。
在另一种可能的设计中，所述第一请求包括原因值，所述原因值为所述终端设备请求基于安全校验的所述第一***信息，所述原因值用于指示所述第一网络设备确定是否进行锚定位。
在另一种可能的设计中，所述第一响应还用于指示进行锚定位。
在另一种可能的设计中，向第一网络设备发送第二请求，所述第二请求包括所述第一***信息；接收所述第一网络设备发送的第二响应，所述第二响应包括所述第二消息，所述第 二消息包括所述第一***信息，所述第二消息是进行安全保护的。在不进行锚定位的情况下，通过第一网络设备对第一***信息进行安全保护，保障传输给终端设备的第一***信息的安全性，避免第一***信息被篡改。
在另一种可能的设计中，所述第二请求包括原因值，所述原因值为所述终端设备请求基于安全校验的所述第一***信息，所述原因值用于指示所述第一网络设备确定是否进行锚定位。
在另一种可能的设计中，所述第二响应还用于指示不进行锚定位。
在另一种可能的设计中，所述第一***信息没有进行安全保护。
在另一种可能的设计中，向第一网络设备发送第三请求，所述第三请求用于请求安全校验的哈希参数；接收所述第一网络设备发送的第三响应，所述第三响应包括第三消息，所述第三消息包括所述哈希参数。在终端设备接收到第一***信息没有进行安全保护情况下，通过向第一网络设备请求哈希参数，对第一***信息进行安全校验，保障第一***信息的安全性，避免第一***信息被篡改。
在另一种可能的设计中，所述第三请求包括原因值，所述原因值为所述终端设备请求基于安全校验的所述第一***信息，所述原因值用于指示所述第一网络设备确定是否进行锚定位。
在另一种可能的设计中，所述第三响应还用于指示不进行锚定位。
在另一种可能的设计中，向所述终端设备发送哈希安全指令，所述哈希安全指令包括哈希参数，所述哈希参数用于确定所述第一***信息的哈希值；接收所述终端设备发送的所述第一***信息的哈希值，所述第一***信息的哈希值用于确定所述终端设备接收到的所述第一***信息是否被篡改。第二网络设备通过计算第一***信息的哈希值和接收到的终端设备的哈希值，确定第一***信息是否被篡改，保障第一***信息的安全性，避免第一***信息被篡改。
在另一种可能的设计中，向所述终端设备发送第三消息，所述第三消息是进行安全保护的。通过对第三消息进行安全保护，保障信息的安全性。
在另一种可能的设计中，所述第三消息包括第三指示信息，所述第三指示信息用于指示所述终端设备接收到的所述第一***信息是否被篡改。
在另一种可能的设计中，当所述终端设备接收到的所述第一***信息被篡改时，所述第三消息包括未被篡改的第一***信息。
第三方面，本申请实施例提供了一种通信方法，该方法应用于第一网络设备，或第一网络设备中的芯片，所述方法包括：所述方法包括：获取安全参数信息；向终端设备发送第一指示信息和安全参数信息，所述第一指示信息用于指示允许使用基于安全校验的***信息的获取机制，所述安全参数信息用于对***信息进行安全校验。对于处于RRC非激活态的终端设备，使用基于安全校验的***信息的获取机制向网络设备请求***信息。由于在SRB1恢复后SRB1是有安全保护的，网络设备通过SRB1传输具有安全保护的***信息，避免***信息被篡改，提高了***信息的安全性。
在一种可能的设计中，接收第二网络设备发送的第一请求；向所述第二网络设备发送第一响应，所述第一响应包括安全保护参数，所述安全保护参数为根据所述安全参数信息确定的，所述安全保护参数用于对***信息进行安全保护。在进行锚定位的情况下，第二网络设备通过向第一网络设备请求安全保护参数，然后根据安全保护参数对第二消息进行安全保护，保障传输给终端设备的第一***信息的安全性，避免第一***信息被篡改。
在另一种可能的设计中，所述第一请求包括原因值，所述原因值为所述终端设备请求基于安全校验的所述第一***信息，所述原因值用于指示所述第一网络设备确定是否进行锚定位。
在另一种可能的设计中，所述第一响应还用于指示进行锚定位。
在另一种可能的设计中，接收第二网络设备发送的第二请求，所述第二请求包括所述第一***信息；向所述第二网络设备发送第二响应，所述第二响应包括第二消息，所述第二消息包括所述第一***信息，所述第二消息是根据所述安全参数信息进行安全保护的。在不进行锚定位的情况下，通过第一网络设备对第一***信息进行安全保护，保障传输给终端设备的第一***信息的安全性，避免第一***信息被篡改。
在另一种可能的设计中，所述第二请求包括原因值，所述原因值为所述终端设备请求基于安全校验的所述第一***信息，所述原因值用于指示所述第一网络设备确定是否进行锚定位。
在另一种可能的设计中，所述第二响应还用于指示不进行锚定位。
在另一种可能的设计中，接收第二网络设备发送的第三请求，所述第三请求包括请求安全校验的哈希参数；向所述第二网络设备发送第三响应，所述第三响应包括第三消息，所述第三消息包括所述哈希参数。在终端设备接收到第一***信息没有进行安全保护情况下，通过向第一网络设备请求哈希参数，对第一***信息进行安全校验，保障第一***信息的安全性，避免第一***信息被篡改。
在另一种可能的设计中，所述第三请求包括原因值，所述原因值为所述终端设备请求基于安全校验的所述第一***信息，所述原因值用于指示所述第一网络设备确定是否进行锚定位。
在另一种可能的设计中，所述第三响应还用于指示不进行锚定位。
第四方面，本申请实施例提供了一种通信方法，该方法应用于终端设备，或终端设备中的芯片，所述方法包括：所述方法包括：向网络设备发送第一消息，所述第一消息用于请求基于安全校验的第一***信息；接收NAS安全保护的第一***信息。对于RRC IDLE的终端设备，网络设备通过NAS消息传输***信息，终端设备使用NAS安全机制，对***信息进行安全校验，避免了终端设备接收到被篡改的***信息，提高了***信息的安全性。
在一种可能的设计中，接收网络设备发送的指示信息，所述指示信息用于指示所述网络设备支持在所述基于安全校验的***信息。通过指示信息告知终端设备可以请求基于安全校验的***信息。
在另一种可能的设计中，通过NAS安全，对接收到的第一***信息进行安全校验。通过NAS安全对第一***信息进行校验，避免终端设备接收到被篡改的第一***信息，提高了***信息的安全性。
第五方面，本申请实施例提供了一种通信方法，该方法应用于网络设备，或网络设备中的芯片，所述方法包括：接收终端设备发送的第一消息，所述第一消息用于请求基于安全校验的第一***信息；向所述终端设备发送NAS安全保护的第一***信息。对于RRC IDLE的终端设备，网络设备通过NAS消息传输***信息，终端设备使用NAS安全机制，对***信息进行安全校验，避免终端设备接收到被篡改的***信息，提高了***信息的安全性。
在一种可能的设计中，向终端设备发送指示信息，所述指示信息用于指示所述网络设备支持在所述基于安全校验的***信息。通过指示信息告知终端设备可以请求基于安全校验的***信息。
在另一种可能的设计中，向核心网设备发送第四请求，所述第四请求包括所述终端设备请求的第一***信息；接收所述核心网设备发送的第四响应，所述第四响应包括NAS安全保护的第一***信息。通过传输NAS安全保护的第一***信息，避免终端设备接收到被篡改的第一***信息。
第六方面，本申请实施例提供了一种通信方法，该方法应用于终端设备，或终端设备中的芯片，所述方法包括：向网络设备发送第一消息，所述第一消息用于请求基于安全校验的第一***信息；接收网络设备发送的安全激活命令，所述安全激活命令用于激活AS安全。对于RRC IDLE的终端设备，AS安全是没有被激活的，终端设备可以请求NAS激活AS安全。网络设备通过AS安全对***信息进行安全保护，终端设备通过激活的AS安全对***信息进行安全校验，避免了终端设备接收到被篡改的***信息，提高了***信息的安全性。
在一种可能的设计中，接收网络设备发送的指示信息，所述指示信息用于指示所述网络设备支持在所述基于安全校验的***信息。通过指示信息告知终端设备可以请求基于安全校验的***信息。
在另一种可能的设计中，向网络设备发送安全激活完成消息。通过发送安全激活完成消息告知已完成激活AS安全，可以基于激活的AS安全来传输第一***信息。
第七方面，本申请实施例提供了一种通信方法，该方法应用于网络设备，或网络设备中的芯片，所述方法包括：接收终端设备发送的第一消息，所述第一消息用于请求基于安全校验的第一***信息，向终端设备发送安全激活命令，所述安全激活命令用于激活AS安全。对于RRC IDLE的终端设备，AS安全是没有被激活的，终端设备可以请求NAS激活AS安全。网络设备通过AS安全对***信息进行安全保护，终端设备通过激活的AS安全对***信息进行安全校验，避免终端设备接收到被篡改的***信息，提高了***信息的安全性。
在一种可能的设计中，向终端设备发送指示信息，所述指示信息用于指示所述网络设备支持在所述基于安全校验的***信息。通过指示信息告知终端设备可以请求基于安全校验的***信息。
在另一种可能的设计中，向核心网设备发送第五请求，所述第五请求包括原因值，所述原因值为终端设备请求基于安全校验的第一***信息；接收核心网设备发送的第五响应，所述第五响应为AS安全激活命令。通过AS安全激活命令激活处于RRC IDLE的终端设备的AS安全。
在另一种可能的设计中，接收终端设备发送的安全激活完成消息。通过发送安全激活完成消息告知已完成激活AS安全，可以基于激活的AS安全来传输第一***信息。
第八方面，本申请实施例提供了一种通信装置，包括：
接收模块，用于接收第一网络设备发送的第一指示信息和安全参数信息，所述第一指示信息用于指示允许使用基于安全校验的***信息的获取机制，所述安全参数信息用于对***信息进行安全校验；
发送模块，用于向第二网络设备发送第一消息，所述第一消息用于请求基于安全校验的第一***信息。
在一种可能的设计中，所述接收模块，还用于接收所述第二网络设备的第二指示信息，所述第二指示信息用于指示所述第二网络设备支持所述基于安全校验的***信息。
在另一种可能的设计中，所述第一消息为无线资源控制RRC***信息请求消息或专用***信息请求消息。
在另一种可能的设计中，所述接收模块，还用于接收所述第二网络设备发送的第二消息， 所述第二消息包括所述第一***信息，所述第二消息是进行安全保护的；
所述装置还包括：
处理模块，用于根据所述安全参数信息，对所述第二消息进行安全校验。
在另一种可能的设计中，所述接收模块，还用于接收所述第二网络设备发送的所述第一***信息，所述第一***信息是未进行安全保护的。
在另一种可能的设计中，所述接收模块，还用于接收所述第二网络设备发送的哈希安全指令，所述哈希安全指令包括哈希参数，所述哈希参数用于确定所述第一***信息的哈希值；
所述发送模块，还用于向所述第二网络设备发送所述第一***信息的哈希值，所述第一***信息的哈希值用于确定终端设备接收到的所述第一***信息是否被篡改。
在另一种可能的设计中，所述接收模块，还用于接收所述第二网络设备发送的第三消息，所述第三消息是进行安全保护的；
所述装置还包括：
处理模块，用于根据所述安全保护参数，对所述第三消息进行安全校验。
在另一种可能的设计中，所述第三消息包括第三指示信息，所述第三指示信息用于指示所述终端设备接收到的所述第一***信息是否被篡改。
在另一种可能的设计中，当所述终端设备接收到的所述第一***信息被篡改时，所述第三消息包括未被篡改的第一***信息。
该通信装置执行的操作及有益效果可以参见上述第一方面所述的方法以及有益效果，重复之处不再赘述。
第九方面，本申请实施例提供了一种通信装置，包括：
接收模块，用于接收终端设备发送的第一消息，所述第一消息用于请求基于安全校验的第一***信息；
发送模块，用于向所述终端设备发送所述第一***信息。
在一种可能的设计中，所述发送模块，还用于向所述终端设备发送第二指示信息，所述第二指示信息用于指示所述第二网络设备支持所述基于安全校验的***信息。
在另一种可能的设计中，所述第一消息为无线资源控制RRC***信息请求消息或专用***信息请求消息。
在另一种可能的设计中，所述第一***信息包含于第二消息中，所述第二消息是进行安全保护的。
在另一种可能的设计中，所述发送模块，还用于向第一网络设备发送第一请求；
所述接收模块，还用于接收所述第一网络设备发送的第一响应，所述第一响应包括安全保护参数，所述安全保护参数为根据安全参数信息确定的，所述安全保护参数用于对所述第二消息进行安全保护。
在另一种可能的设计中，所述第一请求包括原因值，所述原因值为所述终端设备请求基于安全校验的所述第一***信息，所述原因值用于指示所述第一网络设备确定是否进行锚定位。
在另一种可能的设计中，所述第一响应还用于指示进行锚定位。
在另一种可能的设计中，所述发送模块，还用于向第一网络设备发送第二请求，所述第二请求包括所述第一***信息；
所述接收模块，还用于接收所述第一网络设备发送的第二响应，所述第二响应包括所述第二消息，所述第二消息包括所述第一***信息，所述第二消息是进行安全保护的。
在另一种可能的设计中，所述第二请求包括原因值，所述原因值为所述终端设备请求基于安全校验的所述第一***信息，所述原因值用于指示所述第一网络设备确定是否进行锚定位。
在另一种可能的设计中，所述第二响应还用于指示不进行锚定位。
在另一种可能的设计中，所述第一***信息没有进行安全保护。
在另一种可能的设计中，所述发送模块，还用于向第一网络设备发送第三请求，所述第三请求用于请求安全校验的哈希参数；
所述接收模块，还用于接收所述第一网络设备发送的第三响应，所述第三响应包括第三消息，所述第三消息包括所述哈希参数。
在另一种可能的设计中，所述第三请求包括原因值，所述原因值为所述终端设备请求基于安全校验的所述第一***信息，所述原因值用于指示所述第一网络设备确定是否进行锚定位。
在另一种可能的设计中，所述第三响应还用于指示不进行锚定位。
在另一种可能的设计中，所述发送模块，还用于向所述终端设备发送哈希安全指令，所述哈希安全指令包括哈希参数，所述哈希参数用于确定所述第一***信息的哈希值；
所述接收模块，还用于接收所述终端设备发送的所述第一***信息的哈希值，所述第一***信息的哈希值用于确定所述终端设备接收到的所述第一***信息是否被篡改。
在另一种可能的设计中，所述发送模块，还用于向所述终端设备发送第三消息，所述第三消息是进行安全保护的。
在另一种可能的设计中，所述第三消息包括第三指示信息，所述第三指示信息用于指示所述终端设备接收到的所述第一***信息是否被篡改。
在另一种可能的设计中，当所述终端设备接收到的所述第一***信息被篡改时，所述第三消息包括未被篡改的第一***信息。
该通信装置执行的操作及有益效果可以参见上述第二方面所述的方法以及有益效果，重复之处不再赘述。
第十方面，本申请实施例提供了一种通信装置，包括：
获取模块，用于获取安全参数信息；
发送模块，用于向终端设备发送第一指示信息和安全参数信息，所述第一指示信息用于指示允许使用基于安全校验的***信息的获取机制，所述安全参数信息用于对***信息进行安全校验。
在一种可能的设计中，所述获取模块，还用于接收第二网络设备发送的第一请求；
所述发送模块，还用于向所述第二网络设备发送第一响应，所述第一响应包括安全保护参数，所述安全保护参数为根据所述安全参数信息确定的，所述安全保护参数用于对***信息进行安全保护。
在另一种可能的设计中，所述第一请求包括原因值，所述原因值为所述终端设备请求基于安全校验的所述第一***信息，所述原因值用于指示所述第一网络设备确定是否进行锚定位。
在另一种可能的设计中，所述第一响应还用于指示进行锚定位。
在另一种可能的设计中，所述获取模块，还用于接收第二网络设备发送的第二请求，所述第二请求包括所述第一***信息；
所述发送模块，还用于向所述第二网络设备发送第二响应，所述第二响应包括第二消息， 所述第二消息包括所述第一***信息，所述第二消息是根据所述安全参数信息进行安全保护的。
在另一种可能的设计中，所述第二请求包括原因值，所述原因值为所述终端设备请求基于安全校验的所述第一***信息，所述原因值用于指示所述第一网络设备确定是否进行锚定位。
在另一种可能的设计中，所述第二响应还用于指示不进行锚定位。
在另一种可能的设计中，所述获取模块，还用于接收第二网络设备发送的第三请求，所述第三请求包括请求安全校验的哈希参数；
所述发送模块，还用于向所述第二网络设备发送第三响应，所述第三响应包括第三消息，所述第三消息包括所述哈希参数。
在另一种可能的设计中，所述第三请求包括原因值，所述原因值为所述终端设备请求基于安全校验的所述第一***信息，所述原因值用于指示所述第一网络设备确定是否进行锚定位。
在另一种可能的设计中，所述第三响应还用于指示不进行锚定位。
该通信装置执行的操作及有益效果可以参见上述第三方面所述的方法以及有益效果，重复之处不再赘述。
第十一方面，本申请实施例提供了一种通信装置，包括：
发送模块，用于向网络设备发送第一消息，所述第一消息用于请求基于安全校验的第一***信息；
接收模块，用于接收NAS安全保护的第一***信息。
在一种可能的设计中，所述接收模块，还用于接收网络设备发送的指示信息，所述指示信息用于指示所述网络设备支持在所述基于安全校验的***信息。
在另一种可能的设计中，所述装置还包括处理模块，
所述处理模块，用于通过NAS安全，对接收到的第一***信息进行安全校验。
该通信装置执行的操作及有益效果可以参见上述第四方面所述的方法以及有益效果，重复之处不再赘述。
第十二方面，本申请实施例提供了一种通信装置，包括：
接收模块，用于接收终端设备发送的第一消息，所述第一消息用于请求基于安全校验的第一***信息；
发送模块，用于向所述终端设备发送NAS安全保护的第一***信息。
在一种可能的设计中，所述发送模块，还用于向终端设备发送指示信息，所述指示信息用于指示所述网络设备支持在所述基于安全校验的***信息。
在另一种可能的设计中，所述发送模块，还用于向核心网设备发送第四请求，所述第四请求包括所述终端设备请求的第一***信息；所述接收模块，还用于接收所述核心网设备发送的第四响应，所述第四响应包括NAS安全保护的第一***信息。
该通信装置执行的操作及有益效果可以参见上述第五方面所述的方法以及有益效果，重复之处不再赘述。
第十三方面，本申请实施例提供了一种通信装置，包括：
发送模块，用于向网络设备发送第一消息，所述第一消息用于请求基于安全校验的第一***信息；
接收模块，用于接收网络设备发送的安全激活命令，所述安全激活命令用于激活AS安 全。
在一种可能的设计中，所述接收模块，还用于接收网络设备发送的指示信息，所述指示信息用于指示所述网络设备支持在所述基于安全校验的***信息。
在另一种可能的设计中，所述发送模块，还用于向网络设备发送安全激活完成消息。
该通信装置执行的操作及有益效果可以参见上述第六方面所述的方法以及有益效果，重复之处不再赘述。
第十四方面，本申请实施例提供了一种通信方装置，包括：
接收模块，用于接收终端设备发送的第一消息，所述第一消息用于请求基于安全校验的第一***信息；
发送模块，用于向终端设备发送安全激活命令，所述安全激活命令用于激活AS安全。
在一种可能的设计中，所述发送模块，还用于向终端设备发送指示信息，所述指示信息用于指示所述网络设备支持在所述基于安全校验的***信息。
在另一种可能的设计中，所述发送模块，还用于向核心网设备发送第五请求，所述第五请求包括原因值，所述原因为终端设备请求基于安全校验的第一***信息；所述接收模块，还用于接收核心网设备发送的第五响应，所述第五响应为AS安全激活命令。
在另一种可能的设计中，所述接收模块，还用于接收终端设备发送的安全激活完成消息。
该通信装置执行的操作及有益效果可以参见上述第七方面所述的方法以及有益效果，重复之处不再赘述。
第十五方面，本申请实施例提供了一种通信装置，该通信装置被配置为实现上述第一方面、第四方面、第六方面，以及第一方面、第四方面、第六方面中任意可能的一种可能的设计中的终端设备所执行的方法和功能，由硬件/软件实现，其硬件/软件包括与上述功能相应的模块。
第十六方面，本申请实施例提供了一种通信装置，该通信装置被配置为实现上述第一方面以及第一方面中任意可能的一种可能的设计中的第二网络设备所执行的方法和功能，由硬件/软件实现，其硬件/软件包括与上述功能相应的模块。
第十七方面，本申请实施例提供了一种通信装置，该通信装置被配置为实现上述第三方面以及第三方面中任意可能的一种可能的设计中的第一网络设备所执行的方法和功能，由硬件/软件实现，其硬件/软件包括与上述功能相应的模块。
第十八方面，本申请提供了一种通信装置，该装置可以是终端设备，也可以是终端设备中的装置，或者是能够和终端设备匹配使用的装置。其中，该通信装置还可以为芯片***。该通信装置可执行第一方面所述的方法。该通信装置的功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。该硬件或软件包括一个或多个与上述功能相对应的模块。该模块可以是软件和/或硬件。该通信装置执行的操作及有益效果可以参见上述第一方面所述的方法以及有益效果，重复之处不再赘述。
第十九方面，本申请提供了一种通信装置，该装置可以是第二网络设备，也可以是第二网络设备中的装置，或者是能够和第二网络设备匹配使用的装置。其中，该通信装置还可以为芯片***。该通信装置可执行第二方面所述的方法。该通信装置的功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。该硬件或软件包括一个或多个与上述功能相对应的模块。该模块可以是软件和/或硬件。该通信装置执行的操作及有益效果可以参见上述第二方面所述的方法以及有益效果，重复之处不再赘述。
第二十方面，本申请提供了一种通信装置，该装置可以是第一网络设备，也可以是第一 网络设备中的装置，或者是能够和第一网络设备匹配使用的装置。其中，该通信装置还可以为芯片***。该通信装置可执行第三方面所述的方法。该通信装置的功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。该硬件或软件包括一个或多个与上述功能相对应的模块。该模块可以是软件和/或硬件。该通信装置执行的操作及有益效果可以参见上述第三方面所述的方法以及有益效果，重复之处不再赘述。
第二十一方面，本申请提供了一种通信装置，所述通信装置包括处理器，当所述处理器调用存储器中的计算机程序时，如第一方面至第七方面中任意一项所述的方法被执行。
第二十二方面，本申请提供了一种通信装置，所述通信装置包括处理器和存储器，所述存储器用于存储计算机程序；所述处理器用于执行所述存储器所存储的计算机程序以使所述通信装置执行如第一方面至第七方面中任意一项所述的方法。
第二十三方面，本申请提供了一种通信装置，所述通信装置包括处理器、存储器和收发器，所述收发器，用于接收信道或信号，或者发送信道或信号；所述存储器，用于存储计算机程序；所述处理器，用于从所述存储器调用所述计算机程序执行如第一方面至第七方面中任意一项所述的方法。
第二十四方面，本申请提供了一种通信装置，所述通信装置包括处理器和接口电路，所述接口电路，用于接收计算机程序并传输至所述处理器；所述处理器运行所述计算机程序以执行如第一方面至第七方面中任意一项所述的方法。
第二十五方面，本申请提供了一种计算机可读存储介质，所述计算机可读存储介质用于存储计算机程序，当所述计算机程序被执行时，使得如第一方面至第七方面中任意一项所述的方法被实现。
第二十六方面，本申请提供一种包括计算机程序的计算机程序产品，当所述计算机程序被执行时，使得如第一方面至第七方面中任意一项所述的方法被实现。
第二十七方面，本申请实施例提供了一种通信***，该通信***包括至少一个终端设备和至少一个网络设备，该终端设备用于执行上述第一方面、第四方面以及第六方面中的步骤，该网络设备用于执行上述第二方面、第三方面、第五方面以及第七方面中的步骤。
附图说明
为了更清楚地说明本申请实施例或背景技术中的技术方案，下面将对本申请实施例或背景技术中所需要使用的附图进行说明。
图1(A)是本申请实施例提供的一种通信***的架构示意图；
图1(B)是本申请实施例提供的另一种通信***的架构示意图；
图2是一种从RRC inactive恢复到RRC连接态的示意图；
图3是本申请实施例提供的一种通信方法的流程示意图；
图4是本申请实施例提供的另一种通信方法的流程示意图；
图5是本申请实施例提供的另一种通信方法的流程示意图；
图6是本申请实施例提供的另一种通信方法的流程示意图；
图7是本申请实施例提供的另一种通信方法的流程示意图；
图8是本申请实施例提供的一种通信装置的结构示意图；
图9是本申请实施例提供的一种通信装置的结构示意图；
图10是本申请实施例提供的一种通信装置的结构示意图；
图11是本申请实施例提供的一种终端设备的结构示意图；
图12是本申请实施例提供的一种第二网络设备的结构示意图；
图13是本申请实施例提供的一种第一网络设备的结构示意图。
具体实施方式
如图1(A)所示，图1(A)是本申请实施例提供的一种通信***的架构示意图。该通信***包括下一代无线接入网(Next generation radio access network，NG-RAN)和核心网(5GC，5rd generation core network)两部分。NG-RAN用于实现无线接入有关的功能。NG-RAN主要包括RAN节点。其中，核心网主要包括接入和移动性管理功能(access and mobility management function，AMF)实体、用户面功能(user plane function，UPF)实体。其中：
RAN节点为终端设备提供无线接入的设备，RAN节点包括5G基站(next generation node B，gNB)或LTE基站(not next generation evolved Node B，ng-eNB)。对于gNB，提供新无线(new radio，NR)用户面和控制面协议的终结点，对于ng-eNB，它提供演进的UMTS陆地无线接入网(evolved UMTS terrestrial radio access network，E-UTRAN)用户面和控制面协议栈的终结点。gNB与gNB，gNB与ng-eNB，ng-eNB与ng-eNB之间通过Xn接口进行连接。gNB和ng-eNB，他们与5GC通过下一代(next generation，NG)接口进行连接。具体的，与AMF实体通过NG-C接口进行连接，与UPF实体通过NR-U接口进行连接。
AMF实体主要负责移动网络中的移动性管理，如用户位置更新、用户注册网络、用户切换等。UPF实体主要负责对用户报文进行处理，如转发、计费等。
又如图1(B)所示，图1(B)是本申请实施例提供的另一种通信***的架构示意图。该通信***100可以包括网络设备110和终端设备101～终端设备106。应理解，可以应用本申请实施例的方法的通信***100中可以包括更多或更少的网络设备或终端设备。网络设备或终端设备可以是硬件，也可以是从功能上划分的软件或者以上二者的结合。网络设备与终端设备之间可以通过其他设备或网元通信。在该通信***100中，网络设备110可以向终端设备101～终端设备106发送下行数据。当然，终端设备101～终端设备106也可以向网络设备110发送上行数据。终端设备101～终端设备106可以是蜂窝电话、智能电话、便携式电脑、手持通信设备、手持计算设备、卫星无线电装置、全球定位***、掌上电脑(personal digital assistant，PDA)和/或用于在无线通信***100上通信的任意其它适合设备等等。网络设备110可以为是长期演进(long term evolution，LTE)和/或NR的网络设备，具体的可以是基站(NodeB)、演进型基站(eNodeB)、5G移动通信***中的基站、下一代移动通信基站(Next generation Node B，gNB)，未来移动通信***中的基站或Wi-Fi***中的接入节点。
通信***100可以采用公共陆地移动网络(public land mobile network，PLMN)、车联网(vehicle to everything，V2X)、设备到设备(device-to-device，D2D)网络、机器到机器(machine to machine，M2M)网络、物联网(internet of things，IoT)或其他网络。此外，终端设备104～终端设备106也可以组成一个通信***。在该通信***中，终端设备105可以发送下行数据给终端设备104或终端设备106。在本申请实施例中的方法可以应用于图1(B)所示的通信***100中。
第三代合作伙伴计划(3rd generation partnership project，3GPP)在5G网络中，引入了三个RRC状态：RRC空闲态(RRC IDLE)、RRC非激活态(RRC INACTIVE)、和RRC连接态(RRC CONNECTED)。
在RRC连接态下，终端设备与网络设备之间有专用的RRC连接。专用的RRC连接可以为数据无线承载(data radio bearers，DRB)或信令无线承载1(signalling radio bearers1，SRB1 的连接。
在RRC空闲态下，终端设备与网络设备没有专用的RRC连接。
在RRC非激活态下，终端设备在网络设备下移动，可以无需知会网络设备。终端设备保存自己的上下文，最后为终端设备提供服务的基站(Last serving gNB)保存终端设备的上下文、以及与AMF实体和UPF的NG连接。终端设备与网络设备的专用的RRC连接是挂起的，后续可以恢复。终端设备在RRC非激活态下执行小区重选。
RRC非激活态是5G新增的一种RRC状态，目的是使终端设备可以快速恢复到RRC连接态，而无需重新接入。RRC非激活态和RRC空闲态类似，都只能接收公共搜索空间的内容广播(paging)，可以进行小区重选，并且小区重选的原理与RRC空闲态相同。在RRC非激活态下可以获得与在RRC空闲态下相近的功耗水平，原因是在RRC非激活态的终端设备会暂停数据处理，若终端设备在同一个网络设备中移动时，则不需要与网络设备交互信息。但若UE移动超出网络设备的覆盖范围时，则需要启动无线接入网通知区域(RAN notification area，RNA)更新过程。处于RRC非激活态的UE可以有较低的数据传输恢复时延，原因是RRC非激活态的UE可以通过RRC恢复(resume)流程快速迁移到RRC连接态。
如图2所示，图2是一种从RRC inactive恢复到RRC连接态的示意图。下面以终端设备为UE，Last serving gNB为第二基站进行说明。第二基站保存UE的上下文，UE移动出第二基站的覆盖范围，进入第一基站的覆盖范围，并发起RRC恢复过程。
1.终端设备处于非激活态下，向第一基站发送RRC恢复请求(RRC resume request)，该RRC恢复请求中可以携带非激活无线网络临时标识符(inactive radio network tempory identity，I-RNTI)。
2.第一基站向第二基站发送获取UE的上下文请求(retrieve UE context request)。该获取UE的上下文请求可以包括所述I-RNTI。第二基站可以根据I-RNTI，确定终端设备的上下文。
3.第二基站向第一基站发送获取UE的上下文的响应(retrieve UE context response)。该获取UE的上下文的响应包括UE的上下文。
4.第一基站向终端设备发送RRC恢复(RRC resume)消息。UE在接收到RRC恢复消息，进入RRC连接态，RRC连接恢复。
5.UE向第一基站发送RRC恢复完成(RRC resume complete)消息。
6.第一基站向第二基站发送Xn-U地址指示(Xn-U address indication)。
所述Xn-U地址指示用于通知第二基站的数据转发的隧道地址，该数据主要为下行数据。此时，如果第二基站有UE的下行数据，那么可以将下行数据发送给第一基站，之后第一基站将下行数据发送给UE。
7.第一基站向AMF实体发送路径切换请求(path switch request)，所述路径切换请求用于切换路径，将UPF实体与第二基站的连接切换到UPF实体与第一基站的连接，之后的下行数据都是UPF实体直接发给第一基站，而不是第二基站。
8.AMF实体向第一基站发送路径切换响应(path switch response)。
9.第一基站向第二基站发送UE的上下文释放(UE context release)消息。所述UE的上下文释放消息用于通知第二基站释放UE的上下文。
RRC空闲态切换到RRC连接态的转换的信令流程，实际就是UE初始接入的过程，包含随机接入、RRC连接建立和初始上下文建立。将该信令流程与RRC非激活态切换到RRC连 接态的信令流程进行对比，可以发现RRC非激活态下通过RRC恢复流程，可以节省大量的信令交互，例如在Uu口上减少了RRC重配置过程和安全模式配置过程，在NG口上减少了上下文建立过程、鉴权流程等。使得在RRC非激活态下相对于在RRC空闲态下，UE可以更快的接入网络。
***信息主要包括MIB和多个SIB，SIB主要包括SIB1和其他SIB，SIB1主要包括其他***信息的调度信息和初始接入的信息，其他SIB主要包括以下信息：(1)SIB2，包括服务小区的小区重选信息；(2)SIB3，包括服务频点和同频点的邻区的小区重选信息；(3)SIB4，包括异频点的小区重选信息；(4)SIB5，包括E-UTRA频点和邻区的小区重选信息；(5)SIB6，包括地震和海啸预警***(earthquake and tsunami warning system，ETWS)的主要通知；(6)SIB7，包括ETWS的次要通知；(7)SIB8，包括商用移动警报***(commercial mobile alert system，CMAS)的警告通知；(8)SIB9，包括全球定位***(global positioning system，GPS)时间和协调世界时(coordinated universal time，UTC)的信息；(9)SIB10，包括非公共网络(non-public network，NPN)的人类可读的网络名称(human-readable network names)信息；(10)SIB11包括IDLE和INACTIVE的测量信息；(11)SIBpos：包括定位辅助数据。
对于on demand的***信息，主要有以下几种方式：MSG1-based SI请求，MSG3-based SI请求，dedicated SI Request。
(1)MSG1-based SI。
1、终端设备向网络设备发送前导序列，所述前导序列与请求的SIB有对应关系。2、终端设备接收随机接入响应。3、终端设备通过广播接收请求的SIB。
(2)MSG3-based SI。
1、终端设备向网络设备发送前导序列。2、终端设备接收随机接入响应。3、终端设备向网络设备发送MSG3，所述MSG3中指示请求的SIB信息。4、终端设备接收竞争解决信息，5、终端设备通过广播接收请求的SIB。
(3)Dedicated SI Request。
1、终端设备向网络设备发送dedicated Request。2、终端设备通过单播接收***信息。
对于dedicated SI Request，可以用于RRC连接态的UE的***信息获取，有安全校验。
对于IDLE UE或INACTIVE UE，上述***信息的获取，都是没有安全校验的，从而导致终端设备获取到篡改的***信息，存在安全风险。为了解决上述技术问题，本申请实施例提供了如下解决方案。
如图3所示，图3是本申请实施例提供的一种通信方法的流程示意图。本申请实施例可以包括如下步骤：
S301，终端设备接收第一网络设备发送的第一指示信息和安全参数信息，所述第一指示信息用于指示允许使用基于安全校验的***信息的获取机制，所述安全参数信息用于对***信息进行安全校验。
具体的，第一网络设备可以获取安全参数信息，然后向终端设备发送第一指示信息和安全参数信息。终端设备接收到第一指示信息和安全参数信息之后，可以获知允许使用基于安全校验的***信息的获取机制。并且，终端设备可以根据安全参数信息，确定安全保护参数。后续终端设备可以使用该安全保护参数对接收到的***信息进行安全校验。其中，安全参数信息可以为下一跳链计数(next chaining counter，NCC)，NCC用于标识一个安全秘钥。
其中，第一网络设备可以为上一次为该终端设备提供服务的基站(Last serving gNB)。终 端设备当前处于RRC非激活态下，在RRC非激活态下，专用的RRC连接挂起。专用的RRC连接可以为数据无线承载(data radio bearers，DRB)或信令无线承载1(signalling radio bearers1，SRB1)的连接。
S302，终端设备接收第二网络设备发送的第二指示信息，所述第二指示信息用于指示所述第二网络设备支持所述基于安全校验的***信息。
S303，终端设备向第二网络设备发送第一消息，所述第一消息用于请求基于安全校验的第一***信息。
其中，第一消息可以为RRC***信息请求消息(RRC system information request)或专用***信息请求消息(dedicated SIB request)。RRC***信息请求消息是通过SRB0传输的，专用***信息请求消息是通过SRB1传输的。第一***信息可以为MIB或SIB1，所述SIB1可以用于传输其他***信息的调度信息。例如，其他***信息可以为on demand的***信息。
可选的，终端设备可以向第二网络设备发送RRC恢复请求(RRC resume request)。RRC恢复请求可以包括原因值，所述原因值为终端设备请求基于安全校验的第一***信息。通过RRC恢复请求，终端设备与第二网络设备之间建立SRB1。其中，RRC恢复请求是通过SRB0传输的。
其中，第一消息和RRC恢复请求可以在同一个消息中，例如，随机接入的消息3(MSG3)，也可以在不同的消息中。
S304，第二网络设备向第一网络设备发送第一请求。
其中，第一请求包括原因值，所述原因值为终端设备请求基于安全校验的第一***信息。第一网络设备接收到第一请求之后，可以根据原因值，确定是否进行锚定位(anchor relocation)。
在本申请实施例中，第一网络设备确定进行锚定位。本申请实施例适用于小数据传输(small data transmission，SDT)进行锚定位(with anchor relocation)的场景。
其中，第一请求可以为获取UE的上下文请求(retrieve UE context request)。
S305，第一网络设备向第二网络设备发送第一响应。
其中，第一响应可以包括终端设备的上下文和安全保护参数，终端设备的上下文可以包括分组数据汇聚协议(packet data convergence protocol，PDCP)配置、无线链路控制层协议(radio link control，RLC)配置、服务数据适配协议(service data adaptation protocol，SDAP)配置等等，所述安全保护参数为第一网络设备根据安全参数信息确定的。
可选的，第一响应还可以用于指示进行锚定位。例如，第一响应中一个字段中包括一个比特，当该比特为1时，则指示进行锚定位。
其中，第一响应可以为获取UE的上下文的响应(retrieve UE context response)。
S306，第二网络设备与AMF实体进行路径切换(path switch)过程。
具体的，第二网络设备可以向第一网络设备发送Xn-U地址指示(Xn-U address indication)。所述Xn-U地址指示用于通知第一网络设备的数据转发的隧道地址。然后，第二网络设备向AMF实体发送路径切换请求(path switch request)，所述路径切换请求用于切换路径，将UPF实体与第一网络设备的连接切换到UPF实体与第二网络设备的连接，之后的下行数据都是UPF实体直接发给第二网络设备，而不是第一网络设备。最后，AMF实体向第二网络设备发送路径切换响应(path switch response)。
S307，第二网络设备确定让终端设备保持在RRC非激活态下，将第一***信息封装在第二消息中，向终端设备发送第二消息。
其中，所述第二消息包括第一***信息，第二消息是使用上述接收到的安全保护参数进行安全保护的。所述第二消息可以为RRC释放(RRC release)消息，所述第二消息为通过SRB1传输的。
S308，终端设备根据S301中确定的安全保护参数，对接收到的第二消息进行安全校验。
需要说明的是，安全保护可以为完整性保护，安全校验可以为完整性校验。完整性保护可以理解为：第二网络设备根据安全保护参数计算出一个或多个比特，将一个或多比特与第二消息一起发送给终端设备，一个或多比特对第一消息起到完整性保护的作用。完整性校验可以理解为：终端设备根据安全保护参数计算出一个或多个比特，如果计算出的一个或多个比特与接收到的一个或多个比特相同，则完整性校验通过，说明接收到的第一***信息是安全的，未被篡改的。
可选的，第二网络设备向终端设备发送第二消息之后，可以向第一网络设备发送UE的上下文释放(UE context release)消息。所述UE的上下文释放消息用于通知第一网络设备释放UE的上下文。
在本申请实施例中，对于处于RRC非激活态的终端设备，使用基于安全校验的***信息的获取机制向网络设备请求***信息。由于在SRB1恢复后SRB1是有安全保护的，网络设备通过SRB1传输具有安全保护的***信息，避免终端设备接收到被篡改的***信息，提高了***信息的安全性。本申请实施例适用于SDT with anchor relocation的场景。
如图4所示，图4是本申请实施例提供的一种通信方法的流程示意图。本申请实施例可以包括如下步骤：
S401，终端设备接收第一网络设备发送的第一指示信息和安全参数信息，所述第一指示信息用于指示允许使用基于安全校验的***信息的获取机制，所述安全参数信息用于对***信息进行安全校验。
具体的，第一网络设备可以获取安全参数信息，然后向终端设备发送第一指示信息和安全参数信息。终端设备接收到第一指示信息和安全参数信息之后，可以获知允许使用基于安全校验的***信息的获取机制。并且，终端设备可以根据安全参数信息，确定安全保护参数。后续终端设备可以使用该安全保护参数对接收到的***信息进行安全校验。其中，安全参数信息可以为下一跳链计数(next chaining counter，NCC)，NCC用于标识一个安全秘钥。
其中，第一网络设备可以为上一次为该终端设备提供服务的基站(Last serving gNB)。终端设备当前处于RRC非激活态下，在RRC非激活态下，专用的RRC连接挂起。专用的RRC连接可以为数据无线承载(data radio bearers，DRB)或信令无线承载1(signalling radio bearers1，SRB1)的连接。
S402，终端设备接收第二网络设备发送的第二指示信息，所述第二指示信息用于指示所述第二网络设备支持所述基于安全校验的***信息。
S403，终端设备向第二网络设备发送第一消息，所述第一消息用于请求基于安全校验的第一***信息。
其中，第一消息可以为RRC***信息请求消息(RRC system information request)或专用***信息请求消息(dedicated SIB request)。RRC***信息请求消息是通过SRB0传输的，专用***信息请求消息是通过SRB1传输的。第一***信息可以为MIB或SIB1，所述SIB1可以用于传输其他***信息的调度信息。例如，其他***信息可以为on demand的***信息。
可选的，终端设备可以向第二网络设备发送RRC恢复请求(RRC resume request)。RRC 恢复请求可以包括原因值，所述原因值为终端设备请求基于安全校验的第一***信息。通过RRC恢复请求，终端设备与第二网络设备之间建立SRB1。其中，RRC恢复请求是通过SRB0传输的。
其中，第一消息和RRC恢复请求可以在同一个消息中，例如，随机接入的消息3。也可以在不同的消息中。
S404，第二网络设备向第一网络设备发送第二请求。
其中，第二请求包括原因值，所述原因值为终端设备请求基于安全校验的第一***信息。第一网络设备接收到第二请求之后，可以根据原因值，确定是否进行锚定位(anchor relocation)。
其中，所述第二请求还包括所述终端设备请求的第一***信息。
其中，第一请求可以为获取UE的上下文请求(retrieve UE context request)。
在本申请实施例中，第一网络设备确定不进行锚定位。本申请实施例适用于SDT without anchor relocation的场景。
S405，第一网络设备向第二网络设备发送第二响应。
其中，第二响应可以包括终端设备的部分上下文和第二消息，第二消息包括经过安全保护的第一***信息，终端设备的部分上下文可以包括无线链路控制层协议(radio link control，RLC)配置等。其中，第二消息可以为RRC释放(RRC release)消息。
具体的，第一网络设备根据安全参数信息确定安全保护参数，然后通过安全保护参数对第一***信息进行安全保护。然后将经过安全保护的第一***信息封装在第二消息或其他消息中。第二消息或其他消息都是通过SRB1传输的。
可选的，第二响应还可以用于指示不进行锚定位。例如，第二响应中一个字段中包括一个比特，当该比特为0时，则指示不进行锚定位。
其中，第二响应可以为获取UE的上下文的响应(retrieve UE context response)。
S406，第二网络设备确定让终端设备保持在RRC非激活态下，向终端设备发送第二消息。
其中，所述第二消息包括第一***信息，第一***信息是进行安全保护的。所述第二消息可以为RRC释放(RRC release)消息，所述第二消息为通过SRB1传输的。
S407，终端设备根据S401中确定的安全保护参数，对接收到的第一***信息进行安全校验。如果安全校验通过，则说明接收到的第一***信息是安全的。
可选的，可以第二网络设备向终端设备发送第二消息之后，向第一网络设备发送UE的上下文释放(UE context release)消息。所述UE的上下文释放消息用于通知第一网络设备释放UE的上下文。
在本申请实施例中，对于处于RRC非激活态的终端设备，使用基于安全校验的***信息的获取机制向网络设备请求***信息。由于在SRB1恢复后SRB1是有安全保护的，网络设备通过SRB1传输具有安全保护的***信息，避免终端设备接收到被篡改的***信息，提高了***信息的安全性。
如图5所示，图5是本申请实施例提供的一种通信方法的流程示意图。本申请实施例可以包括如下步骤：
S501，终端设备接收第一网络设备发送的第一指示信息和安全参数信息，所述第一指示信息用于指示允许使用基于安全校验的***信息的获取机制，所述安全参数信息用于对***信息进行安全校验。
具体的，第一网络设备可以获取安全参数信息，然后向终端设备发送第一指示信息和安全参数信息。终端设备接收到第一指示信息和安全参数信息之后，可以获知允许使用基于安全校验的***信息的获取机制。并且，终端设备可以根据安全参数信息，确定安全保护参数。后续终端设备可以使用该安全保护参数对接收到的***信息进行安全校验。其中，安全参数信息可以为下一跳链计数(next chaining counter，NCC)，NCC用于标识一个安全秘钥。
其中，第一网络设备可以为上一次为该终端设备提供服务的基站(Last serving gNB)。终端设备当前处于RRC非激活态下，在RRC非激活态下，专用的RRC连接挂起。专用的RRC连接可以为数据无线承载(data radio bearers，DRB)或信令无线承载1(signalling radio bearers1，SRB1)的连接。
S502，终端设备接收第二网络设备发送的第二指示信息，所述第二指示信息用于指示所述第二网络设备支持所述基于安全校验的***信息。
S503，终端设备向第二网络设备发送第一消息，所述第一消息用于请求基于安全校验的第一***信息。
其中，第一消息可以为RRC***信息请求消息(RRC system information request)或专用***信息请求消息(dedicated SIB request)。RRC***信息请求消息是通过SRB0传输的，专用***信息请求消息是通过SRB1传输的。第一***信息可以为MIB或SIB1，所述SIB1可以用于传输其他***信息的调度信息。例如，其他***信息可以为on demand的***信息。
可选的，终端设备可以向第二网络设备发送RRC恢复请求(RRC resume request)。RRC恢复请求可以包括原因值，所述原因值为终端设备请求基于安全校验的第一***信息。通过RRC恢复请求，终端设备与第二网络设备之间建立SRB1。其中，RRC恢复请求是通过SRB0传输的。
其中，第一消息和RRC恢复请求可以在同一个消息中，例如，随机接入的消息3，也可以在不同的消息中。
S504，第二网络设备向终端设备发送第一***信息，所述第一***信息是未进行安全保护的。
S505，第二网络设备向第一网络设备发送第三请求。其中，所述第三请求用于请求安全校验的哈希参数(hash key)。
其中，第三请求还可以包括原因值，所述原因值为终端设备请求基于安全校验的第一***信息。第一网络设备接收到第二请求之后，可以根据原因值，确定是否进行锚定位(anchor relocation)。
其中，第三请求可以为获取UE的上下文请求(retrieve UE context request)。
在本申请实施例中，第一网络设备确定不进行锚定位。本申请实施例适用于SDT without anchor relocation的场景。
S506，第二网络设备接收所述第一网络设备发送的第三响应，所述第三响应包括第三消息，所述第三消息包括所述哈希参数。
其中，第三响应还可以包括终端设备的部分上下文息，终端设备的部分上下文可以包括终端设备的部分上下文可以包括无线链路控制层协议(radio link control，RLC)配置等。
其中，第三消息可以为RRC释放(RRC release)消息。第三消息是通过SRB1传输的。
可选的，第三响应还可以用于指示不进行锚定位。例如，第三响应中一个字段中包括一个比特，当该比特为1时，则指示进行锚定位。
S507，第二网络设备向终端设备发送哈希安全指令，所述哈希安全指令包括哈希参数， 所述哈希参数用于确定所述第一***信息的哈希值。
可选的，终端设备接收到哈希安全指令之后，根据哈希参数，确定第一***信息的哈希值。
其中，哈希安全指令是通过SRB1传输的。
S508，终端设备向所述第二网络设备发送所述第一***信息的哈希值，所述第一***信息的哈希值用于确定所述终端设备接收到的所述第一***信息是否被篡改。
可选的，第二网络设备接收到所述第一***信息的哈希值之后，根据接收到的第一网络设备的哈希参数，自身计算第一***信息的哈希值，并将计算的第一***信息的哈希值与接收到的终端设备计算的第一***信息的哈希值进行比较，如果两者相同，则确定终端设备接收的第一***信息未被篡改，如果两者不相同，则确定终端设备接收到的第一***信息被篡改。
其中，第一***信息的哈希值是通过SRB1传输的。
S509，第二网络设备向终端设备发送第三消息，所述第三消息是进行安全保护的。
其中，所述第三消息包括第三指示信息，所述第三指示信息用于指示所述终端设备接收到的所述第一***信息是否被篡改。例如，第一指示信息可以为一个比特，如果该比特为1，则确定所述终端设备接收到的所述第一***信息被篡改，如果该比特为0，则确定所述终端设备接收到的所述第一***信息未被篡改。
可选的，当所述终端设备接收到的所述第一***信息被篡改时，所述第三消息包括未被篡改的第一***信息。
S510，终端设备根据S501中确定的安全保护参数，对所述第三消息进行安全校验。如果安全校验通过，则说明接收到的第一***信息是安全的。
可选的，第二网络设备向终端设备发送第二消息之后，可以向第一网络设备发送UE的上下文释放(UE context release)消息。所述UE的上下文释放消息用于通知第一网络设备释放UE的上下文。
在本申请实施例中，对于处于RRC非激活态的终端设备，使用基于安全校验的***信息的获取机制向网络设备请求***信息。由于在SRB1恢复后SRB1是有安全保护的，网络设备通过SIB1传输哈希参数，对***信息进行安全校验，避免终端设备接收到被篡改的***信息，提高了***信息的安全性。
如图6所示，图6是本申请实施例提供的一种通信方法的流程示意图。本申请实施例可以包括如下步骤：
S601，终端设备接收网络设备发送的指示信息，所述指示信息用于指示所述网络设备支持在所述基于安全校验的***信息，其中，***信息可以通过SDT传输。
S602，终端设备向网络设备发送第一消息，所述第一消息用于请求基于安全校验的第一***信息。
其中，第一消息可以为RRC***信息请求消息(RRC system information request)或专用***信息请求消息(dedicated SIB request)。RRC***信息请求消息是通过SRB0传输的，专用***信息请求消息是通过SRB1传输的。第一***信息可以为MIB或SIB1，所述SIB1可以用于传输其他***信息的调度信息。例如，其他***信息可以为on demand的***信息。
可选的，终端设备可以向网络设备发送RRC小数据传输请求(RRC SDT request)。RRC SDT request可以包括原因值，所述原因值为终端设备请求基于安全校验的第一***信息。其 中，RRC SDT request是通过SRB0传输的。
其中，第一消息和RRC小数据传输请求可以在同一个消息中，例如，随机接入的消息3，也可以在不同的消息中。
其中，第一***信息可以为MIB或SIB1，所述SIB1可以用于传输其他***信息的调度信息。例如，其他***信息可以为on demand的***信息。
S603，网络设备向核心网设备发送第四请求，所述第四请求包括所述终端设备请求的第一***信息。
其中，第四请求可以为小数据传输上行非接入层消息转移(SDT UL NAS message transfer)消息。核心网设备可以包括AMF实体、安全锚定功能(security anchor function，SEAF)实体等等。
S604，核心网设备对第一***信息进行NAS安全保护，向网络设备发送第四响应。
其中，第四响应包括NAS安全保护的第一***信息。第四响应可以为小数据传输下行非接入层消息转移(SDT DL NAS message transfer)消息。
S605，网络设备向终端设备发送第四消息。
其中，第四消息可以为RRC小数据传输响应(RRC SDT response)。RRC SDT response可以包括NAS安全保护的第一***信息。所述NAS安全保护的第一***信息包含于SDT DL NAS message transfer消息中。
S606，终端设备通过NAS安全，对接收到的第一***信息进行安全校验。
在本申请实施例中，对于RRC IDLE的终端设备，网络设备通过NAS消息传输***信息，终端设备使用NAS安全机制，对***信息进行安全校验，避免了终端设备接收到被篡改的***信息，提高了***信息的安全性。
如图7所示，图7是本申请实施例提供的一种通信方法的流程示意图。本申请实施例可以包括如下步骤：
S701，终端设备接收网络设备发送的指示信息，所述指示信息用于指示所述网络设备支持在所述基于安全校验的***信息，其中，***信息可以通过SDT传输。
S702，终端设备向网络设备发送第一消息，所述第一消息用于请求基于安全校验的第一***信息。
其中，第一消息可以为RRC***信息请求消息(RRC system information request)或专用***信息请求消息(dedicated SIB request)。RRC***信息请求消息是通过SRB0传输的，专用***信息请求消息是通过SRB1传输的。第一***信息可以为MIB或SIB1，所述SIB1可以用于传输其他***信息的调度信息。例如，其他***信息可以为on demand的***信息。
可选的，终端设备可以向网络设备发送RRC小数据传输请求(RRC SDT request)。RRC SDT request可以包括原因值，所述原因值为终端设备请求基于安全校验的第一***信息。其中，RRC SDT request是通过SRB0传输的。
其中，第一消息和RRC小数据传输请求可以在同一个消息中，例如，随机接入的消息3，也可以在不同的消息中。
其中，第一***信息可以为MIB或SIB1，所述SIB1可以用于传输其他***信息的调度信息。例如，其他***信息可以为on demand的***信息。
S703，网络设备向核心网设备发送第五请求。所述第五请求包括原因值，所述原因值为终端设备请求基于安全校验的第一***信息。
其中，第五请求可以为小数据传输上行非接入层消息转移(SDT UL NAS message transfer)消息。核心网设备可以包括AMF实体、安全锚定功能(security anchor function，SEAF)实体等等。
S704，核心网络设备向网络设备发送第五响应。
其中，第五响应可以为接入层(access stratum，AS)安全激活命令。
S705，网络设备向终端设备发送安全激活命令。
S706，终端设备根据AS安全激活命令，激活AS安全。在完成激活AS安全之后，终端设备可以向网络设备发送安全激活完成消息。所述安全激活完成消息用于通知已完成激活AS安全。
S707，终端设备通过激活的AS安全，接收第一***信息。
在本申请实施例中，对于RRC IDLE的终端设备，AS安全是没有被激活的，终端设备可以请求NAS激活AS安全。网络设备通过AS安全对***信息进行安全保护，终端设备通过激活的AS安全对***信息进行安全校验，避免终端设备接收到被篡改的***信息，提高了***信息的安全性。
可以理解的是，上述各个方法实施例中，由终端设备实现的方法和操作，也可以由可用于终端设备的部件(例如芯片或者电路)实现，由网络设备实现的方法和操作，也可以由可用于网络设备的部件(例如芯片或者电路)实现。
上述主要从各个交互的角度对本申请实施例提供的方案进行了介绍。可以理解的是，各个网元，例如发射端设备或者接收端设备，为了实现上述功能，其包含了执行各个功能相应的硬件结构和/或软件模块。本领域技术人员应该可以意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，本申请能够以硬件或硬件和计算机软件的结合形式来实现。某个功能究竟以硬件还是计算机软件驱动硬件的方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
本申请实施例可以根据上述方法示例对终端设备或者网络设备进行功能模块的划分，例如，可以对应各个功能划分各个功能模块，也可以将两个或两个以上的功能集成在一个处理模块中。上述集成的模块既可以使用硬件的形式实现，也可以使用软件功能模块的形式实现。需要说明的是，本申请实施例中对模块的划分是示意性的，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式。下面以使用对应各个功能划分各个功能模块为例进行说明。
以上，结合图3-图7详细说明了本申请实施例提供的方法。以下，结合图8至图10详细说明本申请实施例提供的通信装置。应理解，装置实施例的描述与方法实施例的描述相互对应，因此，未详细描述的内容可以参见上文方法实施例，为了简洁，这里不再赘述。
请参见图8，图8是本申请实施例提供的一种通信装置的结构示意图。该通信装置可以包括接收模块801、处理模块802和发送模块803。接收模块801和发送模块803可以与外部进行通信，处理模块802用于进行处理，如进行安全校验等。接收模块801和发送模块803还可以称为通信接口、收发单元或收发模块。该接收模块801和发送模块803可以用于执行上文方法实施例中终端设备所执行的动作。
例如：接收模块801和发送模块803也可以称为收发模块或收发单元(包括接收单元和/或发送单元)，分别用于执行上文方法实施例中终端设备发送和接收的步骤。
在一种可能的设计中，该通信装置可实现对应于上文方法实施例中的终端设备执行的步骤或者流程，例如，可以为终端设备，或者配置于终端设备中的芯片或电路。接收模块801和发送模块803用于执行上文方法实施例中终端设备侧的收发相关操作，处理模块802用于执行上文方法实施例中终端设备的处理相关操作。
接收模块801，用于接收第一网络设备发送的第一指示信息和安全参数信息，所述第一指示信息用于指示允许使用基于安全校验的***信息的获取机制，所述安全参数信息用于对***信息进行安全校验；
发送模块803，用于向第二网络设备发送第一消息，所述第一消息用于请求基于安全校验的第一***信息。
可选的，接收模块801，还用于接收所述第二网络设备的第二指示信息，所述第二指示信息用于指示所述第二网络设备支持所述基于安全校验的***信息。
可选的，所述第一消息为无线资源控制RRC***信息请求消息或专用***信息请求消息。
可选的，接收模块801，还用于接收所述第二网络设备发送的第二消息，所述第二消息包括所述第一***信息，所述第二消息是进行安全保护的；
处理模块802，用于根据所述安全参数信息，对所述第二消息进行安全校验。
可选的，接收模块801，还用于接收所述第二网络设备发送的所述第一***信息，所述第一***信息是未进行安全保护的。
可选的，接收模块801，还用于接收所述第二网络设备发送的哈希安全指令，所述哈希安全指令包括哈希参数，所述哈希参数用于确定所述第一***信息的哈希值；
发送模块803，还用于向所述第二网络设备发送所述第一***信息的哈希值，所述第一***信息的哈希值用于确定终端设备接收到的所述第一***信息是否被篡改。
可选的，接收模块801，还用于接收所述第二网络设备发送的第三消息，所述第三消息是进行安全保护的；
处理模块802，用于根据所述安全保护参数，对所述第三消息进行安全校验。
可选的，所述第三消息包括第三指示信息，所述第三指示信息用于指示所述终端设备接收到的所述第一***信息是否被篡改。
可选的，当所述终端设备接收到的所述第一***信息被篡改时，所述第三消息包括未被篡改的第一***信息。
需要说明的是，各个模块的实现还可以对应参照图3-图7所示的方法实施例的相应描述，执行上述实施例中终端设备所执行的方法和功能。
请参见图9，图9是本申请实施例提供的一种通信装置的结构示意图。该通信装置可以包括接收模块901和发送模块902，接收模块901和发送模块902可以与外部进行通信。接收模块901和发送模块902还可以称为通信接口、收发模块或收发单元。该接收模块901和发送模块902可以用于执行上文方法实施例中第二网络设备所执行的动作。
例如：接收模块901和发送模块902也可以称为收发模块或收发单元(包括发送单元和/或接收单元)，分别用于执行上文方法实施例中第二网络设备发送和接收的步骤。
在一种可能的设计中，该通信装置可实现对应于上文方法实施例中的第二网络设备执行的步骤或者流程，例如，可以为第二网络设备，或者配置于第二网络设备中的芯片或电路。接收模块901和发送模块902用于执行上文方法实施例中第二网络设备侧的收发相关操作。
接收模块901，用于接收终端设备发送的第一消息，所述第一消息用于请求基于安全校验的第一***信息；
发送模块902，用于向所述终端设备发送所述第一***信息。
可选的，发送模块902，还用于向所述终端设备发送第二指示信息，所述第二指示信息用于指示所述第二网络设备支持所述基于安全校验的***信息。
可选的，所述第一消息为无线资源控制RRC***信息请求消息或专用***信息请求消息。
可选的，所述第一***信息包含于第二消息中，所述第二消息是进行安全保护的。
可选的，发送模块902，还用于向第一网络设备发送第一请求；接收模块901，还用于接收所述第一网络设备发送的第一响应，所述第一响应包括安全保护参数，所述安全保护参数为根据安全参数信息确定的，所述安全保护参数用于对所述第二消息进行安全保护。
可选的，所述第一请求包括原因值，所述原因值为所述终端设备请求基于安全校验的所述第一***信息，所述原因值用于指示所述第一网络设备确定是否进行锚定位。
可选的，所述第一响应还用于指示进行锚定位。
可选的，发送模块902，还用于向第一网络设备发送第二请求，所述第二请求包括所述第一***信息；
接收模块901，还用于接收所述第一网络设备发送的第二响应，所述第二响应包括所述第二消息，所述第二消息包括所述第一***信息，所述第二消息是进行安全保护的。
可选的，所述第二请求包括原因值，所述原因值为所述终端设备请求基于安全校验的所述第一***信息，所述原因值用于指示所述第一网络设备确定是否进行锚定位。
可选的，所述第二响应还用于指示不进行锚定位。
可选的，所述第一***信息没有进行安全保护。
可选的，发送模块902，用于向第一网络设备发送第三请求，所述第三请求用于请求安全校验的哈希参数；
接收模块901，用于接收所述第一网络设备发送的第三响应，所述第三响应包括第三消息，所述第三消息包括所述哈希参数。
可选的，所述第三请求包括原因值，所述原因值为所述终端设备请求基于安全校验的所述第一***信息，所述原因值用于指示所述第一网络设备确定是否进行锚定位。
可选的，所述第三响应还用于指示不进行锚定位。
可选的，发送模块902，用于向所述终端设备发送哈希安全指令，所述哈希安全指令包括哈希参数，所述哈希参数用于确定所述第一***信息的哈希值；
所述接收模块901，接收所述终端设备发送的所述第一***信息的哈希值，所述第一***信息的哈希值用于确定所述终端设备接收到的所述第一***信息是否被篡改。
可选的，所述发送模块902，用于向所述终端设备发送第三消息，所述第三消息是进行安全保护的。
可选的，所述第三消息包括第三指示信息，所述第三指示信息用于指示所述终端设备接收到的所述第一***信息是否被篡改。
可选的，当所述终端设备接收到的所述第一***信息被篡改时，所述第三消息包括未被篡改的第一***信息。
需要说明的是，各个模块的实现还可以对应参照图3-图7所示的方法实施例的相应描述，执行上述实施例中第二网络设备或网络设备所执行的方法和功能。
请参见图10，图10是本申请实施例提供的一种通信装置的结构示意图。该通信装置可以包括获取模块1001和发送模块1002，获取模块1001和发送模块1002可以与外部进行通信。获取模块1001和发送模块1002还可以称为通信接口、收发模块或收发单元。该获取模块1001和发送模块1002可以用于执行上文方法实施例中第一网络设备所执行的动作。
例如：获取模块1001和发送模块1002也可以称为收发模块或收发单元(包括发送单元和/或接收单元)，分别用于执行上文方法实施例中第一网络设备发送和接收的步骤。
在一种可能的设计中，该通信装置可实现对应于上文方法实施例中的第一网络设备执行的步骤或者流程，例如，可以为第一网络设备，或者配置于第一网络设备中的芯片或电路。获取模块1001和发送模块1002用于执行上文方法实施例中第一网络设备侧的收发相关操作。
获取模块1001，用于获取安全参数信息；
发送模块1002，用于向终端设备发送第一指示信息和安全参数信息，所述第一指示信息用于指示允许使用基于安全校验的***信息的获取机制，所述安全参数信息用于对***信息进行安全校验。
可选的，所述获取模块1001，还用于接收第二网络设备发送的第一请求；
发送模块1002，还用于向所述第二网络设备发送第一响应，所述第一响应包括安全保护参数，所述安全保护参数为根据所述安全参数信息确定的，所述安全保护参数用于对***信息进行安全保护。
可选的，所述第一请求包括原因值，所述原因值为所述终端设备请求基于安全校验的所述第一***信息，所述原因值用于指示所述第一网络设备确定是否进行锚定位。
可选的，所述第一响应还用于指示进行锚定位。
可选的，所述获取模块1001，还用于接收第二网络设备发送的第二请求，所述第二请求包括所述第一***信息；
所述发送模块1002，还用于向所述第二网络设备发送第二响应，所述第二响应包括第二消息，所述第二消息包括所述第一***信息，所述第二消息是根据所述安全参数信息进行安全保护的。
可选的，所述第二请求包括原因值，所述原因值为所述终端设备请求基于安全校验的所述第一***信息，所述原因值用于指示所述第一网络设备确定是否进行锚定位。
可选的，所述第二响应还用于指示不进行锚定位。
可选的，所述获取模块1001，还用于接收第二网络设备发送的第三请求，所述第三请求包括请求安全校验的哈希参数；
所述发送模块1002，还用于向所述第二网络设备发送第三响应，所述第三响应包括第三消息，所述第三消息包括所述哈希参数。
可选的，所述第三请求包括原因值，所述原因值为所述终端设备请求基于安全校验的所述第一***信息，所述原因值用于指示所述第一网络设备确定是否进行锚定位。
可选的，所述第三响应还用于指示不进行锚定位。
需要说明的是，各个模块的实现还可以对应参照图3-图7所示的方法实施例的相应描述，执行上述实施例中第一网络设备或网络设备所执行的方法和功能。
图11是本申请实施例提供的一种终端设备的结构示意图。该终端设备可应用于如图1(A)和图1(B)所示的***中，执行上述方法实施例中终端设备的功能，或者实现上述方法实施 例中终端设备执行的步骤或者流程。
如图11所示，该终端设备包括处理器1101和收发器1102。可选地，该终端设备还包括存储器1103。其中，处理器1101、收发器1102和存储器1103之间可以通过内部连接通路互相通信，传递控制和/或数据信号，该存储器1103用于存储计算机程序，该处理器1101用于从该存储器1103中调用并运行该计算机程序，以控制该收发器1102收发信号。可选地，终端设备还可以包括天线，用于将收发器1102输出的上行数据或上行控制信令通过无线信号发送出去。
上述处理器1101可以和存储器1103可以合成一个处理装置，处理器1101用于执行存储器1103中存储的程序代码来实现上述功能。具体实现时，该存储器1103也可以集成在处理器1101中，或者独立于处理器1101。该处理器1101可以与图8中的处理模块对应。
上述收发器1102可以与图8中的接收模块和发送模块对应，也可以称为收发单元或收发模块。收发器1102可以包括接收器(或称接收机、接收电路)和发射器(或称发射机、发射电路)。其中，接收器用于接收信号，发射器用于发射信号。
应理解，图11所示的终端设备能够实现图3-图7所示方法实施例中涉及终端设备的各个过程。终端设备中的各个模块的操作和/或功能，分别为了实现上述方法实施例中的相应流程。具体可参见上述方法实施例中的描述，为避免重复，此处适当省略详述描述。
上述处理器1101可以用于执行前面方法实施例中描述的由终端设备内部实现的动作，而收发器1102可以用于执行前面方法实施例中描述的终端设备向网络设备发送或从网络设备接收的动作。具体请见前面方法实施例中的描述，此处不再赘述。
其中，处理器1101可以是中央处理器单元，通用处理器，数字信号处理器，专用集成电路，现场可编程门阵列或者其他可编程逻辑器件、晶体管逻辑器件、硬件部件或者其任意组合。其可以实现或执行结合本申请公开内容所描述的各种示例性的逻辑方框，模块和电路。处理器1101也可以是实现计算功能的组合，例如包含一个或多个微处理器组合，数字信号处理器和微处理器的组合等等。通信总线1104可以是外设部件互连标准PCI总线或扩展工业标准结构EISA总线等。所述总线可以分为地址总线、数据总线、控制总线等。为便于表示，图11中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。通信总线1104用于实现这些组件之间的连接通信。其中，本申请实施例中收发器1102用于与其他节点设备进行信令或数据的通信。存储器1103可以包括易失性存储器，例如非挥发性动态随机存取内存(nonvolatile random access memory，NVRAM)、相变化随机存取内存(phase change RAM，PRAM)、磁阻式随机存取内存(magetoresistive RAM，MRAM)等，还可以包括非易失性存储器，例如至少一个磁盘存储器件、电子可擦除可编程只读存储器(electrically erasable programmable read-only memory，EEPROM)、闪存器件，例如反或闪存(NOR flash memory)或是反及闪存(NAND flash memory)、半导体器件，例如固态硬盘(solid state disk，SSD)等。存储器1103可选的还可以是至少一个位于远离前述处理器1101的存储装置。存储器1103中可选的还可以存储一组计算机程序代码或配置信息。可选的，处理器1101还可以执行存储器1103中所存储的程序。处理器可以与存储器和收发器相配合，执行上述申请实施例中终端设备的任意一种方法和功能。
图12是本申请实施例提供的一种第二网络设备的结构示意图。该第二网络设备可应用于如图1(A)和图1(B)所示的***中，执行上述方法实施例中第二网络设备的功能，或者实现上述方法实施例中第二网络设备执行的步骤或者流程。
如图12所示，该第二网络设备包括处理器1201和收发器1202。可选地，该第二网络设备还包括存储器1203。其中，处理器1201、收发器1202和存储器1203之间可以通过内部连接通路互相通信，传递控制和/或数据信号，该存储器1203用于存储计算机程序，该处理器1201用于从该存储器1203中调用并运行该计算机程序，以控制该收发器1202收发信号。可选地，第二网络设备还可以包括天线，用于将收发器1202输出的上行数据或上行控制信令通过无线信号发送出去。
上述处理器1201可以和存储器1203可以合成一个处理装置，处理器1201用于执行存储器1203中存储的程序代码来实现上述功能。具体实现时，该存储器1203也可以集成在处理器1201中，或者独立于处理器1201。
上述收发器1202可以与图9中的接收模块和发送模块对应，也可以称为收发单元或收发模块。收发器1202可以包括接收器(或称接收机、接收电路)和发射器(或称发射机、发射电路)。其中，接收器用于接收信号，发射器用于发射信号。
应理解，图12所示的第二网络设备能够实现图3-图5所示方法实施例中涉及第二网络设备的各个过程、以及实现图6-图7所示方法实施例中涉及网络设备的各个过程。第二网络设备中的各个模块的操作和/或功能，分别为了实现上述方法实施例中的相应流程。具体可参见上述方法实施例中的描述，为避免重复，此处适当省略详述描述。
上述处理器1201可以用于执行前面方法实施例中描述的由第二网络设备内部实现的动作，而收发器1202可以用于执行前面方法实施例中描述的第二网络设备向终端设备发送或从终端设备接收的动作。具体请见前面方法实施例中的描述，此处不再赘述。
其中，处理器1201可以是前文提及的各种类型的处理器。通信总线1204可以是外设部件互连标准PCI总线或扩展工业标准结构EISA总线等。所述总线可以分为地址总线、数据总线、控制总线等。为便于表示，图12中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。通信总线1204用于实现这些组件之间的连接通信。其中，本申请实施例中设备的收发器1202用于与其他设备进行信令或数据的通信。存储器1203可以是前文提及的各种类型的存储器。存储器1203可选的还可以是至少一个位于远离前述处理器1201的存储装置。存储器1203中存储一组计算机程序代码或配置信息，且处理器1201执行存储器1203中程序。处理器可以与存储器和收发器相配合，执行上述申请实施例中第二网络设备的任意一种方法和功能。
图13是本申请实施例提供的一种第一网络设备的结构示意图。该第一网络设备可应用于如图1(A)和图1(B)所示的***中，执行上述方法实施例中第一网络设备的功能，或者实现上述方法实施例中第一网络设备执行的步骤或者流程。
如图13所示，该第一网络设备包括处理器1301和收发器1302。可选地，该第一网络设备还包括存储器1303。其中，处理器1301、收发器1302和存储器1303之间可以通过内部连接通路互相通信，传递控制和/或数据信号，该存储器1303用于存储计算机程序，该处理器1301用于从该存储器1303中调用并运行该计算机程序，以控制该收发器1302收发信号。可选地，第一网络设备还可以包括天线，用于将收发器1302输出的上行数据或上行控制信令通过无线信号发送出去。
上述处理器1301可以和存储器1303可以合成一个处理装置，处理器1301用于执行存储器1303中存储的程序代码来实现上述功能。具体实现时，该存储器1303也可以集成在处理器1301中，或者独立于处理器1301。
上述收发器1302可以与图10中的获取模块和发送模块对应，也可以称为收发单元或收发模块。收发器1302可以包括接收器(或称接收机、接收电路)和发射器(或称发射机、发射电路)。其中，接收器用于接收信号，发射器用于发射信号。
应理解，图13所示的第一网络设备能够实现图3-图5所示方法实施例中涉及第一网络设备的各个过程、以及实现图6-图7所示方法实施例中涉及网络设备的各个过程。第一网络设备中的各个模块的操作和/或功能，分别为了实现上述方法实施例中的相应流程。具体可参见上述方法实施例中的描述，为避免重复，此处适当省略详述描述。
上述处理器1301可以用于执行前面方法实施例中描述的由第一网络设备内部实现的动作，而收发器1302可以用于执行前面方法实施例中描述的第一网络设备向终端设备发送或从终端设备接收的动作。具体请见前面方法实施例中的描述，此处不再赘述。
其中，处理器1301可以是前文提及的各种类型的处理器。通信总线1304可以是外设部件互连标准PCI总线或扩展工业标准结构EISA总线等。所述总线可以分为地址总线、数据总线、控制总线等。为便于表示，图13中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。通信总线1304用于实现这些组件之间的连接通信。其中，本申请实施例中设备的收发器1302用于与其他设备进行信令或数据的通信。存储器1303可以是前文提及的各种类型的存储器。存储器1303可选的还可以是至少一个位于远离前述处理器1301的存储装置。存储器1303中存储一组计算机程序代码或配置信息，且处理器1301执行存储器1303中程序。处理器可以与存储器和收发器相配合，执行上述申请实施例中第一网络设备的任意一种方法和功能。
本申请实施例还提供了一种芯片***，该芯片***包括处理器，用于支持终端设备或网络设备以实现上述任一实施例中所涉及的功能，例如生成或处理上述方法中所涉及的SDT数据。在一种可能的设计中，所述芯片***还可以包括存储器，所述存储器，用于终端设备或网络设备必要的程序指令和数据。该芯片***，可以由芯片构成，也可以包含芯片和其他分立器件。其中，芯片***的输入和输出，分别对应方法实施例终端设备或网络设备的接收与发送操作。
本申请实施例还提供了一种处理装置，包括处理器和接口。所述处理器可用于执行上述方法实施例中的方法。
应理解，上述处理装置可以是一个芯片。例如，该处理装置可以是现场可编程门阵列(field programmable gate array，FPGA)，可以是专用集成芯片(application specific integrated circuit，ASIC)，还可以是***芯片(system on chip，SoC)，还可以是中央处理器(central processor unit，CPU)，还可以是网络处理器(network processor，NP)，还可以是数字信号处理电路(digital signal processor，DSP)，还可以是微控制器(micro controller unit，MCU)，还可以是可编程控制器(programmable logic device，PLD)或其他集成芯片。
在实现过程中，上述方法的各步骤可以通过处理器中的硬件的集成逻辑电路或者软件形式的指令完成。结合本申请实施例所公开的方法的步骤可以直接体现为硬件处理器执行完成，或者用处理器中的硬件及软件模块组合执行完成。软件模块可以位于随机存储器，闪存、只读存储器，可编程只读存储器或者电可擦写可编程存储器、寄存器等本领域成熟的存储介质中。该存储介质位于存储器，处理器读取存储器中的信息，结合其硬件完成上述方法的步骤。为避免重复，这里不再详细描述。
应注意，本申请实施例中的处理器可以是一种集成电路芯片，具有信号的处理能力。在实现过程中，上述方法实施例的各步骤可以通过处理器中的硬件的集成逻辑电路或者软件形 式的指令完成。上述的处理器可以是通用处理器、数字信号处理器(DSP)、专用集成电路(ASIC)、现场可编程门阵列(FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件。可以实现或者执行本申请实施例中的公开的各方法、步骤及逻辑框图。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。结合本申请实施例所公开的方法的步骤可以直接体现为硬件译码处理器执行完成，或者用译码处理器中的硬件及软件模块组合执行完成。软件模块可以位于随机存储器，闪存、只读存储器，可编程只读存储器或者电可擦写可编程存储器、寄存器等本领域成熟的存储介质中。该存储介质位于存储器，处理器读取存储器中的信息，结合其硬件完成上述方法的步骤。
根据本申请实施例提供的方法，本申请还提供一种计算机程序产品，该计算机程序产品包括：计算机程序，当该计算机程序在计算机上运行时，使得该计算机执行图3-图7所示实施例中任意一个实施例的方法。
根据本申请实施例提供的方法，本申请还提供一种计算机可读介质，该计算机可读介质存储有计算机程序，当该计算机程序在计算机上运行时，使得该计算机执行图3-图7所示实施例中任意一个实施例的方法。
根据本申请实施例提供的方法，本申请还提供一种通信***，其包括前述的一个或多个终端设备以及一个或多个网络设备。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。所述计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行所述计算机指令时，全部或部分地产生按照本申请实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线(digital subscriber line，DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质(例如，软盘、硬盘、磁带)、光介质(例如，高密度数字视频光盘(digital video disc，DVD))、或者半导体介质(例如，固态硬盘(solid state disc，SSD))等。
上述各个装置实施例中网络设备与终端设备和方法实施例中的网络设备或终端设备对应，由相应的模块或单元执行相应的步骤，例如接收模块和发送模块(收发器)执行方法实施例中接收或发送的步骤，除发送、接收外的其它步骤可以由处理模块(处理器)执行。具体模块的功能可以参考相应的方法实施例。其中，处理器可以为一个或多个。
在本说明书中使用的术语“部件”、“模块”、“***”等用于表示计算机相关的实体、硬件、固件、硬件和软件的组合、软件、或执行中的软件。例如，部件可以是但不限于，在处理器上运行的进程、处理器、对象、可执行文件、执行线程、程序和/或计算机。通过图示，在计算设备上运行的应用和计算设备都可以是部件。一个或多个部件可驻留在进程和/或执行线程中，部件可位于一个计算机上和/或分布在两个或更多个计算机之间。此外，这些部件可从在上面存储有各种数据结构的各种计算机可读介质执行。部件可例如根据具有一个或多个数据分组(例如来自与本地***、分布式***和/或网络间的另一部件交互的二个部件的数据，例如通过信号与其它***交互的互联网)的信号通过本地和/或远程进程来通信。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各种说明性逻辑块 (illustrative logical block)和步骤(step)，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的***、装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的***、装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个***，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能模块可以集成在一个处理模块中，也可以是各个模块单独物理存在，也可以两个或两个以上模块集成在一个模块中。
所述功能如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(read-only memory，ROM)、随机存取存储器(random access memory，RAM)、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以所述权利要求的保护范围为准。

Claims (30)

  1. 一种通信方法，其特征在于，所述方法应用于终端设备，所述方法包括：
    接收第一网络设备发送的第一指示信息和安全参数信息，所述第一指示信息用于指示允许使用基于安全校验的***信息的获取机制，所述安全参数信息用于对***信息进行安全校验；
    向第二网络设备发送第一消息，所述第一消息用于请求基于安全校验的第一***信息。
  2. 如权利要求1所述的方法，其特征在于，所述方法还包括：
    接收所述第二网络设备的第二指示信息，所述第二指示信息用于指示所述第二网络设备支持所述基于安全校验的***信息。
  3. 如权利要求1或2所述的方法，其特征在于，所述第一消息为无线资源控制RRC***信息请求消息或专用***信息请求消息。
  4. 如权利要求1-3任一项所述的方法，其特征在于，所述方法还包括：
    接收所述第二网络设备发送的第二消息，所述第二消息包括所述第一***信息，所述第二消息是进行安全保护的；
    根据所述安全参数信息，对所述第二消息进行安全校验。
  5. 如权利要求1-3任一项所述的方法，其特征在于，所述方法还包括：
    接收所述第二网络设备发送的所述第一***信息，所述第一***信息是未进行安全保护的。
  6. 如权利要求5所述的方法，其特征在于，所述终端设备接收所述第二网络设备发送的所述第一***信息之后，还包括：
    接收所述第二网络设备发送的哈希安全指令，所述哈希安全指令包括哈希参数，所述哈希参数用于确定所述第一***信息的哈希值；
    向所述第二网络设备发送所述第一***信息的哈希值，所述第一***信息的哈希值用于确定所述终端设备接收到的所述第一***信息是否被篡改。
  7. 如权利要求5或6所述的方法，其特征在于，所述方法还包括：
    接收所述第二网络设备发送的第三消息，所述第三消息是进行安全保护的；
    根据所述安全保护参数，对所述第三消息进行安全校验。
  8. 如权利要求7所述的方法，其特征在于，所述第三消息包括第三指示信息，所述第三指示信息用于指示所述终端设备接收到的所述第一***信息是否被篡改。
  9. 如权利要求7或8所述的方法，其特征在于，当所述终端设备接收到的所述第一***信息被篡改时，所述第三消息包括未被篡改的第一***信息。
  10. 一种通信方法，其特征在于，所述方法应用于第二网络设备，所述方法包括：
    接收终端设备发送的第一消息，所述第一消息用于请求基于安全校验的第一***信息；
    向所述终端设备发送所述第一***信息。
  11. 如权利要求10所述的方法，其特征在于，所述方法还包括：
    向所述终端设备发送第二指示信息，所述第二指示信息用于指示所述第二网络设备支持所述基于安全校验的***信息。
  12. 如权利要求10或11所述的方法，其特征在于，所述第一消息为无线资源控制RRC***信息请求消息或专用***信息请求消息。
  13. 如权利要求10-12任一项所述的方法，其特征在于，所述第一***信息包含于第二消息中，所述第二消息是进行安全保护的。
  14. 如权利要求13所述的方法，其特征在于，所述方法还包括：
    向第一网络设备发送第一请求；
    接收所述第一网络设备发送的第一响应，所述第一响应包括安全保护参数，所述安全保护参数为根据安全参数信息确定的，所述安全保护参数用于对所述第二消息进行安全保护。
  15. 如权利要求14所述的方法，其特征在于，所述第一请求包括原因值，所述原因值为所述终端设备请求基于安全校验的所述第一***信息，所述原因值用于指示所述第一网络设备确定是否进行锚定位。
  16. 如权利要求14或15所述的方法，其特征在于，所述第一响应还用于指示进行锚定位。
  17. 如权利要求13所述的方法，其特征在于，所述方法还包括：
    向第一网络设备发送第二请求，所述第二请求包括所述第一***信息；
    接收所述第一网络设备发送的第二响应，所述第二响应包括所述第二消息，所述第二消息包括所述第一***信息，所述第二消息是进行安全保护的。
  18. 如权利要求17所述的方法，其特征在于，所述第二请求包括原因值，所述原因值为所述终端设备请求基于安全校验的所述第一***信息，所述原因值用于指示所述第一网络设备确定是否进行锚定位。
  19. 如权利要求17或18所述的方法，其特征在于，所述第二响应还用于指示不进行锚定位。
  20. 如权利要求10-12任一项所述的方法，其特征在于，所述第一***信息没有进行安全保护。
  21. 如权利要求20所述的方法，其特征在于，所述方法还包括：
    向第一网络设备发送第三请求，所述第三请求用于请求安全校验的哈希参数；
    接收所述第一网络设备发送的第三响应，所述第三响应包括第三消息，所述第三消息包括所述哈希参数。
  22. 如权利要求21所述的方法，其特征在于，所述第三请求包括原因值，所述原因值为所述终端设备请求基于安全校验的所述第一***信息，所述原因值用于指示所述第一网络设备确定是否进行锚定位。
  23. 如权利要求21或22所述的方法，其特征在于，所述第三响应还用于指示不进行锚定位。
  24. 如权利要求20-23任一项所述的方法，其特征在于，所述方法还包括：
    向所述终端设备发送哈希安全指令，所述哈希安全指令包括哈希参数，所述哈希参数用于确定所述第一***信息的哈希值；
    接收所述终端设备发送的所述第一***信息的哈希值，所述第一***信息的哈希值用于确定所述终端设备接收到的所述第一***信息是否被篡改。
  25. 如权利要求20-24任一项所述的方法，其特征在于，所述方法还包括：
    向所述终端设备发送第三消息，所述第三消息是进行安全保护的。
  26. 如权利要求25所述的方法，其特征在于，所述第三消息包括第三指示信息，所述第三指示信息用于指示所述终端设备接收到的所述第一***信息是否被篡改。
  27. 如权利要求25或26所述的方法，其特征在于，当所述终端设备接收到的所述第一***信息被篡改时，所述第三消息包括未被篡改的第一***信息。
  28. 一种通信方法，其特征在于，所述方法应用于第一网络设备，所述方法包括：
    获取安全参数信息；
    向终端设备发送第一指示信息和安全参数信息，所述第一指示信息用于指示允许使用基于安全校验的***信息的获取机制，所述安全参数信息用于对***信息进行安全校验。
  29. 一种通信装置，其特征在于，包括处理器和存储器，所述存储器用于存储计算机程序，所述处理器运行所述计算机程序以使得所述装置执行权利要求1-28中任一项所述的方法。
  30. 一种计算机可读存储介质，其特征在于，用于存储计算机程序，当所述计算机程序在计算机上运行时，使所述计算机执行权利要求1-28中任一项所述的方法。
PCT/CN2022/142614 2021-12-29 2022-12-28 一种通信方法及装置 WO2023125604A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202111648311.5 2021-12-29
CN202111648311.5A CN116419222A (zh) 2021-12-29 2021-12-29 一种通信方法及装置

Publications (1)

Publication Number Publication Date
WO2023125604A1 true WO2023125604A1 (zh) 2023-07-06

Family

ID=86997994

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/142614 WO2023125604A1 (zh) 2021-12-29 2022-12-28 一种通信方法及装置

Country Status (2)

Country Link
CN (1) CN116419222A (zh)
WO (1) WO2023125604A1 (zh)

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110167019A (zh) * 2018-02-13 2019-08-23 华为技术有限公司 通信方法及装置
WO2020155070A1 (zh) * 2019-01-31 2020-08-06 Oppo广东移动通信有限公司 用于切换网络设备的方法和终端设备
WO2020220321A1 (zh) * 2019-04-30 2020-11-05 Oppo广东移动通信有限公司 无线通信方法、终端设备和网络设备
WO2021031013A1 (zh) * 2019-08-16 2021-02-25 华为技术有限公司 通信方法及装置

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110167019A (zh) * 2018-02-13 2019-08-23 华为技术有限公司 通信方法及装置
WO2020155070A1 (zh) * 2019-01-31 2020-08-06 Oppo广东移动通信有限公司 用于切换网络设备的方法和终端设备
WO2020220321A1 (zh) * 2019-04-30 2020-11-05 Oppo广东移动通信有限公司 无线通信方法、终端设备和网络设备
WO2021031013A1 (zh) * 2019-08-16 2021-02-25 华为技术有限公司 通信方法及装置
CN113841433A (zh) * 2019-08-16 2021-12-24 华为技术有限公司 通信方法及装置

Also Published As

Publication number Publication date
CN116419222A (zh) 2023-07-11

Similar Documents

Publication Publication Date Title
US9184977B2 (en) System for controlling access to device-to-device communication services in wireless network
US9871782B2 (en) Wireless communication systems and methods
WO2021203310A1 (zh) 一种数据传输方法及装置、终端设备
WO2018170914A1 (zh) 一种***信息传输方法及装置
JP2022501842A (ja) 情報伝送方法、装置及び通信デバイス
WO2017024890A1 (zh) 设备到设备通信方法、装置和***
WO2021203891A1 (zh) 控制网络切片认证的方法、装置、设备及存储介质
WO2022236484A1 (zh) Sdt失败上报的方法、终端设备和网络设备
KR20180059750A (ko) 서비스 베어링 혼잡 제어 방법 및 장치
WO2022011618A1 (zh) 信息处理方法、终端设备和网络设备
WO2013044883A1 (zh) 一种实现告警事件处理的方法、装置和***
EP3930418B1 (en) Link re-establishment method and terminal devices
WO2018202076A1 (zh) ***信息传输方法、终端及网络侧设备
WO2018027901A1 (zh) 通信方法、终端设备和接入网设备
CN114223254A (zh) 直通链路***信息传输的方法及其设备
WO2018214762A1 (zh) 一种获取寻呼参数的方法及装置
CN111565478B (zh) 伪网络设备识别方法、装置、设备及存储介质
WO2023186028A1 (zh) 通信方法及装置
WO2023125604A1 (zh) 一种通信方法及装置
WO2022206393A1 (zh) 通信方法及装置
WO2022160315A1 (zh) 通信方法及装置
WO2022171033A1 (zh) 通信方法及装置
JP6828053B2 (ja) 通信方法、コアネットワーク装置、アクセスネットワーク装置、端末装置と通信システム
JP2022502979A (ja) パラメータ設定方法、端末装置及び記憶媒体
WO2023061436A1 (zh) 一种数据传输方法及装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22914856

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 2022914856

Country of ref document: EP

ENP Entry into the national phase

Ref document number: 2022914856

Country of ref document: EP

Effective date: 20240704