WO2021244569A1 - Data transmission method and system, electronic device, and storage medium - Google Patents

Abstract

The present application provides a data transmission method, applied in a first control panel function entity. The method comprises: determining target user plane data that needs security protection between target user equipment and a user plane function entity; and sending a first notification message to the target user equipment, wherein the first notification message is used for instruction to perform security protection on the target user plane data between the target user equipment and the user plane function entity. The present application also provides a data transmission system, an electronic device, and a computer readable storage medium.

Description

Data transmission method, system, electronic equipment, storage medium

Cross-references to related applications

This application claims the priority of the patent application No. 202010497412.6 filed with the Chinese Patent Office on June 3, 2020, the entire content of which is incorporated herein by reference.

Technical field

The present disclosure relates to, but is not limited to, the field of communication security.

Background technique

At present, only the confidentiality and/or integrity protection of the user plane data transmission between the user equipment (UE, User Equipment) and the access network (RAN, Radio Access Network) is performed, but the user between the RAN and the core network is not protected. Confidentiality and/or integrity protection of plane data transmission. In some scenarios, confidentiality and/or integrity protection of user plane data transmission between user equipment (UE, User Equipment) and the core network is required, and the above protection The method cannot meet the protection requirements of these scenarios.

Summary of the invention

In a first aspect, the present disclosure provides a data transmission method, which is applied to a first control plane functional entity, and the method includes: determining target user plane data that needs to be securely protected between the target user equipment and the user plane functional entity; The target user equipment sends a first notification message, where the first notification message is used to instruct to perform security protection on the target user plane data between the target user equipment and the user plane functional entity.

In a second aspect, the present disclosure provides a data transmission method applied to a second control plane functional entity. The method includes: receiving a second notification message sent by the first control plane functional entity, where the second notification message is used to notify the The second control plane functional entity generates a first key, the first key is used by the user plane functional entity to generate a second key, and the second key is used by the target user equipment Used with the user plane functional entity to securely protect the target user plane data between the target user equipment and the user plane functional entity; generate the first key, and transfer the first key Sent to the user plane functional entity.

In a third aspect, the present disclosure provides a data transmission method, which is applied to a user plane functional entity, and the method includes: obtaining a first key, and generating a second key according to the first key; For being used by the target user equipment and the user plane functional entity, the target user plane data is securely protected between the target user equipment and the user plane functional entity; through the second key pair The target user plane data transmitted between the target user equipment and the user plane functional entity is subjected to security protection processing.

In a fourth aspect, the present disclosure provides a data transmission method applied to a target user equipment. The method includes: receiving a first notification message sent by a first control plane functional entity, where the first notification message is used to indicate The target user plane data is securely protected between the user equipment and the user plane functional entity.

In a fifth aspect, the present disclosure provides an electronic device, which includes: at least one processor; a memory on which at least one program is stored. When the at least one program is executed by the at least one processor, the at least one Processor Any of the data transmission methods described in this article.

In a sixth aspect, the present disclosure provides a computer-readable storage medium on which a computer program is stored, and when the program is executed by a processor, any one of the data transmission methods described herein is implemented.

In a seventh aspect, the present disclosure provides a data transmission system, including: a first control plane functional entity configured to determine target user plane data that needs to be securely protected between a target user equipment and a user plane functional entity; The user equipment sends a first notification message, where the first notification message is used to instruct to perform security protection on the target user plane data between the target user equipment and the user plane functional entity; the target user equipment is configured to receive The first notification message sent by the first control plane functional entity.

Description of the drawings

Figure 1 is a schematic diagram of the security protection mechanism in the process of data transmission in the 5G network defined by the 3rd Generation Partnership Project (3GPP, The 3rd Generation Partnership Project) R15 in related technologies;

Fig. 2 is a flowchart of a data transmission method provided by the present disclosure;

FIG. 3 is a flowchart of a data transmission method provided by the present disclosure;

Fig. 4 is a flowchart of a data transmission method provided by the present disclosure;

FIG. 5 is a flowchart of a data transmission method provided by the present disclosure;

FIG. 6 is a flowchart of the data transmission method provided in Example 1 of the present disclosure;

FIG. 7 is a flowchart of the data transmission method provided in Example 2 of the present disclosure;

FIG. 8 is a flowchart of the data transmission method provided in Example 3 of the present disclosure;

FIG. 9 is a schematic diagram of the structure of the protocol stack provided in Example 4 of the present disclosure;

Fig. 10 is a block diagram of a data transmission device provided by the present disclosure;

Figure 11 is a block diagram of a data transmission device provided by the present disclosure;

FIG. 12 is a block diagram of a data transmission device provided by the present disclosure;

Figure 13 is a block diagram of a data transmission device provided by the present disclosure;

Fig. 14 is a block diagram of a data transmission system provided by the present disclosure.

detailed description

In order to enable those skilled in the art to better understand the technical solutions of the present disclosure, the data transmission method, system, electronic device, and computer-readable storage medium provided by the present disclosure will be described in detail below with reference to the accompanying drawings.

Hereinafter, example embodiments will be described more fully with reference to the accompanying drawings, but the example embodiments may be embodied in different forms and should not be construed as being limited to the embodiments set forth herein. On the contrary, the purpose of providing these embodiments is to make the present disclosure thorough and complete, and to enable those skilled in the art to fully understand the scope of the present disclosure.

In the case of no conflict, the embodiments of the present disclosure and the features in the embodiments can be combined with each other.

As used herein, the term "and/or" includes any and all combinations of at least one related listed item.

The terms used herein are only used to describe specific embodiments and are not intended to limit the present disclosure. As used herein, the singular forms "a" and "the" are also intended to include the plural forms, unless the context clearly dictates otherwise. It will also be understood that when the terms "comprise" and/or "made of" are used in this specification, it specifies the presence of the described features, wholes, steps, operations, elements and/or components, but does not exclude the presence or Add at least one other feature, whole, step, operation, element, component, and/or group thereof.

Unless otherwise defined, the meanings of all terms (including technical and scientific terms) used herein are the same as those commonly understood by those of ordinary skill in the art. It will also be understood that terms such as those defined in commonly used dictionaries should be interpreted as having meanings consistent with their meanings in the context of the related technology and the present disclosure, and will not be interpreted as having idealized or excessive formal meanings, Unless this article specifically defines it as such.

Traditional communication networks are subject to deep binding of software and hardware, with single network performance, poor networking flexibility, and limited expansion. It is difficult to build a network to simultaneously adapt to the differentiated requirements of different applications for network service performance such as bandwidth, delay, and reliability. 5G has carried out a deep reconstruction of the network architecture. Based on virtualization and software-defined technology, a service-oriented architecture is introduced. On a shared and unified hardware platform, virtualized network functions are built on demand according to application requirements, and network slicing is built to provide better Network service performance that meets application requirements. For example, for IoT applications with fixed terminal locations, there is no need to introduce mobility management functions when constructing network slicing to provide network services; for low-latency applications, it is necessary to construct network slicing. The user plane function (UPF, User Plane Function) is deployed at the edge of the network to shorten the data transmission delay to meet the requirements of the application on the network delay. In other words, 5G can provide network services with different characteristics for different applications with the help of emerging technologies such as virtualization and network slicing.

When 5G networks provide network services for applications in various industries, they carry various high-value application data and sensitive data such as privacy. Attacks on networks to obtain or tamper with data have never stopped, and as the future 5G network bears business data continuously enriched, attack methods are still evolving. Therefore, protection measures such as integrity and ciphering protection of data during network transmission are indispensable.

Confidentiality refers to the encrypted transmission of data to prevent the data from being eavesdropped and illegally obtained during the transmission; integrity refers to the integrity of the transmitted data at the sending end and the integrity verification at the receiving end, thereby preventing the transmission process The data in it has been tampered with.

The data transmitted by the 5G network is divided into two categories: one is control plane signaling data, such as the signaling of users registering to the network, and the signaling of slicing sessions to access the network; the other is user plane data for users to carry out services. , Such as data for online video services.

Figure 1 is a schematic diagram of the security protection mechanism in the process of data transmission in the 5G network defined by the 3rd Generation Partnership Project (3GPP, The 3rd Generation Partnership Project) R15. As shown in Figure 1, A in Figure 1 represents the confidentiality and/or integrity protection of control plane data between user equipment (UE, User Equipment) and access network (RAN, Radio Access Network), Figure 1 B in the figure represents the confidentiality and/or integrity protection of the user plane data between the UE and the RAN; C in Figure 1 represents the control plane data between the UE and the 5G core network (5GC, 5G Core network) Confidentiality and/or integrity protection, but the confidentiality and/or integrity protection of the user plane data transmission between UE and 5GC has not yet been required. User plane data is transmitted in plain text between RAN and 5GC, as shown in Figure 1. In the D.

When 5G provides network services for vertical industries, based on the business characteristics of the vertical industries, it is necessary to provide user plane data with UE to 5GC transmission path for security protection requirements, mainly based on the following reasons:

(1) The configuration of the access network functional entity is easier to expose, and the configuration of the access network functional entity side encryption, authentication, and user plane integrity protection is more vulnerable to attack.

(2) Compared with the functional entity side of the access network, the network nodes on the core network side have stronger computing capabilities, which helps to reduce the delay of data interaction, and vertical industries often attach great importance to low-latency experience.

(3) Network slicing operators (operators that provide network services for vertical industry applications) may lease RAN resources from other operators. From the perspective of network slicing operators or industry applications, the access network functional entity is not a device that is absolutely trusted. Therefore, network slicing operators or industry applications hope that data transmission is safely terminated on the core network rather than the access network functional entity of the access network. side.

In view of the above security requirements, part of the security protection requirements can be achieved through the following methods, but there are still some shortcomings:

(1) For the protection between the UE and the access network functional entity, refer to the method shown in Figure 1 B, and establish an encrypted channel between the access network boundary network element and the core network boundary network element, that is, D in Figure 1 For example, Internet Protocol Security (IPSec, Internet Protocol Security) encrypts and/or protects the integrity of all data transmitted between the boundary network elements of the access network and the boundary network elements of the core network. Although this method realizes the security protection of user plane data between the UE and 5GC, it has the following disadvantages:

1) The solution is to implement encryption and/or integrity protection for all data transmitted between the boundary network elements of the access network and the boundary network elements of the core network. Encryption protection is required for data regardless of whether there is an encryption requirement, which will reduce processing Efficiency, increase business delay.

2) The access network functional entity still participates in the process of data encryption and decryption and/or integrity verification, and there is still the risk that the access network functional entity is untrusted and the access network functional entity is attacked, resulting in data security.

3) The application itself provides protection mechanisms such as application layer encryption to ensure the security of user plane data. For example, some applications use Secure Sockets Layer (SSL, Secure Sockets Layer) to encrypt and transmit application data. However, not every application has the functions of encrypting, protecting and verifying user plane data at the application layer. The above-mentioned solutions are specific to various applications and are not easy to promote.

Fig. 2 is a flowchart of a data transmission method of the present disclosure.

In the first aspect, referring to FIG. 2, the present disclosure provides a data transmission method applied to a first control plane functional entity (for example, it can be executed by the first control plane functional entity). The method may include step 200 and step 201.

In step 200, the target user plane data that needs to be secured between the target user equipment and the user plane functional entity is determined.

In some exemplary embodiments, it is determined that all target user plane data of the target UE does not require security protection between the target UE and the user plane functional entity, and this process ends.

In some exemplary embodiments, the target user plane data that needs to be secured between the target user equipment and the user plane functional entity may be determined according to the user subscription information.

In some exemplary embodiments, the target user plane data that needs to be secured between the target user equipment and the user plane functional entity may also be determined according to whether the first notification message sent by the second control plane functional entity is received, and the first notification The message is used to instruct to perform security protection on the target user plane data between the target user equipment and the user plane functional entity. For example, receiving the first notification message sent by the second network control function entity indicates that the target user plane data needs to be securely protected between the target user equipment and the user plane function entity; the first notification message sent by the second network control function entity is not received. The notification message indicates that there is no need to securely protect the user plane data between the target user equipment and the user plane functional entity.

Of course, there are many other ways, and the specific determination strategy is not used to limit the protection scope of the present disclosure, and will not be repeated here.

In some exemplary embodiments, the target user plane data that needs to be securely protected between the target user equipment and the user plane functional entity may be determined during the registration process of the target UE to the core network, for example, after the authentication process is completed , To determine the target user plane data that needs to be secured between the target user equipment and the user plane functional entity. In this case, the target user plane data is all user plane data transmitted between the target UE and the user plane functional entity.

In some exemplary embodiments, it may be determined during the establishment of a protocol data unit (PDU, Protocol Data Unit) session whether it is necessary to perform security protection for user plane data between the user equipment and the core network, for example, after receiving a session After the session management function (SMF, Session Management Function) entity creates a response to the PDU session context, it is determined whether the user plane data needs to be secured between the user equipment and the core network. In this case, it is determined whether it is necessary to perform security protection for the user plane data corresponding to the PDU session between the user equipment and the core network.

In step 201, a first notification message is sent to the target user equipment, where the first notification message is used to instruct to perform security protection on the target user plane data between the target user equipment and the user plane functional entity .

In some exemplary embodiments, the first notification message may be sent to the target UE during the registration process of the target UE to the core network, for example, after the authentication process is completed, the first notification message is sent to the target UE. After receiving the first notification message, the target UE confirms the target user plane data that needs to be secured between the target user equipment and the user plane functional entity. In this case, the target user plane data is all user plane data transmitted between the target UE and the user plane functional entity.

In some exemplary embodiments, the first notification message may be sent to the target UE during the PDU session establishment process, for example, after receiving the PDU session context creation response from the SMF entity, the first notification message is sent to the target UE. In this case, the target user plane data is the user plane data transmitted by the target UE to the user plane functional entity through the PDU session.

That is, for some UEs, after determining the target user plane data that needs to be secured between the user equipment and the user plane functional entity, the first notification message is sent to the user equipment; for some UEs, the first notification message is sent to the user equipment; After all user plane data does not need to be secured between the user equipment and the user plane functional entity, the first notification message is not sent to the UE. In this way, the user plane data of all UEs is not secured between the UE and the user plane functional entity, but the user plane data of some UEs is secured between the UE and the user plane functional entity. The security protection of the user plane data of the UE between the UE and the user plane functional entity can be determined according to the subscription data of the UE, and the user can sign a contract with the operator according to their own needs.

Or, for some PDU sessions of a certain UE, after determining the target user plane data that needs to be secured between the user equipment and the user plane functional entity, the first notification message is sent to the user equipment; for other UEs In the PDU session, after determining that all user plane data transmitted through the PDU session does not require security protection between the user equipment and the user plane functional entity, the first notification message is not sent to the UE. In this way, the user plane data corresponding to all PDU sessions of the UE is not securely protected between the UE and the user plane functional entity, but the user plane data corresponding to part of the PDU session of the UE is between the UE and the user plane functional entity. Security protection is performed between the UE and the user plane data corresponding to which PDU sessions of the UE. The security protection between the UE and the user plane functional entity can be determined according to the subscription data of the UE. The user can sign a contract with the operator according to their own needs. accomplish.

In some exemplary embodiments, after determining the target user plane data that needs to be securely protected between the target user equipment and the user plane functional entity, the method further includes: generating a first key, and sending to the user plane functional entity The first key; wherein the first key is used by the user plane functional entity to generate a second key, and the second key is used by the target user equipment and the user The plane function entity is used to securely protect the target user plane data between the target user equipment and the user plane function entity.

In some exemplary embodiments, the anchor key may be generated first, and then the first key may be generated according to the anchor key. The first key is used for key isolation, preventing one key from being leaked and affecting the security of other keys, improving security.

In some exemplary embodiments, the second key includes an encryption key. In some exemplary embodiments, the second key includes an integrity key. In some exemplary embodiments, the second key includes an encryption key and an integrity key.

In some exemplary embodiments, the encryption key is used for confidentiality protection of user plane data between the UE and the core user plane functional entity, and the integrity key is used for user plane data between the UE and the core user plane functional entity. Integrity protection.

In some exemplary embodiments, the first key is the first key corresponding to the target UE, and the second key is the second key corresponding to the target UE. The first keys corresponding to different UEs may be the same or different. , The second keys corresponding to different target UEs may be the same or different.

In some exemplary embodiments, the first key is the first key corresponding to the protocol data unit (PDU, Protocol Data Unit) session of the target UE. For example, one PDU session may correspond to one first key, or two One or more PDU sessions correspond to one first key; the second key is the second key corresponding to the UE’s Protocol Data Unit (PDU, Protocol Data Unit) session. For example, one PDU session can correspond to one second secret. The key may also correspond to a second key for two or more PDU sessions.

In some exemplary embodiments, after determining the target user plane data that needs to be secured between the target user equipment and the user plane functional entity, the method further includes: sending a second notification message to the second control plane functional entity, so The second notification message is used to notify the second control plane functional entity to generate a first key, and the first key is used by the user plane functional entity to generate a second key. The key is used by the target user equipment and the user plane functional entity to securely protect the target user plane data between the target user equipment and the user plane functional entity.

In the data transmission method provided by the present disclosure, the first control plane functional entity or the second control plane functional entity determines the target user plane data that needs to be secured between the target user equipment and the user plane functional entity, and then notifies the target user equipment, The target user equipment and the user plane functional entity are enabled to perform security protection on the target user plane data, and the security protection of the target user plane data between the target user equipment and the user plane functional entity is realized.

Fig. 3 is a flowchart of a data transmission method of the present disclosure.

In the second aspect, referring to FIG. 3, the present disclosure provides a data transmission method applied to a second control plane functional entity (for example, it may be executed by the second control plane functional entity). The method may include step 300 and step 301.

In step 300, a second notification message sent by a first control plane functional entity is received, where the second notification message is used to notify the second control plane functional entity to generate a first key, and the first key is used to be The user plane function entity uses the second key to generate a second key, and the second key is used by the target user equipment and the user plane function entity. Perform security protection with the user plane functional entity.

In some exemplary embodiments, the second key includes an encryption key. In some exemplary embodiments, the second key includes an integrity key. In some exemplary embodiments, the second key includes an encryption key and an integrity key.

In some exemplary embodiments, the encryption key is used for confidentiality protection of user plane data between the UE and the core user plane functional entity, and the integrity key is used for user plane data between the UE and the core user plane functional entity. Integrity protection.

In some exemplary embodiments, the first key is the first key corresponding to the target UE, and the second key is the second key corresponding to the target UE. The first keys corresponding to different UEs may be the same or different. , The second keys corresponding to different target UEs may be the same or different.

In some exemplary embodiments, the first key is the first key corresponding to the protocol data unit (PDU, Protocol Data Unit) session of the target UE. For example, one PDU session may correspond to one first key, or two One or more PDU sessions correspond to one first key; the second key is the second key corresponding to the UE’s Protocol Data Unit (PDU, Protocol Data Unit) session. For example, one PDU session can correspond to one second secret. The key may also correspond to a second key for two or more PDU sessions.

In step 301, the first key is generated, and the first key is sent to the user plane functional entity.

In some exemplary embodiments, the first key may be generated according to the anchor key carried in the second notification message. The first key is used for key isolation, preventing one key from being leaked and affecting the security of other keys, and improving security.

In some exemplary embodiments, before receiving the second notification message sent by the first control plane functional entity, the method may further include: determining target user plane data that needs to be secured between the target user equipment and the user plane functional entity ; Send a first notification message to the first control plane functional entity, the first notification message is used to indicate that the target user plane data is securely protected between the target user equipment and the user plane functional entity .

In some exemplary embodiments, the target user plane data that needs to be secured between the target user equipment and the user plane functional entity may be determined according to the user subscription information. Of course, there are many other ways, and the specific determination strategy is not used to limit the protection scope of the present disclosure, and will not be repeated here.

In some exemplary embodiments, the target user plane data that needs to be securely protected between the target user equipment and the user plane functional entity may be determined during the registration process of the target UE to the core network, for example, after the authentication process is completed , To determine the target user plane data that needs to be secured between the target user equipment and the user plane functional entity. In this case, the target user plane data is all user plane data of the target UE.

In some exemplary embodiments, the target user plane data that needs to be securely protected between the target user equipment and the user plane functional entity may be determined during the establishment of the PDU session, for example, upon receiving the PDU session context creation from the SMF entity After responding, determine the target user plane data that needs to be secured between the target user equipment and the user plane functional entity. In this case, the target user plane data is the user plane data transmitted by the target UE to the user plane functional entity through the PDU session.

That is, for some UEs, after determining the target user plane data that needs to be secured between the user equipment and the user plane functional entity, the first notification message is sent to the user equipment; for some UEs, the first notification message is sent to the user equipment; After all user plane data does not need to be secured between the user equipment and the user plane functional entity, the first notification message is not sent to the UE. In this way, the user plane data of all UEs is not secured between the UE and the user plane functional entity, but the user plane data of some UEs is secured between the UE and the user plane functional entity. The security protection of the user plane data of the UE between the UE and the user plane functional entity can be determined according to the subscription data of the UE, and the user can sign a contract with the operator according to their own needs.

Or, for some PDU sessions of a certain UE, after it is determined that the user plane data transmitted through the PDU session needs to be secured between the user equipment and the user plane functional entity, the first notification message is sent to the user equipment; for the UE For some other PDU sessions, after determining that the user plane data transmitted through the PDU session does not require security protection between the user equipment and the user plane functional entity, the first notification message is not sent to the UE. In this way, the user plane data corresponding to all PDU sessions of the UE is not securely protected between the UE and the user plane functional entity, but the user plane data corresponding to part of the PDU session of the UE is between the UE and the user plane functional entity. Security protection is performed between the UE and the user plane data corresponding to which PDU sessions of the UE. The security protection between the UE and the user plane functional entity can be determined according to the subscription data of the UE. The user can sign a contract with the operator according to their own needs. accomplish.

In the data transmission method provided by the present disclosure, the first control plane functional entity or the second control plane functional entity determines the target user plane data that needs to be secured between the target user equipment and the user plane functional entity, and then notifies the target user equipment, The target user equipment and the user plane functional entity are enabled to perform security protection on the target user plane data, and the security protection of the target user plane data between the target user equipment and the user plane functional entity is realized.

Fig. 4 is a flowchart of a data transmission method of the present disclosure.

In the third aspect, referring to FIG. 4, embodiments of the present disclosure provide a data transmission method, which is applied to a user plane functional entity (for example, it can be executed by a user plane functional entity). The method may include step 400 and step 401.

In step 400, a first key is obtained, and a second key is generated according to the first key; the second key is used to be used by the target user equipment and the user plane functional entity, The user plane data is securely protected between the target user equipment and the user plane functional entity.

In some exemplary embodiments, obtaining the first key includes: receiving the first key sent by the first control plane functional entity.

In some exemplary embodiments, obtaining the first key includes: receiving the first key sent by a second control plane functional entity.

In some exemplary embodiments, the second key includes an encryption key. In some exemplary embodiments, the second key includes an integrity key. In some exemplary embodiments, the second key includes an encryption key and an integrity key.

In some exemplary embodiments, the encryption key is used for confidentiality protection of user plane data between the UE and the core user plane functional entity, and the integrity key is used for user plane data between the UE and the core user plane functional entity. Integrity protection.

In some exemplary embodiments, the first key is the first key corresponding to the target UE, and the second key is the second key corresponding to the target UE. The first keys corresponding to different UEs may be the same or different. , The second keys corresponding to different target UEs may be the same or different.

In some exemplary embodiments, the first key is the first key corresponding to the protocol data unit (PDU, Protocol Data Unit) session of the target UE. For example, one PDU session may correspond to one first key, or two One or more PDU sessions correspond to one first key; the second key is the second key corresponding to the UE’s Protocol Data Unit (PDU, Protocol Data Unit) session. For example, one PDU session can correspond to one second secret. The key may also correspond to a second key for two or more PDU sessions.

It should be noted that for some UEs, if the first key corresponding to the UE is obtained, it means that all user plane data of the UE needs to be secured between the UE and the user plane function entity; for some UEs, if Failure to obtain the first key corresponding to the UE indicates that it is not necessary to perform security protection for all user plane data of the UE between the UE and the user plane functional entity. In this way, the user plane data of all UEs is not secured between the UE and the user plane functional entity, but the user plane data of some UEs is secured between the UE and the user plane functional entity. The security protection of the user plane data of the UE between the UE and the user plane functional entity can be determined according to the subscription data of the UE, and the user can sign a contract with the operator according to their own needs.

Or, for some PDU sessions of a certain UE, if the first key corresponding to the PDU session is obtained, it means that all user plane data transmitted by the UE through the PDU session need to be protected between the UE and the user plane function entity. ; For other PDU sessions of the UE, if the first key corresponding to the PDU session is not obtained, it means that there is no need to securely protect all user plane data transmitted by the UE through the PDU session between the UE and the user plane functional entity . In this way, the user plane data corresponding to all PDU sessions of the UE is not securely protected between the UE and the user plane functional entity, but the user plane data corresponding to part of the PDU session of the UE is between the UE and the user plane functional entity. The user plane data corresponding to which PDU sessions of the UE is specifically protected between the UE and the user plane functional entity can be determined according to the UE’s subscription data, and the user can sign with the operator according to their own needs. accomplish.

In some exemplary embodiments, the second key can be generated in multiple ways. The specific generation method is not used to limit the scope of protection of the present disclosure. The present disclosure emphasizes that the second key is for user equipment and user plane functions. The key used to securely protect user plane data between entities is different from the key used to securely protect user plane data or control plane data between UE and RAN functional entities. RAN does not participate in UE and user plane functional entities. For the security protection of user plane data.

In step 401, security protection processing is performed on the target user plane data transmitted between the target user equipment and the user plane functional entity through the second key.

In some exemplary embodiments, the second key includes a confidentiality key and/or an integrity key, and the target user plane transmitted between the target user equipment and the user plane functional entity is transferred through the second key. Data security protection includes: using the confidentiality key to encrypt the target user plane data sent to the target user equipment; using the confidentiality key to encrypt the target user plane data received from the target user equipment Perform decryption; or, use the integrity key to perform integrity protection on the target user plane data sent to the target user equipment; use the integrity key to perform the integrity protection on the target user plane data received from the target user equipment Performing integrity verification; or, using the confidentiality key to encrypt the target user plane data sent to the target user equipment, and using the integrity key to perform integrity protection on the target user plane data; The integrity key is used to perform integrity verification on the target user plane data received from the target user equipment, and after the verification is passed, the confidentiality key is used to decrypt the target user plane data.

In some exemplary embodiments, the security protection of the target user plane data transmitted between the target user equipment and the user plane functional entity by using the second key includes: the downlink target user sent to the target user equipment Before the plane data is encapsulated in PDCP (Packet Data Convergence Protocol, Packet Data Convergence Protocol), the second key is used to perform the first security protection process on the downlink target user plane data, and the downlink target after the first security protection process The user plane data is sent to the target user equipment; after PDCP encapsulation is performed on the uplink target user plane data received from the target user equipment after the first security protection process, the second key is used to pair the second key The uplink target user plane data after a security protection process is subjected to a second security protection process.

In some exemplary embodiments, the second key is the second key corresponding to the target UE, and the downlink target user plane data sent to the target UE is all downlink target user plane data sent by the user plane functional entity to the target UE. The received uplink target user plane data from the target UE after the first security protection processing is all the uplink target user plane data from the target UE received by the user plane function entity.

That is, the second key is used to perform the first security protection process on all downlink target user plane data sent by the user plane function entity to the target UE, and the second key is used to perform the first security protection process on all the uplink target user plane data received from the target UE. The data undergoes second security protection processing.

In some exemplary embodiments, the second key is the second key corresponding to the PDU session of the target UE. For example, one PDU session may correspond to one second key, or two or more PDU sessions may correspond to one second key. The second key, then, the downlink user plane data sent to the UE is the downlink user plane data sent by the core network to the UE through the PDU session, and the uplink user plane data received from the UE after the first security protection process is the core network The uplink user plane data from the UE received through the PDU session.

That is to say, the second key is used to perform the first security protection process on the downlink target user plane data sent by the user plane function entity to the target UE through the PDU session corresponding to the second key. The downlink target user plane data sent to the UE by the PDU session corresponding to the key (that is, the PDU session other than the PDU session corresponding to the second key) does not require the first security protection process, but is performed according to the existing technology. Processing; similarly, using the second key to perform the second security protection processing on the uplink target user plane data from the target UE received through the PDU session corresponding to the second key, for the PDU that is not corresponding to the second key The uplink target user plane data from the target UE received by the session (that is, the PDU session other than the PDU session corresponding to the second key) does not need to undergo the second security protection process, but is processed in accordance with the prior art.

In the above exemplary embodiment, only the user plane data transmitted with the UE through a partial PDU session is secured, rather than all the user plane data of the UE is secured, thereby improving the processing efficiency for the user plane data that is not required. , Reduce business delay.

In some exemplary embodiments, the security protection may be any one of the following three situations: confidentiality protection, integrity protection, confidentiality protection, and integrity protection. The three situations are described below respectively.

(1) Security protection only includes confidentiality protection

In this case, the second key only includes an encryption key, and correspondingly, the using the second key to perform the first security protection processing on the downlink target user plane data includes: using the encryption key to perform the first security protection process on the downlink target Encrypting user plane data; and performing the second security protection process on the uplink target user data after the first security protection process by using the second key includes: decrypting the encrypted uplink target user data by using the encryption key.

(2) Security protection only includes integrity protection

In this case, the second key only includes the integrity key, and accordingly, the using the second key to perform the first security protection processing on the downlink target user plane data includes: using the integrity key to Performing integrity protection processing on the downlink target user plane data; said using the second key to perform the second security protection processing on the uplink target user plane data after the first security protection processing includes: using the integrity key to perform integrity protection The processed uplink target user plane data is checked for integrity.

(3) Security protection includes both confidentiality protection and integrity protection

In this case, the second key includes an encryption key and an integrity key. Correspondingly, the using the second key to perform the first security protection processing on the downlink target user plane data includes: using the encryption key pair Encrypting the downlink target user plane data, using the integrity key to perform integrity protection processing on the encrypted downlink target user plane data; using the second key to perform the integrity protection processing on the uplink target user after the first security protection processing Performing the second security protection processing on the plane data includes: using the integrity key to perform integrity verification on the uplink target user plane data after encryption and integrity protection processing, and after the verification is passed, the encryption key is used to encrypt the data. The upstream target user data is decrypted.

In the data transmission method provided by the present disclosure, the first control plane functional entity or the second control plane functional entity determines the target user plane data that needs to be secured between the target user equipment and the user plane functional entity, and then notifies the target user equipment, Make the target user equipment and the user plane functional entity secure the target user plane data, and realize the security protection of the target user plane data between the target user equipment and the user plane functional entity; and the RAN does not participate in the UE and the core network For the security protection of user plane data, the RAN transparently transmits the user plane data transmitted between the UE and the core network, and does not maintain the second key, which is suitable for scenarios where the RAN is untrusted and vulnerable to attacks.

Fig. 5 is a flowchart of a data transmission method of the present disclosure.

In the fourth aspect, referring to FIG. 5, the present disclosure provides a data transmission method applied to a target UE (for example, it may be executed by the target UE). The method may include step 500.

In step 500, a first notification message sent by a first control plane functional entity is received, where the first notification message is used to indicate that the target user plane data is performed between the target user equipment and the user plane functional entity. safety protection.

In some exemplary embodiments, the first notification message from the first control plane functional entity is not received, and this process ends.

It should be noted that, for some UEs, if the UE receives the first notification message from the first control plane function entity during the registration process of the UE with the core network, it means that the UE and the user plane function entity need to deal with each other. All user plane data of the UE is secured; for some UEs, if the UE does not receive the first notification message from the first control plane functional entity during the registration process of the UE to the core network, it means that there is no need to connect the UE to the core network. The user plane functional entities perform security protection for all user plane data of the UE. In this way, the user plane data of all UEs is not secured between the UE and the user plane functional entity, but the user plane data of some UEs is secured between the UE and the user plane functional entity. The security protection of the user plane data of the UE between the UE and the user plane functional entity can be determined according to the subscription data of the UE, and the user can sign a contract with the operator according to their own needs.

Or, for some PDU sessions of a certain UE, if the first notification message from the first control plane functional entity is received during the establishment of the PDU session, it indicates that the UE needs to pass between the UE and the user plane functional entity. The user plane data transmitted in the PDU session is secured; for other PDU sessions of the UE, if the first notification message from the first control plane functional entity is not received during the establishment of the PDU session, it means that there is no need for the UE Security protection is performed between the user plane function entity and the user plane data transmitted by the UE through the PDU session. In this way, the user plane data corresponding to all PDU sessions of the UE is not securely protected between the UE and the user plane functional entity, but the user plane data corresponding to part of the PDU session of the UE is between the UE and the user plane functional entity. Security protection is performed between the UE and the user plane data corresponding to which PDU sessions of the UE. The security protection between the UE and the user plane functional entity can be determined according to the subscription data of the UE. The user can sign a contract with the operator according to their own needs. accomplish.

In some exemplary embodiments, after receiving the first notification message sent by the first control plane functional entity, the method may further include: generating a first key, and generating a second key according to the first key; wherein, The second key is used by the target user equipment and the user plane functional entity to securely protect the target user plane data between the target user equipment and the user plane functional entity.

In some exemplary embodiments, the second key includes an encryption key. In some exemplary embodiments, the second key includes an integrity key. In some exemplary embodiments, the second key includes an encryption key and an integrity key.

In some exemplary embodiments, the encryption key is used for confidentiality protection of user plane data between the UE and the core user plane functional entity, and the integrity key is used for user plane data between the UE and the core user plane functional entity. Integrity protection.

In some exemplary embodiments, the first key is the first key corresponding to the target UE, and the second key is the second key corresponding to the target UE. The first keys corresponding to different target UEs may be the same or Different, the second keys corresponding to different target UEs may be the same or different.

In some exemplary embodiments, the first key is the first key corresponding to the protocol data unit (PDU, Protocol Data Unit) session of the target UE. For example, one PDU session may correspond to one first key, or two One or more PDU sessions correspond to one first key; the second key is the second key corresponding to the UE’s Protocol Data Unit (PDU, Protocol Data Unit) session. For example, one PDU session can correspond to one second secret. The key may also correspond to a second key for two or more PDU sessions.

In some exemplary embodiments, the method may further include: performing security protection processing on target user plane data transmitted between the target user equipment and the user plane functional entity through the second key.

In some exemplary embodiments, the second key includes a confidentiality key and/or an integrity key; the second key is used to transmit data between the target user equipment and the user plane functional entity. The security protection processing of the target user plane data includes: using the confidentiality key to encrypt the target user plane data sent to the user plane functional entity; using the confidentiality key to encrypt the target user plane data received from the user functional entity Data decryption; or, using the integrity key to perform integrity protection processing on the target user plane data sent to the user function entity; using the integrity key to perform integrity protection on the target user plane data received from the user functional entity Integrity verification; or, using the confidentiality key to encrypt the target user plane data sent to the user plane functional entity, and using the integrity key to perform integrity protection on the encrypted target user plane data Processing; use the integrity key to perform integrity verification on the target user plane data received from the user functional entity, and use the confidentiality key to decrypt the target user plane data after the verification is passed.

In some exemplary embodiments, performing security protection processing on the target user plane data transmitted between the target user equipment and the user plane functional entity by using the second key includes: Before PDCP encapsulation of the uplink target user plane data, the second key is used to perform the first security protection process on the uplink target user plane data, and the uplink target user plane data after the first security protection process is sent to the user plane function Entity; after PDCP decapsulation is performed on the downlink target user plane data received from the user plane functional entity after the first security protection process, the second key is used to perform the first security protection process on the downlink target user The surface data undergoes second security protection processing.

In some exemplary embodiments, the second key is the second key corresponding to the target UE, and the uplink target user plane data sent to the user plane function entity is all uplink user plane data sent by the target UE to the user plane function entity, The received downlink target user plane data from the user plane functional entity after the first security protection processing is all downlink user plane data from the user plane functional entity received by the target UE.

In other words, the second key is used to perform the first security protection process on all uplink target user plane data sent by the target UE to the user plane functional entity, and the second key is used to perform the first security protection process on all downlink targets received from the user plane functional entity. The user plane data undergoes the second security protection processing.

In some exemplary embodiments, the second key is the second key corresponding to the protocol data unit (PDU, Protocol Data Unit) session of the target UE. For example, one second key may correspond to one PDU session, or two One or more PDU sessions correspond to a second key, then the uplink target user plane data sent to the user plane functional entity is the uplink user plane data sent by the target UE to the user plane functional entity through the PDU session, and the received data is from The downlink target user plane data processed by the first security protection of the user plane function entity is the downlink user plane data from the user plane function entity received by the UE through the PDU session.

That is, the second key is used to perform the first security protection process on the uplink target user plane data sent by the target UE to the user plane function entity through the PDU session corresponding to the second key, and the target UE is not connected with the second key. The uplink user plane data sent by the corresponding PDU session (that is, the PDU session other than the PDU session corresponding to the second key) to the user plane function entity does not require the first security protection process, but is performed in accordance with the existing technology. Processing; similarly, use the second key to perform the second security protection processing on the downlink target user plane data from the user plane functional entity received through the PDU session corresponding to the second key, and for the second key that does not correspond to the second key The downlink user plane data received from the user plane function entity in the PDU session (that is, the PDU session other than the PDU session corresponding to the second key) does not need to be subjected to the second security protection process, but in accordance with the prior art To process.

In the above exemplary embodiment, only the user plane data transmitted through a part of the PDU session and the user plane function entity is secured, instead of the security protection of all the user plane data of the UE, thereby improving the user plane data that does not need to be performed. Improve processing efficiency and reduce business delay.

In some exemplary embodiments, the security protection may be any one of the following three situations: confidentiality protection, integrity protection, confidentiality protection, and integrity protection. The three situations are described below respectively.

(1) Security protection only includes confidentiality protection

In this case, the second key only includes the encryption key. Accordingly, using the second key to perform the first security protection processing on the uplink target user plane data includes: using the encryption key to perform the first security protection process on the uplink target user plane. Encrypting the data; the using the second key to perform the second security protection process on the downlink target user data after the first security protection process includes: using the encryption key to decrypt the encrypted downlink target user data.

(2) Security protection only includes integrity protection

In this case, the second key only includes the integrity key, and accordingly, the using the second key to perform the first security protection processing on the uplink target user plane data includes: using the integrity key to pair the Performing integrity protection processing on the uplink target user plane data; the using the second key to perform the second security protection processing on the downlink target user plane data after the first security protection processing includes: using the integrity key to perform integrity protection The processed downlink target user plane data is checked for integrity.

(3) Security protection includes both confidentiality protection and integrity protection

In this case, the second key includes an encryption key and an integrity key. Correspondingly, the using the second key to perform the first security protection processing on the uplink target user plane data includes: using the encryption key pair Encrypting the uplink target user plane data, using the integrity key to perform integrity protection processing on the encrypted uplink target user plane data; using the second key to perform the integrity protection processing on the downlink target user after the first security protection processing Performing the second security protection processing on the plane data includes: using the integrity key to perform integrity verification on the downstream target user plane data after encryption and integrity protection processing, and after the verification is passed, the encryption key is used to encrypt the data. The downlink target user data is decrypted.

In the data transmission method provided by the present disclosure, the first control plane functional entity or the second control plane functional entity determines the target user plane data that needs to be secured between the target user equipment and the user plane functional entity, and then notifies the target user equipment, Make the target user equipment and the user plane functional entity secure the target user plane data, and realize the security protection of the target user plane data between the target user equipment and the user plane functional entity; and the RAN does not participate in the UE and the core network For the security protection of user plane data, the RAN transparently transmits the user plane data transmitted between the UE and the core network, and does not maintain the second key, which is suitable for scenarios where the RAN is untrusted and vulnerable to attacks.

In some exemplary embodiments, the first control plane functional entity, the second control plane functional entity, and the user plane functional entity are set in different devices in the core network.

In some exemplary embodiments, the first control plane functional entity and the second control plane functional entity are control plane network functions responsible for user equipment access and service processing.

In some exemplary embodiments, the user plane function entity is a forwarding plane network function that processes user application data.

In some exemplary embodiments, in a 5G network, the first control plane functional entity is an access management function (AMF, Access Management Function), and the second control plane functional entity is a session management function (SMF, Session Management Function), The server is the user plane function (UPF, User Plane Function).

In some exemplary embodiments, in an evolved packet core network (EPC, Evolved Packet Core network), the first control plane functional entity is a mobility management entity (MME, Mobility Management Entity), and the user plane functional entity is a service gateway (SGW, Serving GateWay) or packet gateway (PGW, Packet GateWay).

The following specific examples are used to describe the specific implementation process of the foregoing embodiments in detail. It should be noted that the examples listed are only for convenience of description and cannot be used to limit the protection scope of the present disclosure.

Example 1

If a virtual network operator provides network services and it leases access equipment, the access equipment is not trustworthy for the application, and an encrypted channel needs to be established directly between the UE and the core network equipment; or in the following scenario, multiple core network operators Shared access network, in order to ensure data security, it is also necessary to establish an encrypted channel between the UE and each core network. For the above scenario, the key required for user plane data encryption can be generated during the registration and authentication phase of the UE accessing the core network, so that the user plane data can be encrypted for transmission when the UE conducts services. Taking the 5G network as an example, the implementation process is described in Figure 6. In the inventive solution, the first control plane functional entity is an AMF entity, and the user plane functional entity is a UPF entity.

1. The UE requests to access the 5G network and initiates a registration authentication request to the AMF entity. The RAN functional entity routes the registration authentication request to the AMF entity according to the hidden subscription identifier (SUCI, Subscription Identifier) in the registration authentication request.

2. The authentication and authentication process is completed between the UE, AMF entity, Authentication Server Function (AUSF, Authentication Server Function) entity, and Unified Data Management (UDM, Unified Data Management) entity. For other registration procedures among UE, RAN functional entities, and AMF entities, please refer to 3GPP TS 23.502 registration and authentication procedures for details.

3. After the authentication process is completed, the AMF entity generates the anchor key K _SEAF . If the AMF entity decides that the user plane data needs to be secured between the UE and the user plane function entity (for example, the operator policy or user subscription information stipulates that the user plane data needs to be secured between the UE and the user plane function entity Protection, the AMF entity needs to securely protect the user plane data between the UE and the user plane function entity according to the operator’s policy or user subscription information), the AMF entity uses the key generation algorithm to derive the key _{according to the K SEAF, and finally generates} The first (intermediate) key K ₁ .

4.AMF entity transmits the first key K ₁ to UPF entity, the transmitting entity UPF process may be established by the AMF during transmission through the session management entity (SMF, Session Management Function) entity to the session in the PDU.

5. The UPF entity saves the first key K ₁ .

6. The AMF entity notifies the UE that the user plane data needs to be secured between the UE and the user plane function entity.

7. The remaining registration procedures are completed between the UE, the RAN functional entity, and the AMF entity.

8. The UPF entity uses a key generation algorithm to generate a second key _{according to K 1 (the second key includes an encryption key K 2} and an integrity key K ₃ ). On the UE side, according to the instructions in step 6, the UE generates the anchor key K _SEAF according to the same key generation algorithm on the network side, further generates the first key K ₁ , and generates the encryption key according to the first key K ₁ K ₂ and integrity key K ₃ .

9. When the UE conducts services, confidentiality and integrity protection of user plane data are performed between the UE and the UPF entity. For the related process, please refer to the description of Example 4.

The above solution describes the security protection of user plane data between the UE and the 5G core network after the UE is registered on the 5G network, that is, all user plane data interacting between the UE and the 5G core network are protected for confidentiality and integrity . The above solution is also applicable to EPC. The first control plane functional entity described in the solution is MME, and the user plane functional entity is SGW or PGW. In the UE registration phase, an encryption key K2 and an integrity key K3 are generated on the UE and SGW/PGW.

Example 2

Example 1 describes the security protection of user plane data between the UE and the 5G core network. The 5G network can also provide network services in the form of network slicing, that is, 5GC can include multiple network slices. After the UE is registered on the 5G network, it can access up to 8 network slices. Example 2 describes the provision of security protection for user plane data between the UE and the core network at the network slicing level, and the implementation process is shown in FIG. 7. In the solution, the first network control function entity is an AMF entity, the second network control function entity is an SMF entity, and the user plane function entity is a UPF entity:

1. After the UE has successfully registered to the 5G network, the UE requests to access the network slice and initiates a PDU session establishment request. The PDU session establishment request includes a NAS (Non-Access Stratum) message, and the NAS message includes: single Network slice selection assistance information (S-NSSAI, Single Network Slice Selection Assistance Information), etc. The S-NSSAI contains the network slice identifier that authorizes the UE to request access. The AMF entity stores S-NSSAI and other information.

2. The AMF entity selects the SMF entity based on information such as S-NSSAI.

3. The AMF entity initiates a PDU session context creation request to the SMF entity, and the PDU session context creation request includes information such as the user's permanent identifier (SUPI, Subscription Permanent Identifier), S-NSSAI, and so on.

4. The SMF entity uses SUPI, S-NSSAI and other information to obtain session management-related subscription data from the UDM entity; among them, the session management-related subscription data contains information indicating whether user plane data security protection is required between the UE and the core network .

5. If the PDU session establishment request in step 1 is sent for the first time, the SMF entity performs UPF entity selection; if the PDU session establishment request in step 1 is not sent for the first time, step 7 is directly executed.

6. An N4 session is established between the SMF entity and the UPF entity.

7. The SMF entity makes a decision based on the subscription data whether it is necessary to securely protect the user plane data between the UE and the user plane functional entity.

8. The SMF entity and the AMF entity exchange PDU session establishment messages or PDU session update messages. The SMF entity sends information indicating whether the user plane data needs to be secured between the UE and the user plane function entity to the AMF entity.

9. After the AMF entity receives the information indicating whether the user plane data needs to be secured between the UE and the user plane functional entity, it sends the anchor key (for example, K _SEAF ) generated after the authentication is successful to the SMF entity .

10. The SMF entity saves the anchor key K _SEAF and generates the first key K ₁ according to the anchor key K _SEAF using a key generation algorithm.

11. The SMF entity sends the first key K ₁ to the UPF entity.

12. The UPF entity saves the first key K ₁ .

13. According to step 8, the AMF entity returns to the UE information indicating whether the user plane data needs to be secured between the UE and the user plane functional entity.

14. The UE, AMF entity, SMF entity, and UPF entity complete the rest of the PDU session establishment process.

15. After the UE receives the information indicating whether the user plane data needs to be securely protected between the UE and the user plane functional entity, it uses the key generation algorithm to generate the first key K ₁ , and generates the first key K 1 according to the first key K ₁ Two keys (the second key includes an encryption key K ₂ and an integrity key K ₃ ). The UPF entity uses the same key generation algorithm to generate a second key according to the first key K _{1 (the second key includes an encryption key K 2} and an integrity key K ₃ ).

16. Refer to Example 4 for the process of confidentiality and integrity protection of user plane data between the UE and the UPF entity.

In the foregoing embodiment, the SMF entity decides to perform security protection for the user plane data between the UE and the core network for the network slice, and informs the AMF entity. The SMF entity generates the first key K1 according to the anchor key K _SEAF provided by the AMF entity and provides it to the UPF entity. The above process can also be implemented as follows: The network slice decision corresponding to the S-NSSAI requested by the AMF entity for the UE is executed. The user plane data is securely protected between the UE and the core network, and the first key K is generated according to the anchor key KSEAF. _{1 is} provided to the SMF entity, and the SMF entity provides K ₁ to the UPF entity.

Example 3

Example 1 describes the security protection of user plane data between the UE and the 5G core network. The 5G network can also provide network services in the form of network slicing, that is, 5GC can include multiple network slices. After the UE is registered on the 5G network, it can access up to 8 network slices. Example 3 describes the provision of security protection for user plane data between the UE and the core network at the network slicing level, and the implementation process is shown in Figure 8. In the solution, the first network control function entity is an AMF entity, the second network control function entity is an SMF entity, and the user plane function entity is a UPF entity:

1. After the UE has successfully registered to the 5G network, the UE requests to access the network slice and initiates a PDU session establishment request. The PDU session establishment request contains a NAS message. The NAS message includes: Single network slice selection auxiliary information (S-NSSAI, Single) Network Slice Selection Assistance Information) etc. The S-NSSAI contains the network slice identifier that authorizes the UE to request access. The AMF entity stores S-NSSAI and other information.

2. The AMF entity selects the SMF entity based on information such as S-NSSAI.

3. The AMF entity initiates a PDU session context creation request to the SMF entity, and the PDU session context creation request includes information such as SUPI, S-NSSAI, etc.

4. The SMF entity uses SUPI, S-NSSAI and other information to obtain session management-related contract data from UDM; among them, the session management-related contract data contains information indicating whether user plane data needs to be secured between the UE and the user plane function entity. information.

5. If the PDU session establishment request in step 1 is sent for the first time, the SMF entity performs UPF entity selection; if the PDU session establishment request in step 1 is not sent for the first time, step 7 is directly executed.

6. An N4 session is established between the SMF entity and the UPF entity.

7. The SMF entity and the AMF entity exchange PDU session establishment messages or PDU session update messages. The SMF entity sends information indicating whether user plane data security protection between the UE and the user plane function entity needs to be performed to the AMF entity.

8. The decision of the AMF entity requires the security protection of the user plane data between the UE and the user plane functional entity, and the first (intermediate) key is generated using the key generation algorithm _{according to the anchor key K SEAF generated after the authentication is successful} K ₁ , sending the first key K ₁ to the SMF entity.

9. The SMF entity sends the first key K ₁ to the UPF entity.

10. The UPF entity saves the first key K ₁ .

11. According to step 8, the AMF entity returns to the UE information indicating whether the user plane data needs to be secured between the UE and the user plane functional entity.

12. The remaining process of PDU session establishment is completed among UE, AMF entity, SMF entity, and UPF entity.

13. After the UE receives the information indicating whether the user plane data needs to be securely protected between the UE and the user plane functional entity, it uses the key generation algorithm to generate the first key K ₁ , and generates the first key K 1 according to the first key K ₁ Two keys (the second key includes an encryption key K ₂ and an integrity key K ₃ ). The UPF entity uses the same key generation algorithm to generate a second key according to the first key K _{1 (the second key includes an encryption key K 2} and an integrity key K ₃ ).

14. Refer to Example 4 for the process of confidentiality and integrity protection of user plane data between the UE and the UPF entity.

Example 4

In combination with the foregoing implementation manners, it is decided to perform security protection for user plane data between the UE and the RAN entity or the UE and the UPF entity according to whether the AMF entity sends the first notification message to the UE.

If the AMF entity does not send the first notification message to the UE, security protection for user plane data is performed between the UE and the RAN functional entity, which is a prior art.

If the AMF entity sends the first notification message to the UE, the user plane data is securely protected between the UE and the UPF entity, that is, the encryption key K ₂ and the integrity key K _{3 are used} .

Combining the above example 1, example 2 and example 3, this example describes the schematic diagram of the protocol stack processing of the user plane data security endpoint in the UPF, as shown in Figure 9, that is, the PDCP connection is established between the UE and the UPF entity, and the PDCP connection is used Encryption and integrity protection of user plane data. Intermediate network functional entities, such as RAN functional entities, are not involved in the encryption and decryption processing and integrity protection of user plane data. The specific implementation process is described as follows:

For uplink user plane data:

The UE completes the encapsulation of the sent uplink user plane data according to the UE protocol stack part shown in FIG. 9 and sends the encapsulated uplink user plane data. Specifically, the application layer encapsulation is performed on the uplink user plane data, the PDU layer encapsulation is performed on the uplink user plane data after the application layer encapsulation, and the Simple Distributed File Transfer System Access Protocol (SDAP, Simple Distribution File System Access Protocol) encapsulation, using the encryption key K ₂ to encrypt the SDAP encapsulated uplink user plane data, and using the integrity key K ₃ to perform integrity protection processing on the encrypted uplink user plane data. PDCP encapsulation is performed on the uplink user plane data after sexual protection processing, the radio link control layer (RLC, Radio Link Control) encapsulation is performed on the uplink user plane data after PDCP encapsulation, and the media access control is performed on the uplink user plane data after RLC encapsulation. (MAC, Medica Access Control) layer encapsulation, physical layer (PHY, Physical layer) encapsulation is performed on the uplink user plane data after MAC layer encapsulation.

When the PHY-encapsulated uplink user plane data is sent to the RAN entity, the RAN entity completes the protocol conversion of the uplink user plane data. First, the PHY encapsulated uplink user plane data is PHY decapsulated, and the PHY decapsulated uplink user The plane data is decapsulated at the MAC layer, the uplink user plane data after the MAC layer decapsulation is decapsulated, and then the uplink user plane data after the RLC decapsulation is converted into a general packet radio service (GPRS, General Packet Radio Service) tunnel Protocol (GTP, GPRS Tunnelling Protocol) encapsulation format. In the protocol conversion process, the RAN entity does not perform any processing on the PDCP layer and above, that is, does not perform decryption and integrity verification processing on the uplink user plane data. After the RAN entity completes the protocol conversion processing on the uplink user plane data, it is sent to the UPF entity.

The UPF entity receives the upstream user plane data after protocol conversion, decapsulates the upstream user plane data after protocol conversion, decapsulates the upstream user plane data after the protocol conversion, decapsulates the upstream user plane data decapsulated at the L1 layer, decapsulates the upstream user plane data at the L2 layer, and decapsulates the L2 layer Decapsulate the upstream user plane data at the GTP-U/UDP/IP layer, decapsulate the upstream user plane decapsulated at the GTP-U/UDP/IP layer using PDCP, and decapsulate PDCP with the integrity key K ₃ Integrity check is performed on the uplink user plane data. After the verification is passed, use the encryption key K ₂ to decrypt the uplink user plane data after PDCP decapsulation, and perform SDAP decapsulation on the decrypted uplink user plane data. The encapsulated uplink user plane data is decapsulated at the PDU layer.

For downlink user plane data:

The UPF entity completes the encapsulation of the sent downlink user plane data according to the UPF protocol stack part shown in FIG. 9, and sends the encapsulated downlink user plane data. Specifically, perform PDU layer encapsulation on the downlink user plane data, perform SDAP encapsulation on the PDU layer encapsulated downlink user plane data, use encryption key K ₂ to encrypt the SDAP encapsulated downlink user plane data, and use the integrity key K ₃ performs integrity protection processing on the encrypted downlink user plane data, performs PDCP encapsulation on the downlink user plane data after integrity protection processing, and performs GTP-U/UDP/IP layer encapsulation on the PDCP encapsulated downlink user plane data , L2 layer encapsulation is performed on the downlink user plane data after the GTP-U/UDP/IP layer encapsulation, and the L1 layer encapsulation is performed on the downlink user plane data after the L2 layer encapsulation.

When the data is sent to the RAN entity, the RAN entity completes the protocol conversion of the downlink user plane data. First, the L1 layer encapsulated downlink user plane data is decapsulated at the L1 layer, and the L1 layer decapsulated downlink user plane data is decapsulated at the L2 layer. Layer decapsulation, decapsulate the downlink user plane data decapsulated at the L2 layer at the GTP-U/DPU/IP layer, and then convert the decapsulated downlink user plane data at the GTP-U/DPU/IP layer into an RLC encapsulation format . In the protocol conversion process, the RAN entity does not perform any processing on the PDCP layer and above, that is, does not perform decryption and integrity verification processing on the downlink user plane data. After the RAN entity completes the protocol conversion processing on the downlink user plane data, it is sent to the UE.

The UE receives the downlink user plane data after protocol conversion, decapsulates the downlink user plane data after protocol conversion, decapsulates the downlink user plane data after PHY decapsulation, and decapsulates the downlink user plane data after the MAC layer decapsulation. The plane data is decapsulated at the RLC layer, the downlink user plane decapsulated at the RLC layer is decapsulated with PDCP, and the integrity key K _{3 is used} to verify the integrity of the downlink user plane data after the PDCP decapsulation. After the verification is passed , Use the encryption key K ₂ to decrypt the downlink user plane data after PDCP decapsulation, perform SDAP decapsulation on the decrypted downlink user plane data, decapsulate the downlink user plane data after SDAP decapsulation, and decapsulate the PDU layer. The downstream user plane data after layer decapsulation is decapsulated at the application layer.

In a fifth aspect, the present disclosure provides an electronic device, which includes: at least one processor; a memory on which at least one program is stored. When the at least one program is executed by at least one processor, the at least one processor implements any one of the foregoing. Kind of data transmission method.

Among them, the processor is a device with data processing capabilities, which includes but is not limited to a central processing unit (CPU), etc.; the memory is a device with data storage capabilities, which includes but is not limited to random access memory (RAM, more specifically such as SDRAM). , DDR, etc.), read-only memory (ROM), charged erasable programmable read-only memory (EEPROM), flash memory (FLASH).

In some embodiments, the processor and the memory are connected to each other through a bus, and further connected to other components of the computing device.

In a sixth aspect, the present disclosure provides a computer-readable storage medium on which a computer program is stored, and when the program is executed by a processor, any one of the aforementioned data transmission methods is implemented.

FIG. 10 is a block diagram of the composition of a data transmission device of the present disclosure.

In a seventh aspect, referring to FIG. 10, the present disclosure provides a data transmission device (such as a first control plane functional entity), including: a first determining module 1001 configured to determine that it needs to perform between the target user equipment and the user plane functional entity Security-protected target user plane data; the first notification message sending module 1002 is configured to send a first notification message to the target user equipment, where the first notification message is used to indicate that the target user equipment and the user plane The functional entities perform security protection on the target user plane data.

In some exemplary embodiments, the data transmission device further includes: a first key processing module 1003, configured to generate a first key, and send the first key to the user plane functional entity; wherein, the first key A key is used to be used by the user plane functional entity to generate a second key, and the second key is used to be used by the target user equipment and the user plane functional entity to perform data on the target user plane. Security protection is performed between the target user equipment and the user plane functional entity.

In some exemplary embodiments, the first determining module 1001 is configured to receive the first notification message sent by the second control plane functional entity.

In some exemplary embodiments, the data transmission apparatus further includes: a second notification message sending module 1004, configured to send a second notification message to a second control plane functional entity, where the second notification message is used to notify the second The control plane function entity generates a first key, and the first key is used by the user plane function entity to generate a second key, and the second key is used by the target user equipment and the The user plane functional entity is used to securely protect the target user plane data between the target user equipment and the user plane functional entity.

The specific implementation process of the above-mentioned data transmission device is the same as the specific implementation process of the data transmission method on the functional entity side of the first control plane in the foregoing embodiment, and will not be repeated here.

FIG. 11 is a block diagram of the composition of a data transmission device of the present disclosure.

In an eighth aspect, referring to FIG. 11, the present disclosure provides a data transmission device (such as a second control plane functional entity), including: a first notification message receiving module 1101, configured to receive a second notification sent by the first control plane functional entity Message, the second notification message is used to notify the second control plane functional entity to generate a first key, and the first key is used by the user plane functional entity to generate a second key, the The second key is used by the target user equipment and the user plane functional entity to securely protect the target user plane data between the target user equipment and the user plane functional entity; the second secret The key processing module 1102 is configured to generate the first key, and send the first key to the user plane function entity.

In some exemplary embodiments, the data transmission apparatus further includes: a third determining module 1103 configured to determine target user plane data that needs to be secured between the target user equipment and the user plane functional entity; and a third notification message sending module 1104. It is configured to send a first notification message to the first control plane functional entity, where the first notification message is used to indicate that the target user plane data is received between the target user equipment and the user plane functional entity. Carry out safety protection.

The specific implementation process of the above-mentioned data transmission device is the same as the specific implementation process of the data transmission method on the functional entity side of the second control plane in the foregoing embodiment, and will not be repeated here.

FIG. 12 is a block diagram of the composition of a data transmission device of the present disclosure.

In a ninth aspect, referring to FIG. 12, the present disclosure provides a data transmission device (such as a user plane functional entity), including: a third key processing module 1201, configured to obtain a first key, and generate The second key; the second key is used to be used by the target user equipment and the user plane functional entity, and the target user plane data is between the target user equipment and the user plane functional entity Perform security protection; the first data processing module 1202 is configured to perform security protection processing on target user plane data transmitted between the target user equipment and the user plane functional entity through the second key.

In some exemplary embodiments, the third key processing module 1201 is configured to obtain the first key in the following manner: receiving the first key sent by the first control plane functional entity.

In some exemplary embodiments, the third key processing module 1201 is configured to obtain the first key in the following manner: receiving the first key sent by the second control plane functional entity.

In some exemplary embodiments, the second key includes a confidentiality key and/or an integrity key, and the first data processing module 1202 is configured to: use the confidentiality key pair to send to the target user equipment The target user plane data is encrypted; the confidentiality key is used to decrypt the target user plane data received from the target user equipment; or the integrity key is used to send to the target user of the target user equipment Protect the integrity of the plane data; use the integrity key to verify the integrity of the target user plane data received from the target user equipment; or, use the confidentiality key pair to send to the target user equipment To encrypt the target user plane data, use the integrity key to perform integrity protection on the target user plane data; use the integrity key to perform integrity on the target user plane data received from the target user equipment After the verification is passed, the confidentiality key is used to decrypt the target user plane data.

The specific implementation process of the foregoing data transmission device is the same as the specific implementation process of the data transmission method on the user plane function entity side of the foregoing embodiment, and will not be repeated here.

FIG. 13 is a block diagram of the composition of a data transmission device of the present disclosure.

In the tenth aspect, referring to FIG. 13, the present disclosure provides another data transmission device (such as a target UE), including: a second notification message receiving module 1301, configured to receive a first notification message sent by a first control plane functional entity, so The first notification message is used to instruct to perform security protection on the target user plane data between the target user equipment and the user plane functional entity.

In some exemplary embodiments, the data transmission device further includes: a fourth key processing module 1302, configured to generate a first key, and generate a second key according to the first key; wherein, the second key The key is used by the target user equipment and the user plane functional entity to securely protect the target user plane data between the target user equipment and the user plane functional entity.

In some exemplary embodiments, the second key includes a confidentiality key and/or an integrity key; the data transmission device further includes: a second data processing module 1303 configured to: use the confidentiality key Encrypt the target user plane data sent to the user plane functional entity; use the confidentiality key to decrypt the target user plane data received from the user functional entity; or use the integrity key pair to send to the user plane Perform integrity protection processing on the target user plane data of the functional entity; use the integrity key to perform integrity verification on the target user plane data received from the user functional entity; or use the confidentiality key pair to send to the user Encrypt the target user plane data of the user plane function entity, use the integrity key to perform integrity protection processing on the encrypted target user plane data; use the integrity key to perform the integrity protection processing on the target user received from the user function entity The integrity check is performed on the plane data, and the confidentiality key is used to decrypt the target user plane data after the verification is passed.

The specific implementation process of the above-mentioned data transmission device is the same as the specific implementation process of the data transmission method on the target UE side in the foregoing embodiment, and will not be repeated here.

FIG. 14 is a block diagram of the composition of a data transmission system of the present disclosure.

In an eleventh aspect, referring to FIG. 14, the present disclosure provides a data transmission system, including: a first control plane function entity 1401, configured to determine the target user plane that needs to be secured between the target user equipment and the user plane function entity Data; sending a first notification message to the target user equipment, where the first notification message is used to instruct to perform security protection on the target user plane data between the target user equipment and the user plane functional entity; target The user equipment 1402 is configured to receive the first notification message sent by the first control plane functional entity.

In some exemplary embodiments, the first control plane functional entity 1401 is further configured to: generate a first key, and send the first key to the user plane functional entity; wherein, the first key is used for Is used by the user plane functional entity to generate a second key, and the second key is used by the target user equipment and the user plane functional entity, and for the target user plane data in the target user Security protection is performed between the device and the user plane functional entity; the data transmission system further includes: a user plane functional entity 1403 configured to receive the first key sent by the first control plane functional entity; according to the first secret Key to generate a second key; using the second key to perform security protection processing on the target user plane data transmitted between the target user equipment and the user plane functional entity; the target user equipment 1402 is further configured to: generate a second key A key for generating a second key according to the first key; using the second key to perform security protection processing on target user plane data transmitted between the target user equipment and the user plane functional entity.

In some exemplary embodiments, the first control plane functional entity 1401 is configured to determine the target user plane data that needs to be secured between the target user equipment and the user plane functional entity in the following manner: receiving the second control plane functional entity The first notification message sent; the data transmission system further includes: a second control plane functional entity 1404 configured to determine the target user plane data that needs to be secured between the target user equipment and the user plane functional entity; The control plane functional entity sends the first notification message.

In some exemplary embodiments, the first control plane functional entity 1401 is further configured to send a second notification message to the second control plane functional entity, where the second notification message is used to notify the second control plane functional entity to generate A first key, the first key is used to be used by the user plane functional entity to generate a second key, the second key is used to be used by the target user equipment and the user plane functional entity , To perform security protection on the target user plane data between the target user equipment and the user plane functional entity; the data transmission system further includes: a second control plane functional entity 1404 configured to receive the first control plane functional entity The second notification message sent; the first key is generated, and the first key is sent to the user plane function entity; the user plane function entity 1403 is configured to receive the first message sent by the second control plane function entity Key; generate a second key according to the first key; use the second key to securely protect the target user plane data transmitted between the target user equipment and the user plane functional entity; target The user equipment 1402 is further configured to: generate a first key, and generate a second key according to the first key; use the second key to transfer data between the target user equipment and the user plane functional entity The target user plane data is processed for security protection.

The specific implementation process of the above-mentioned data transmission system is the same as the specific implementation process of the data transmission method of the foregoing embodiment, and will not be repeated here.

A person of ordinary skill in the art can understand that all or some of the steps, functional modules/units in the system, and apparatus in the methods disclosed above can be implemented as software, firmware, hardware, and appropriate combinations thereof. In the hardware implementation, the division between functional modules/units mentioned in the above description does not necessarily correspond to the division of physical components; for example, a physical component may have multiple functions, or a function or step may consist of several physical components. The components are executed cooperatively. Certain physical components or all physical components can be implemented as software executed by a processor, such as a central processing unit, a digital signal processor, or a microprocessor, or as hardware, or as an integrated circuit, such as an application specific integrated circuit . Such software may be distributed on a computer-readable medium, and the computer-readable medium may include a computer storage medium (or a non-transitory medium) and a communication medium (or a transitory medium). As is well known by those of ordinary skill in the art, the term computer storage medium includes volatile and non-volatile implementations in any method or technology for storing information (such as computer-readable instructions, data structures, program modules, or other data). Sexual, removable and non-removable media. Computer storage media include but are not limited to RAM, ROM, EEPROM, flash memory or other memory technologies, CD-ROM, digital versatile disk (DVD) or other optical disk storage, magnetic cassettes, magnetic tapes, magnetic disk storage or other magnetic storage devices, or Any other medium used to store desired information and that can be accessed by a computer. In addition, it is well known to those of ordinary skill in the art that a communication medium usually contains computer-readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transmission mechanism, and may include any information delivery medium. .

Example embodiments have been disclosed herein, and although specific terms are adopted, they are used and should only be interpreted as general descriptive meanings, and are not used for the purpose of limitation. In some examples, it is obvious to those skilled in the art that, unless expressly indicated otherwise, the features, characteristics, and/or elements described in combination with a particular embodiment can be used alone, or features, characteristics, and/or elements described in combination with other embodiments can be used, Combination of features and/or components. Therefore, those skilled in the art will understand that various changes in form and details can be made without departing from the scope of the present disclosure as set forth by the appended claims.

Claims (16)

A data transmission method, applied to a first control plane functional entity, includes: Determine the target user plane data that needs to be secured between the target user equipment and the user plane functional entity; Send a first notification message to the target user equipment, where the first notification message is used to instruct to perform security protection on the target user plane data between the target user equipment and the user plane functional entity. The data transmission method according to claim 1, after determining the target user plane data that needs to be secured between the target user equipment and the user plane functional entity, the method further comprises: Generate a first key, and send the first key to the user plane functional entity; wherein, the first key is used by the user plane functional entity to generate a second key, and the second key is The key is used by the target user equipment and the user plane functional entity to securely protect the target user plane data between the target user equipment and the user plane functional entity. The method according to claim 1, wherein the determining the target user plane data that needs to be secured between the target user equipment and the user plane functional entity comprises: Receive the first notification message sent by the second control plane functional entity. The method according to claim 1, after determining the target user plane data that needs to be secured between the target user equipment and the user plane functional entity, the method further comprises: A second notification message is sent to the second control plane functional entity, the second notification message is used to notify the second control plane functional entity to generate a first key, and the first key is used to be used by the user plane function The entity uses it to generate a second key, the second key being used by the target user equipment and the user plane function entity, and for the target user plane data on the target user equipment and the user plane Security protection between functional entities. A data transmission method applied to a second control plane functional entity, including: Receive a second notification message sent by a first control plane functional entity, where the second notification message is used to notify the second control plane functional entity to generate a first key, and the first key is used to be used by the user plane The functional entity uses it to generate a second key, and the second key is used by the target user equipment and the user plane functional entity. Security protection between surface functional entities; The first key is generated, and the first key is sent to the user plane function entity. The method according to claim 5, before the receiving the second notification message sent by the first control plane functional entity, the method further comprises: Determine the target user plane data that needs to be secured between the target user equipment and the user plane functional entity; Send a first notification message to the first control plane functional entity, where the first notification message is used to instruct to perform security protection on the target user plane data between the target user equipment and the user plane functional entity. A data transmission method applied to user plane functional entities, including: Obtain a first key, and generate a second key according to the first key; the second key is used by the target user equipment and the user plane functional entity to access the target user plane data Performing security protection between the target user equipment and the user plane functional entity; Security protection processing is performed on the target user plane data transmitted between the target user equipment and the user plane functional entity by using the second key. The method according to claim 7, wherein said obtaining the first key comprises: Receiving the first key sent by the first control plane functional entity. The method according to claim 7, wherein said obtaining the first key comprises: Receiving the first key sent by the second control plane functional entity. The method according to claim 7, wherein the second key includes a confidentiality key and/or an integrity key, and the second key is used to communicate between the target user equipment and the user plane functional entity. The transmitted target user plane data is protected by security, including: Use the confidentiality key to encrypt the target user plane data sent to the target user equipment; use the confidentiality key to decrypt the target user plane data received from the target user equipment; or, Use the integrity key to perform integrity protection on the target user plane data sent to the target user equipment; use the integrity key to perform integrity verification on the target user plane data received from the target user equipment ； or, Use the confidentiality key to encrypt the target user plane data sent to the target user equipment, and use the integrity key to perform integrity protection on the target user plane data; The integrity key is used to perform integrity verification on the target user plane data received from the target user equipment, and after the verification is passed, the confidentiality key is used to decrypt the target user plane data. A data transmission method applied to target user equipment, including: Receiving a first notification message sent by a first control plane functional entity, where the first notification message is used to instruct to perform security protection on the target user plane data between the target user equipment and the user plane functional entity. The method according to claim 11, after the receiving the first notification message sent by the first control plane functional entity, the method further comprises: A first key is generated, and a second key is generated according to the first key; wherein, the second key is used by the target user equipment and the user plane functional entity to perform a reference to the target user plane Data is secured between the target user equipment and the user plane functional entity. The method according to claim 12, wherein the second key comprises a confidentiality key and/or an integrity key; the method further comprises: Use the confidentiality key to encrypt the target user plane data sent to the user function entity; use the confidentiality key to decrypt the target user plane data received from the user function entity; or, Using the integrity key to perform integrity protection processing on the target user plane data sent to the user functional entity; using the integrity key to perform integrity verification on the target user plane data received from the user functional entity; or, Use the confidentiality key to encrypt the target user plane data sent to the user plane functional entity, and use the integrity key to perform integrity protection processing on the encrypted target user plane data; The integrity key is used to perform integrity verification on the target user plane data received from the user functional entity, and after the verification is passed, the confidentiality key is used to decrypt the target user plane data. An electronic device, which includes: At least one processor; A storage device having at least one program stored thereon, and when the at least one program is executed by the at least one processor, the at least one processor realizes the data transmission method according to any one of claims 1-13. A computer-readable storage medium having a computer program stored thereon, and when the program is executed by a processor, the data transmission method according to any one of claims 1-13 is realized. A data transmission system includes: The first control plane functional entity is configured to determine target user plane data that needs to be secured between the target user equipment and the user plane functional entity; send a first notification message to the target user equipment, and the first notification message is used Instructing to perform security protection on the target user plane data between the target user equipment and the user plane functional entity; The target user equipment is configured to receive the first notification message sent by the first control plane functional entity.

Images