[go: up one dir, main page]

WO2025167843A1 - Procédé et appareil de communication - Google Patents

Procédé et appareil de communication

Info

Publication number
WO2025167843A1
WO2025167843A1 PCT/CN2025/075515 CN2025075515W WO2025167843A1 WO 2025167843 A1 WO2025167843 A1 WO 2025167843A1 CN 2025075515 W CN2025075515 W CN 2025075515W WO 2025167843 A1 WO2025167843 A1 WO 2025167843A1
Authority
WO
WIPO (PCT)
Prior art keywords
node
security algorithm
key length
security
supported
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
PCT/CN2025/075515
Other languages
English (en)
Chinese (zh)
Inventor
郭燕飞
吴义壮
郭龙华
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Huawei Technologies Co Ltd
Original Assignee
Huawei Technologies Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Huawei Technologies Co Ltd filed Critical Huawei Technologies Co Ltd
Publication of WO2025167843A1 publication Critical patent/WO2025167843A1/fr
Pending legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/03—Protecting confidentiality, e.g. by encryption
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/041—Key generation or derivation

Definitions

  • the embodiments of the present application relate to the field of wireless communications, and in particular to a communication method and apparatus.
  • symmetric security algorithms are commonly used to protect data transmitted between terminal devices and the network. These algorithms use a 128-bit key length (collectively, these algorithms are referred to as 128-bit algorithms).
  • 128-bit algorithms face the risk of being cracked by quantum computers. Therefore, industry experts recommend upgrading symmetric security algorithms from 128-bit to 256-bit. In other words, using a symmetric security algorithm with a 256-bit key length to protect data.
  • the present application provides a communication method and apparatus for achieving the security of a communication system in a scenario where the communication system needs to support both 128-bit algorithms and 256-bit algorithms.
  • the present application provides a communication method that can be performed by a first communication device, which can serve as a master node of a terminal device in dual connectivity (DC) mode.
  • the first communication device can be a wireless access node or a component (such as a chip) in a wireless access node.
  • a master node for ease of description, the following description uses execution by a master node as an example.
  • the method includes: a primary node determining a secondary node based on a key length of a security algorithm supported by the primary node and a key length of a security algorithm supported by a candidate node, or the primary node determining a secondary node based on a key length of a first security algorithm and a key length of a security algorithm supported by the candidate node, wherein the first security algorithm is a security algorithm used to protect data transmitted between the primary node and a terminal device.
  • the candidate node includes the secondary node.
  • the primary node sends a node request to the secondary node, wherein the node request is used to request the addition of the secondary node.
  • the main node when the main node selects a secondary node from the alternative nodes, it considers the key length of the first security algorithm (or the key length of the security algorithm supported by the main node) and the key length of the security algorithm supported by the alternative node, and requests to add the selected secondary node. This can make the selection of the secondary node more reasonable, and facilitates the subsequent secondary nodes to select a suitable security algorithm.
  • the selected secondary node can meet the following conditions: the main node and the secondary node can each determine a suitable security algorithm, so that the security strength of the data transmitted between the main node and the terminal device is consistent with the security strength of the data transmitted between the secondary node and the terminal device, so as to meet the requirements of secure communication.
  • the secondary node selected according to the solution of the present application can make the key lengths of the security algorithms selected by the main node and the secondary node the same.
  • the terminal device uses data redundant transmission (such as ultra reliable and low latency communications (URLLC)) services in dual connection mode
  • data redundant transmission such as ultra reliable and low latency communications (URLLC)
  • URLLC ultra reliable and low latency communications
  • the terminal device's two redundant protocol data unit (PDU) sessions are used to transmit service data.
  • the data corresponding to the two PDU sessions are protected by the primary node and the secondary node respectively using the selected security algorithms.
  • the key lengths of the two security algorithms are the same, which meets the security assumption of data redundant transmission.
  • the key length of the security algorithm supported by the secondary node is not less than the key length of the first security algorithm.
  • the maximum key length of the security algorithm supported by the secondary node is not less than the key length of the first security algorithm.
  • the key length of the security algorithm supported by the secondary node is not less than the maximum key length of the security algorithm supported by the primary node.
  • the maximum key length of the security algorithm supported by the secondary node is not less than the maximum key length of the security algorithm supported by the primary node.
  • the key length of the security algorithm supported by the secondary node is not less than the key length of the first security algorithm or the key length of the security algorithm supported by the primary node, so that the secondary node is able to select an appropriate security algorithm to protect the data transmitted between the secondary node and the terminal device. In other words, it avoids the secondary node being arbitrarily determined by the primary node and unable to select an appropriate security algorithm. For example, if the primary node determines a 256-bit algorithm to protect the data transmitted between the primary node and the terminal device, in this case, if the secondary node does not support the 256-bit algorithm and only supports the 128-bit algorithm, the secondary node cannot select the 256-bit algorithm to meet the security requirements.
  • the node request includes information about the key length of the first security algorithm. Specifically, the information about the key length of the first security algorithm is used to determine the security algorithm for data transmitted between the secondary node and the terminal device.
  • the secondary node can obtain information about the key length of the first security algorithm from the node request and select a security algorithm based on this information.
  • the primary and secondary nodes can each select an appropriate security algorithm and, based on their respective selected security algorithms, protect data transmitted between them and the terminal device, thereby achieving security for the communication system. For example, if the security algorithms selected by the primary and secondary nodes each have the same key length, this meets the security assumptions of data redundancy transmission in scenarios where the terminal device uses data redundancy transmission services.
  • the node request when the key length of the first security algorithm is a preset key length, the node request includes information about the key length of the first security algorithm.
  • the preset key length is, for example, 256 bits.
  • a triggering condition is provided where the node request includes information about the key length of the first security algorithm, namely, the key length of the first security algorithm is a preset key length. It will be appreciated that when the key length of the first security algorithm is less than the preset key length, it is not necessary to include the key length information of the first security algorithm in the node request, thereby reducing the number of bits occupied during signaling exchanges.
  • the master node is preconfigured with information about the key length of the security algorithm supported by the candidate node; or the master node obtains information about the key length of the security algorithm supported by the candidate node from the candidate node.
  • the information on the key length of the security algorithm supported by the alternative node can be an identifier of multiple key lengths of multiple security algorithms supported by the alternative node, or an identifier of the maximum key length among multiple key lengths supported by the alternative node, or an indication of whether the alternative node supports a preset key length, and the preset key length can be 256 bits.
  • a method is provided for the master node to obtain information about the key length of the security algorithm supported by the candidate node, so that the master node can select a secondary node from the candidate node based on the key length of the security algorithm supported by the candidate node.
  • the primary node upon determining that a redundancy condition is met, determines a secondary node based on the key length of the first security algorithm and the key length of the security algorithm supported by the backup node; or, the primary node determines the secondary node based on the key length of the security algorithm supported by the primary node and the key length of the security algorithm supported by the backup node.
  • the redundancy condition includes one or more of the following conditions 1 to 4: condition 1, the terminal device uses a data redundancy transmission (such as URLLC) service; condition 2, a redundant user plane path is established for the terminal device; condition 3, a redundant PDU session is established for the terminal device; or condition 4, redundant transmission is implemented for the terminal device.
  • the main node considers the trigger conditions of the key length of the first security algorithm (or the key length of the security algorithm supported by the main node) and the key length of the security algorithm supported by the alternative node when determining the secondary node. That is, the above method is executed when it is determined that the redundancy condition is met to avoid unnecessary actions of the main node.
  • the present application provides a communication method that can be performed by a first communication device, which can serve as a master node of a terminal device in dual connectivity mode.
  • the first communication device can be a wireless access node or a component (such as a chip) in a wireless access node.
  • the master node uses the master node as an example.
  • the method includes: a primary node obtaining information about security algorithms supported by a secondary node.
  • the primary node determines a first security algorithm based on the information about the security algorithms supported by the secondary node.
  • the first security algorithm is a security algorithm used to protect data transmitted between the primary node and a terminal device.
  • the primary node may first select a secondary node from candidate nodes, and then obtain information about the security algorithms supported by the secondary node.
  • the master node when determining the first security algorithm, the master node considers information about the security algorithms supported by the secondary node. In this way, the master node and the secondary node can each determine an appropriate security algorithm, thereby ensuring that the security strength of data transmitted between the master node and the terminal device is consistent with the security strength of data transmitted between the secondary node and the terminal device, thereby meeting the requirements of secure communication. For example, according to the solution of this application, it is possible to achieve that the key length of the first security algorithm selected by the master node and the security algorithm selected by the secondary node are the same.
  • the information about security algorithms supported by the secondary node includes information about key lengths of the security algorithms supported by the secondary node and/or identifiers of the security algorithms supported by the secondary node.
  • the information about key lengths of the security algorithms supported by the secondary node may specifically include identifiers of multiple key lengths supported by the secondary node, or identifiers of the maximum key length supported by the secondary node, or an indication of whether the secondary node supports a preset key length, where the preset key length is, for example, 256 bits.
  • the primary node further sends a node request to the secondary node, requesting the addition of the secondary node.
  • the node request includes information about the key length of the first security algorithm.
  • the key length information of the first security algorithm is used to determine the security algorithm for data transmitted between the secondary node and the terminal device.
  • the key length information of the first security algorithm is used by the secondary node to determine the security algorithm for data transmitted between the secondary node and the terminal device.
  • the secondary node can obtain information about the key length of the first security algorithm from the node request and select a security algorithm based on the information about the key length of the first security algorithm. In this way, the secondary node can select a security algorithm whose key length matches (or is consistent with) the key length of the first security algorithm. Furthermore, when the primary node and the secondary node protect the data transmitted between the terminal device and the secondary node based on their respective selected security algorithms, the security of the communication system is achieved. Furthermore, the key length of the security algorithm selected by the secondary node can be the same as the key length of the first security algorithm. In the scenario where the terminal device uses a data redundancy transmission service, this meets the security assumption of data redundancy transmission.
  • the node request when the key length of the first security algorithm is a preset key length, the node request includes information about the key length of the first security algorithm.
  • a triggering condition is provided where the node request includes information about the key length of the first security algorithm, namely, the key length of the first security algorithm is a preset key length. It will be appreciated that when the key length of the first security algorithm is less than the preset key length, it is not necessary to include the key length information of the first security algorithm in the node request, thereby reducing the number of bits occupied during signaling exchanges.
  • the primary node when the primary node obtains information about security algorithms supported by the secondary node, the primary node may be pre-configured with information about security algorithms supported by the secondary node; or the primary node may obtain information about security algorithms supported by the secondary node from the secondary node.
  • a method is provided for the primary node to obtain information about security algorithms supported by the secondary nodes, so that the primary node can determine the first security algorithm based on the information about security algorithms supported by the secondary nodes.
  • the primary node determines a first security algorithm based on information about security algorithms supported by the secondary node when determining that a redundancy condition is met.
  • the redundancy condition includes one or more of the following conditions 1 to 4: condition 1, the terminal device uses a data redundancy transmission (such as URLLC) service; condition 2, a redundant user plane path is established for the terminal device; condition 3, a redundant PDU session is established for the terminal device; or condition 4, redundant transmission is implemented for the terminal device.
  • the master node is provided with a trigger condition for considering the information of the security algorithm supported by the secondary node when determining the first security algorithm. That is, the above method is executed when it is determined that the redundancy condition is met to avoid unnecessary actions of the master node.
  • the security algorithm information includes information about the key length of the security algorithm.
  • the primary node may specifically determine the first security algorithm based on the information about the key length of the security algorithm supported by the secondary node and the information about the security algorithms supported by the primary node.
  • the primary node determines the maximum key length supported by the secondary node based on information about the key length of the security algorithm supported by the secondary node, and determines the first security algorithm based on information about the maximum key length supported by the secondary node and the security algorithm supported by the primary node.
  • the primary node when determining the first security algorithm, the primary node considers the key length of the security algorithm supported by the secondary node. This allows each primary and secondary node to determine an appropriate security algorithm, ensuring that the security strength of data transmitted between the primary node and the terminal device matches that of data transmitted between the secondary node and the terminal device, thus meeting the requirements for secure communication. Furthermore, in scenarios where the terminal device uses data redundancy transmission services, the security assumption of data redundancy transmission is met.
  • the security algorithm information includes a security algorithm identifier.
  • the primary node may specifically determine the first security algorithm and the second security algorithm based on the security algorithm identifier supported by the secondary node and the security algorithm information supported by the primary node, where the second security algorithm is a security algorithm used to protect data transmitted between the secondary node and the terminal device. Furthermore, the primary node sends the identifier of the second security algorithm to the secondary node.
  • the master node not only independently determines the first security algorithm but also selects the second security algorithm for the slave node. This ensures that the security strength of data transmitted between the master node and the terminal device is consistent with the security strength of data transmitted between the slave node and the terminal device.
  • the master node can ensure that the key length of the first security algorithm is the same as the key length of the second security algorithm, thereby ensuring the security of the communication system. In scenarios where terminal devices use data redundancy transmission services, this meets the security assumptions of data redundancy transmission.
  • the present application provides a communication method that can be performed by a first communication device, which can serve as a master node of a terminal device in dual connectivity mode.
  • the first communication device can be a wireless access node or a component (such as a chip) in a wireless access node.
  • the master node uses the master node as an example.
  • the method includes: the master node determines a first security algorithm, wherein the first security algorithm is a security algorithm for protecting data transmitted between the master node and the terminal device.
  • the master node sends a node request to the slave node, the node request is used to request the addition of the slave node, and the node request includes information on the key length of the first security algorithm.
  • the information on the key length of the first security algorithm may have one or more of the following functions: used by the slave node to determine whether the key length of the first security algorithm is supported, used by the slave node to determine the second security algorithm, used by the slave node to determine whether the key length of the second security algorithm matches the key length of the first security algorithm, or used by the slave node to determine what type of node response to send to the master node.
  • the second security algorithm is a security algorithm determined by the slave node to protect data transmitted between the slave node and the terminal device; the node response is used to indicate a failure to add the slave node, or the node response is used to indicate a success in adding the slave node.
  • the primary node may also receive a node response from the secondary node, where the node response indicates that adding the secondary node failed. Furthermore, the primary node reselects a secondary node and sends a node request to the reselected secondary node. Optionally, the primary node also receives a node response from the reselected secondary node, where the node response indicates that adding the secondary node was successful.
  • the primary node determines a secondary node that can be successfully added by sending a node request to the secondary node and receiving a node response from the secondary node.
  • the successfully added secondary node can meet the following conditions: the primary node and the secondary node can each determine an appropriate security algorithm, so that the security strength of the data transmitted between the primary node and the terminal device is consistent with the security strength of the data transmitted between the secondary node and the terminal device, thereby meeting the requirements of secure communication.
  • the secondary node added according to the solution of this application can ensure that the key length of the security algorithm selected by the primary node and the secondary node is the same.
  • the two redundant PDU sessions of the terminal device are used to transmit the service data.
  • the data corresponding to the two PDU sessions are protected by the primary node and the secondary node respectively using the selected security algorithms.
  • the key lengths of the two security algorithms are the same, which meets the security assumption of data redundant transmission.
  • the primary node sends a node request including information about the key length of the first security algorithm to the secondary node when determining that a redundancy condition is met.
  • the redundancy condition includes one or more of the following conditions 1 to 4: condition 1, the terminal device uses a data redundancy transmission (such as URLLC) service; condition 2, a redundant user plane path is established for the terminal device; condition 3, a redundant PDU session is established for the terminal device; or condition 4, redundant transmission is implemented for the terminal device.
  • a trigger condition is provided in which the node request includes information on the key length of the first security algorithm. That is, the above method is executed when it is determined that the redundancy condition is met, thereby avoiding unnecessary actions of the master node.
  • the node request when the key length of the first security algorithm is a preset key length, the node request includes information about the key length of the first security algorithm.
  • the preset key length is, for example, 256 bits.
  • a further triggering condition for providing the node request with information about the key length of the first security algorithm is that the key length of the first security algorithm is a preset key length. It will be appreciated that when the key length of the first security algorithm is less than the preset key length, it is not necessary to include the key length information of the first security algorithm in the node request, thereby reducing the number of bits occupied during signaling exchanges.
  • the present application provides a communication method that can be performed by a second communication device, which can serve as a secondary node of a terminal device in dual connectivity mode.
  • the second communication device can be a wireless access node or a component (such as a chip) in a wireless access node.
  • the following description uses the secondary node as an example.
  • the method includes: a secondary node receiving a node request from a primary node, the node request being used to request adding the secondary node, the node request including information about a key length of a first security algorithm, the first security algorithm being a security algorithm used to protect data transmitted between the primary node and a terminal device.
  • the secondary node determining, based on the information about the key length of the first security algorithm, a second security algorithm, the second security algorithm being a security algorithm used to protect data transmitted between the secondary node and the terminal device.
  • the key length of the second security algorithm is the same as the key length of the first security algorithm.
  • the present application provides a communication method that can be performed by a second communication device, which can serve as a secondary node of a terminal device in dual connectivity mode.
  • the second communication device can be a wireless access node or a component (such as a chip) in a wireless access node.
  • the following description uses the secondary node as an example.
  • the secondary node may further determine whether the secondary node and/or the terminal device supports the second security algorithm. Exemplarily, the secondary node further obtains the security algorithms supported by the terminal device from the node request, and further determines that the security algorithms supported by the terminal device include the second security algorithm.
  • the secondary node may further send a node response to the primary node.
  • the node response is used to indicate that the secondary node is successfully added.
  • the node response does not carry an identifier of the second security algorithm.
  • the present application provides a communication method that can be performed by a second communication device, which can serve as a secondary node of a terminal device in dual connectivity mode.
  • the second communication device can be a wireless access node or a component (such as a chip) in a wireless access node.
  • the following description uses the secondary node execution as an example.
  • the method includes: the secondary node receives a node request, the node request is used to request to add a secondary node, the node request includes information on the key length of a first security algorithm, and the first security algorithm is a security algorithm used to protect data transmitted between the primary node and the terminal device.
  • the secondary node When the secondary node determines that it does not support the key length of the first security algorithm, it sends a node response to the primary node, where the node response is used to indicate that adding the secondary node fails; or
  • the secondary node selects the second security algorithm, and when the key length of the first security algorithm is different from the key length of the second security algorithm, sends a node response to the primary node, where the node response is used to indicate that adding the secondary node has failed; or
  • the secondary node selects the second security algorithm, and when the key length of the first security algorithm is the same as the key length of the second security algorithm, sends a node response to the primary node, where the node response is used to indicate that the secondary node is successfully added; or,
  • the secondary node selects a second security algorithm based on the key length of the first security algorithm and sends a node response to the primary node.
  • the node response is used to indicate that the secondary node is added successfully, wherein the key length of the first security algorithm is the same as the key length of the second security algorithm.
  • an embodiment of the present application provides a communication device, which has the function of implementing the first aspect or any possible implementation of the first aspect, or the function of the first communication device in the second aspect or any possible implementation of the second aspect, or the function of the first communication device in the third aspect or any possible implementation of the third aspect, or the function of the second communication device in the fourth aspect or any possible implementation of the fourth aspect, or the function of the second communication device in the fifth aspect or any possible implementation of the fifth aspect, or the function of the second communication device in the sixth aspect or any possible implementation of the sixth aspect.
  • the first communication device may serve as a primary node for a terminal device in dual connectivity mode.
  • the first communication device may be a wireless access node or a component (such as a chip) in a wireless access node.
  • the second communication device may serve as a secondary node for a terminal device in dual connectivity mode.
  • the second communication device may be a wireless access node or a component (such as a chip) in a wireless access node.
  • the functions of the above-mentioned communication device can be implemented by hardware, or by hardware executing corresponding software.
  • the hardware or software includes one or more modules, units or means corresponding to the above-mentioned functions.
  • the structure of the device includes a processing module and a transceiver module.
  • the processing module is configured to support the device to implement the method of the first communication device in the above-mentioned first aspect or any possible implementation of the first aspect, or the method of the first communication device in the above-mentioned second aspect or any possible implementation of the second aspect, or the method of the first communication device in the above-mentioned third aspect or any possible implementation of the third aspect, or the method of the second communication device in the above-mentioned fourth aspect or any possible implementation of the fourth aspect, or the method of the second communication device in the above-mentioned fifth aspect or any possible implementation of the fifth aspect, or the method of the second communication device in the above-mentioned sixth aspect or any possible implementation of the sixth aspect.
  • the device structure includes a processor and may also include a memory.
  • the processor is coupled to the memory and is configured to execute computer program instructions stored in the memory to cause the device to implement the method of the first communication device described in the first aspect or any possible implementation of the first aspect, or the method of the first communication device described in the second aspect or any possible implementation of the second aspect, or the method of the first communication device described in the third aspect or any possible implementation of the third aspect, or the method of the second communication device described in the fourth aspect or any possible implementation of the fourth aspect, or the method of the second communication device described in the fifth aspect or any possible implementation of the fifth aspect, or the method of the second communication device described in the sixth aspect or any possible implementation of the sixth aspect.
  • the device also includes a communication interface, and the processor is coupled to the communication interface.
  • the communication interface may be a transceiver or an input/output interface; when the device is a chip included in the wireless access node, the communication interface may be the chip's input/output interface.
  • the transceiver may be a transceiver circuit, and the input/output interface may be an input/output circuit.
  • an embodiment of the present application provides a chip system, including:
  • a processor and a memory the processor is coupled to the memory, the memory is used to store programs or instructions, and when the programs or instructions are executed by the processor, the chip system implements the method of the first communication device in the above-mentioned first aspect or any possible implementation of the first aspect, or, the method of the first communication device in the above-mentioned second aspect or any possible implementation of the second aspect, or, the method of the first communication device in the above-mentioned third aspect or any possible implementation of the third aspect, or, the method of the second communication device in the above-mentioned fourth aspect or any possible implementation of the fourth aspect, or, the method of the second communication device in the above-mentioned fifth aspect or any possible implementation of the fifth aspect, or, the method of the second communication device in the above-mentioned sixth aspect or any possible implementation of the sixth aspect.
  • the chip system further includes an interface circuit for transmitting interactive code instructions to the processor.
  • the chip system may include one or more memories.
  • the memory may be integrated with the processor or provided separately from the processor.
  • the memory may be a non-transient processor, such as a read-only memory (ROM), which may be integrated with the processor on the same chip or provided on separate chips.
  • ROM read-only memory
  • the present application provides a computer-readable storage medium, which stores a computer program or instruction.
  • the communication device implements the method of the first communication device in the above-mentioned first aspect or any possible implementation of the first aspect, or the method of the first communication device in the above-mentioned second aspect or any possible implementation of the second aspect, or the method of the first communication device in the above-mentioned third aspect or any possible implementation of the third aspect, or the method of the second communication device in the above-mentioned fourth aspect or any possible implementation of the fourth aspect, or the method of the second communication device in the above-mentioned fifth aspect or any possible implementation of the fifth aspect, or the method of the second communication device in the above-mentioned sixth aspect or any possible implementation of the sixth aspect.
  • the present application provides a computer program product, which includes a computer program or instructions.
  • the computer program or instructions When executed by a communication device, it implements the method of the first communication device in the above-mentioned first aspect or any possible implementation of the first aspect, or the method of the first communication device in the above-mentioned second aspect or any possible implementation of the second aspect, or the method of the first communication device in the above-mentioned third aspect or any possible implementation of the third aspect, or the method of the second communication device in the above-mentioned fourth aspect or any possible implementation of the fourth aspect, or the method of the second communication device in the above-mentioned fifth aspect or any possible implementation of the fifth aspect, or the method of the second communication device in the above-mentioned sixth aspect or any possible implementation of the sixth aspect.
  • an embodiment of the present application provides a communication system, the communication system comprising:
  • the first communication device in the second aspect or any possible implementation of the second aspect and the second communication device in the fourth aspect or any possible implementation of the fourth aspect; or
  • the first communication device in the second aspect or any possible implementation of the second aspect and the second communication device in the fifth aspect or any possible implementation of the fifth aspect; or
  • the first communication device in the third aspect or any possible implementation of the third aspect and the second communication device in the sixth aspect or any possible implementation of the sixth aspect.
  • FIG2 is a schematic diagram of a key derivation architecture in a 5G system
  • FIG3 is a schematic diagram of a user plane path of a URLLC service
  • FIG4 is a flow chart of the first communication method provided by this application.
  • FIG5 is a flow chart of a second communication method provided in this application.
  • FIG6 is a flow chart of a third communication method provided by the present application.
  • FIG7 is a flow chart of a fourth communication method provided by the present application.
  • FIG8 is a schematic diagram of a flow chart of a fifth communication method provided in this application.
  • FIG9 is a schematic flow chart of a first determination method for a secondary node in the fifth communication method provided by this application.
  • FIG11 is a schematic flow chart of a third method for determining a secondary node in the fifth communication method provided by this application.
  • FIG12 is a schematic diagram of a process for a master node to determine whether a redundancy condition is satisfied, provided by the present application;
  • FIG13 is a schematic structural diagram of a communication device provided by the present application.
  • FIG14 is a schematic structural diagram of another communication device provided in this application.
  • Figure 1 shows a schematic diagram of a 5G network architecture.
  • the 5G network architecture shown in Figure 1 can be divided into three parts: the terminal device part, the data network (DN), and the operator network part. The following briefly describes the functions of some of these network elements.
  • the operator network may include one or more of the following network elements (or equipment, functions, nodes): radio access node (RAN), authentication server function (AUSF), network exposure function (NEF), policy control function (PCF), unified data management (UDM), unified data repository (UDR), network repository function (NRF), access and mobility management function (AMF), session management function (SMF), user plane function (UPF), application function (AF), etc.
  • RAN radio access node
  • AUSF authentication server function
  • NEF network exposure function
  • PCF policy control function
  • UDM unified data management
  • UDR unified data repository
  • NRF network repository function
  • AMF access and mobility management function
  • SMF session management function
  • UPF user plane function
  • AF application function
  • a terminal device also known as user equipment (UE) is a device with wireless transceiver capabilities. It can be deployed on land, indoors or outdoors, handheld or vehicle-mounted; on water (such as ships); or in the air (such as on airplanes, balloons, and satellites). Terminal devices can be mobile phones, tablets, computers with wireless transceiver capabilities, virtual reality (VR) terminals, augmented reality (AR) terminals, wireless terminals used in industrial control, wireless terminals used in self-driving, wireless terminals used in remote medicine, wireless terminals used in smart grids, wireless terminals used in transportation safety, wireless terminals used in smart cities, and wireless terminals used in smart homes.
  • VR virtual reality
  • AR augmented reality
  • the above-mentioned terminal device can establish a connection with the operator network through the interface provided by the operator network (such as N1, etc.), and use the data and/or voice services provided by the operator network.
  • the terminal device can also access the DN through the operator network, use the operator services deployed on the DN, and/or services provided by a third party.
  • the above-mentioned third party may be a service provider other than the operator network and the terminal device, and can provide data and/or voice services to the terminal device.
  • the specific form of the above-mentioned third party can be determined according to the actual application scenario and is not limited here.
  • a wireless access node provides network access for authorized terminal devices in a specific area and can utilize transmission tunnels with varying qualities of service (QoS) based on the terminal device's level and service requirements.
  • QoS qualities of service
  • a wireless access node manages wireless resources, provides access services to terminal devices, and forwards control signals and data between the terminal device and the core network.
  • a wireless access node can also be understood as a base station in a traditional network.
  • a wireless access node can be any communication device with wireless transceiver capabilities used to communicate with terminal devices.
  • Such a wireless access node includes, but is not limited to, an evolved Node B (eNB), a gNB in a 5G system, a transmission point (TRP or TP), or one or a group of antenna panels (including multiple antenna panels) of a base station in a 5G system. It can also be a network node that constitutes a gNB or a transmission point, such as a baseband unit (BBU) or a distributed unit (DU). It can also be a pole site, micro base station, macro base station, integrated access and backhaul (IAB) node, etc.
  • eNB evolved Node B
  • TRP or TP transmission point
  • DU distributed unit
  • IAB integrated access and backhaul
  • the core network part includes user plane functions and control plane functions.
  • User plane functions include the UPF. As the interface with the data network, the UPF performs functions such as user plane data forwarding (such as packet data), quality of service (QoS) control, session/flow-level billing and statistics, and bandwidth limiting.
  • user plane data forwarding such as packet data
  • QoS quality of service
  • session/flow-level billing and statistics such as bandwidth limiting.
  • the control plane functions mainly carry out user registration and authentication, mobility management, and delivery of data packet forwarding policies and QoS control policies to the user plane functions.
  • the control plane functions can be further refined to include other network elements besides the UPF, such as the AMF and SMF.
  • the AMF primarily handles user registration, location management, and access authentication/authorization during user mobility. It is also responsible for communicating user policies between terminal devices and the PCF.
  • SMF is mainly responsible for establishing corresponding session connections when users initiate services and providing specific services to users, such as sending data packet forwarding strategies and QoS strategies to UPF based on the NG4 interface between SMF and UPF.
  • AUSF is mainly responsible for authenticating users and determining the legitimacy of terminal devices to determine whether the terminal devices are allowed to access the network.
  • UDM is mainly responsible for storing the contract data of terminal devices, user access authorization and other functions.
  • UDR is mainly responsible for the storage and access of contract data, policy data, application data and other types of data.
  • PCF is mainly responsible for issuing business-related policies to AMF or SMF.
  • NEF is mainly used to support the opening of capabilities and events.
  • the AF primarily communicates application-side requirements for the network to the PCF, enabling the PCF to generate corresponding policies.
  • the AF can be a third-party functional entity or an application service deployed by an operator, such as the Internet Protocol (IP) Multimedia Subsystem (IMS) voice call service.
  • IP Internet Protocol
  • IMS Internet Multimedia Subsystem
  • NRF can be used to provide network element discovery capabilities, providing network element information corresponding to the network element type based on requests from other network elements. NRF also provides network element management services such as network element registration, update, and deregistration, as well as network element status subscription and push.
  • a DN is a network located outside of a carrier network.
  • a carrier network can connect to multiple DNs, and a variety of services can be deployed on the DN, providing data and/or voice services to terminal devices.
  • a DN is the private network of a smart factory.
  • Sensors installed in the workshop can be terminal devices, and the DN contains a control server for the sensors, which can provide services to the sensors.
  • the sensors can communicate with the control server, receive instructions from the control server, and transmit collected sensor data to the control server according to the instructions.
  • Another example is a DN that is a company's internal office network.
  • An employee's mobile phone or computer can be a terminal device, allowing them to access information and data resources on the company's internal office network.
  • Nnssf, Nausf, Nnef, Nnrf, Npcf, Nudm, Naf, Namf, Nsmf, N1, N2, N3, N4, and N6 are interface sequence numbers. The meanings of these interface sequence numbers are defined in the 3rd Generation Partnership Project (3GPP) protocol and are not limited here.
  • the above-mentioned network element can be a network component in a hardware device, a software function running on dedicated hardware, or a virtualized function instantiated on a platform (e.g., a cloud platform).
  • a platform e.g., a cloud platform
  • the above-mentioned network element can be implemented by a single device, or by multiple devices, or can be a functional module within a single device, and this embodiment of the present application does not specifically limit this.
  • the network elements involved in the embodiments of the present application may be the AMF, AUSF, UDM, etc. in Figure 1, or they may be network elements having the functions of the above-mentioned AMF, AUSF, UDM, etc. in future communications such as the sixth generation (6G) network, and the embodiments of the present application are not limited to this.
  • 6G sixth generation
  • Security algorithms also known as cryptographic algorithms are the security foundation of communication systems and are widely used in mobile communication network systems.
  • Security algorithms are generally divided into symmetric security algorithms and asymmetric security algorithms.
  • symmetric security algorithms may include symmetric encryption algorithms, hash algorithms, integrity protection algorithms (such as medium access control (MAC), hash-based message authentication code (hash MAC, HMAC)), etc.).
  • Asymmetric security algorithms may include asymmetric encryption algorithms, digital signature algorithms, key exchange algorithms, etc.
  • asymmetric security algorithms are mainly used for identity authentication, key negotiation, and key establishment of two or more interacting parties in the early stages of system establishment. After the key is established, the two or more interacting parties can use the symmetric security algorithm to securely protect the information exchanged between the two or more parties based on the established key.
  • symmetric security algorithms used for signaling and data protection between terminal devices and networks include the Advanced Encryption Standard (AES), SNOW3G, and the Zu Chongzhi algorithm (ZUC). These symmetric security algorithms currently use a 128-bit key length (collectively referred to as 128-bit algorithms).
  • 128-bit algorithms are at risk of being cracked by quantum computers.
  • Grover's algorithm can reduce the difficulty of brute force cracking from N attempts to N 1/2 attempts, thus reducing the security of 128-bit encryption (key space) to 64 bits.
  • industry cryptography experts recommend upgrading symmetric security algorithms from 128-bit to 256-bit algorithms. In other words, using symmetric security algorithms with a 256-bit key length to protect data.
  • the key derivation architecture in the 5G system is shown in Figure 2.
  • the universal subscriber identity module (USIM) card and UDM (or authentication credential repository and processing function, ARPF) side of the terminal device store the long-term key K of the terminal device.
  • USIM universal subscriber identity module
  • ARPF authentication credential repository and processing function
  • the terminal device derives the CK and IK based on the terminal device's long-term key K.
  • the AUSF key (K AUSF ) and SEAF key (K SEAF ) are then derived from the concatenation of the CK and IK.
  • the terminal device then derives the AMF key (K AMF ) from the SEAF key.
  • the terminal device further derives the non-access stratum (NAS) key (K NAS ) and gNB key (K gNB ) based on the AMF key.
  • the gNB key is used by the terminal device to generate access stratum (AS) keys.
  • the AS keys include the radio resource control (RRC) key (K RRC ) and the user plane (UP) key (K UP ).
  • the UDM derives the AUSF key based on the concatenation of the CK and the IK and provides it to the AUSF.
  • the AUSF derives the SEAF key based on the AUSF key and provides it to the SEAF.
  • the SEAF derives the AMF key based on the SEAF key and provides it to the AMF.
  • the AMF derives the NAS key, the non-3GPP interworking function (N3IWF) key, and the gNB key based on the AMF key.
  • the AMF provides the N3IWF key to the N3IWF.
  • the N3IWF key is used to protect subsequent non-3GPP access data traffic.
  • the AMF also provides the gNB key and next hop (NH) parameters to the gNB.
  • the gNB generates RRC keys and user plane keys based on the gNB key and NH parameters.
  • RRC keys include an RRC encryption key (K RRCenc ) and an RRC integrity protection key (K RRCint ).
  • User plane keys include a user plane encryption key (K UPenc ) and a user plane integrity protection key (K UPint ).
  • the user plane encryption key is used by the terminal device and gNB to encrypt and protect the user data
  • the user plane integrity protection key is used by the terminal device and gNB to protect the integrity of the user data.
  • the security capabilities of a terminal device include the security algorithms supported by the terminal device.
  • the security algorithms supported by the terminal device are used in the algorithm negotiation of the mobile communication network: the terminal device reports the security algorithms supported by the terminal device to the network side, and the network side selects a security algorithm supported by both the network side and the terminal device and with a higher priority based on the priority of the local security algorithm and the security algorithms supported by the terminal device.
  • the AMF on the network side determines the NAS security algorithm to protect the NAS messages between the terminal device and the AMF;
  • the wireless access node on the network side determines the AS security algorithm to protect the AS messages between the terminal device and the wireless access node.
  • the key length of the security algorithm supported by the terminal device can be 128 bits, and in future communications, it may support security algorithms with a key length of 256 bits or even 512 bits.
  • Dual connectivity is an operating mode for a terminal device in the RRC connected state.
  • the terminal device is simultaneously connected to two different radio access nodes (RANs).
  • RANs radio access nodes
  • These two RAPs can be of the same or different communication standards.
  • the RAP whose control plane is connected to the core network is called the master node (MN), while the RAP whose control plane is not connected to the core network is called the secondary node (SN), which is also called a slave node.
  • MN master node
  • SN secondary node
  • the advantages of dual connectivity are: (1) The wireless resources provided by a single wireless access node are relatively limited. If a terminal device can connect to two wireless access nodes at the same time, it can utilize the wireless resources of both wireless access nodes, effectively improving throughput. (2) There may be wireless access nodes of different communication standards in the network (such as a 4G wireless access node and a 5G wireless access node). If a terminal device can connect to two wireless access nodes of different communication standards, it can flexibly adapt to the networking environment.
  • the primary node can obtain the security algorithms supported by the terminal device and, based on the security algorithms supported by the terminal device, the security algorithms supported by the primary node, and the priority of the security algorithms supported by the primary node, select a security algorithm (denoted as security algorithm A) and send the identifier of security algorithm A to the terminal device. Furthermore, the primary node can also send the security algorithms supported by the terminal device to the secondary node. Correspondingly, the secondary node selects a security algorithm (denoted as security algorithm B) based on the security algorithms supported by the terminal device, the security algorithms supported by the secondary node, and the priority of the security algorithms supported by the secondary node.
  • a security algorithm denoted as security algorithm A
  • the secondary node sends the identifier of security algorithm B to the primary node, which then sends the identifier of security algorithm B to the terminal device.
  • the secondary node sends the identifier of security algorithm B to the primary node, which then sends the identifier of security algorithm B to the terminal device.
  • the terminal device can establish two protocol data unit (PDU) sessions on the 5G network.
  • the user plane paths corresponding to these two PDU sessions are separated.
  • Figure 3 shows a schematic diagram of the user plane path for a URLLC service.
  • the user plane corresponding to one PDU session passes through the primary node and UPF1, while the user plane corresponding to the other PDU session passes through the secondary node and UPF2.
  • UPF1 and UPF2 are connected to the same DN.
  • the data transmitted in these two PDU sessions meets the security assumption of data redundancy transmission, that is, the transmitted data is identical and the key length of the security algorithm used for data transmission is the same.
  • the primary node may choose to use a security algorithm with a key length of 256 bits (i.e., a 256-bit algorithm) to transmit data with the terminal device, while the secondary node may choose to use a security algorithm with a key length of 128 bits (i.e., a 128-bit algorithm) to transmit data with the terminal device, which results in the key lengths of the security algorithms corresponding to the two sessions being different, which does not meet the security assumptions of data redundancy transmission (such as URLLC) services in the dual-connection mode.
  • the primary node may choose to use a security algorithm with a key length of 256 bits (i.e., a 256-bit algorithm) to transmit data with the terminal device
  • the secondary node may choose to use a security algorithm with a key length of 128 bits (i.e., a 128-bit algorithm) to transmit data with the terminal device, which results in the key lengths of the security algorithms corresponding to the two sessions being different, which does not meet the security assumptions of data redund
  • this application provides five communication methods for achieving communication system security in scenarios where the communication system needs to support both 128-bit and 256-bit algorithms. Furthermore, when a terminal device uses the data redundancy transmission service in dual-connection mode, the key lengths of the security algorithms corresponding to the two PDU sessions of the terminal device are the same, meeting the security assumption of data redundancy transmission.
  • the five communication methods can all be executed by the first communication device and the second communication device.
  • the first communication device and the second communication device may serve as the primary node and secondary node, respectively, of a terminal device in dual-connectivity mode.
  • the first communication device may be a wireless access node or a component (e.g., a chip) within a wireless access node
  • the second communication device may be a wireless access node or a component (e.g., a chip) within a wireless access node.
  • the following descriptions use primary and secondary nodes.
  • a security algorithm may also be referred to as a cryptographic algorithm, a security protection algorithm, a protection algorithm, etc.
  • the security algorithm may be a symmetric cryptographic algorithm.
  • the security algorithm may be an integrity protection algorithm, or an encryption algorithm, or the security algorithm may include an integrity protection algorithm and an encryption algorithm, or the security algorithm may be an authenticated encryption with associated data (AEAD) algorithm, which corresponds to an AEAD mode, that is, when a primary node (or secondary node) and a terminal device transmit data, the AEAD algorithm is used for both integrity protection and encryption protection of the data.
  • AEAD authenticated encryption with associated data
  • the key length of a security algorithm can be used to indicate the protection strength of the security algorithm for data, wherein the longer the key length of the security algorithm, the stronger the protection strength of the security algorithm for data. For example, if the key length of security algorithm 1 is 256 bits and the key length of security algorithm 2 is 128 bits, then the protection strength of security algorithm 1 for data is higher (or stronger) than the protection strength of security algorithm 2 for data.
  • the key length of a security algorithm can also be used to indicate the algorithm strength of a security algorithm, wherein the longer the key length of a security algorithm, the stronger the algorithm strength of the security algorithm.
  • the algorithm strength of security algorithm 1 is higher (or stronger) than the algorithm strength of security algorithm 2.
  • the key length of a security algorithm can be referred to as the protection strength of a security algorithm or the algorithm strength of a security algorithm.
  • the key length of a security algorithm can be, for example, 512 bits, 256 bits, or 128 bits.
  • Security algorithms can also be classified according to their key length, i.e., security algorithms corresponding to a 512-bit key length are classified into one category, security algorithms corresponding to a 256-bit key length are classified into another category, and security algorithms corresponding to a 128-bit key length are classified into another category.
  • the key length of a security algorithm can also be referred to as the category or classification of the security algorithm.
  • the key length of a security algorithm can also be referred to as the key length used by the security algorithm, the key length input to the security algorithm, or the key length corresponding to (or associated with) the security algorithm.
  • a primary node selects a secondary node that supports a first security algorithm key length based on the key length of the first security algorithm, and then requests to add the secondary node.
  • the first security algorithm is a security algorithm used to protect data transmitted between the primary node and the terminal device.
  • the secondary node determines a second security algorithm used to protect data transmitted between the secondary node and the terminal device.
  • the primary node selects a secondary node based on a security algorithm supported by the primary node and then requests to add the secondary node.
  • the key length of the security algorithm supported by the secondary node must be no less than the maximum key length of the security algorithm supported by the primary node.
  • the secondary node determines a second security algorithm for protecting data transmitted between the secondary node and the terminal device.
  • the primary node first identifies a secondary node and, based on information about security algorithms supported by the secondary node, determines a first security algorithm for protecting data transmitted between the primary node and the terminal device.
  • the information about security algorithms supported by the secondary node includes information about key lengths and/or identifiers of security algorithms supported by the secondary node.
  • the primary node requests that the secondary node be added.
  • the secondary node determines a second security algorithm for protecting data transmitted between the secondary node and the terminal device.
  • the primary node first identifies the secondary node and, based on the security algorithm information supported by the secondary node, determines a first security algorithm and a second security algorithm.
  • the first security algorithm is used to protect data transmitted between the primary node and the terminal device
  • the second security algorithm is used to protect data transmitted between the secondary node and the terminal device.
  • the information about the security algorithms supported by the secondary node includes the identifiers of the security algorithms supported by the secondary node (or the identifiers of the security algorithms supported by the secondary node and the key lengths of the security algorithms supported by the secondary node).
  • the primary node then requests to add the secondary node and sends the identifier of the second security algorithm to the secondary node.
  • the master node first determines the first security algorithm, which is used to protect data transmitted between the master node and the terminal device.
  • the master node selects a secondary node (denoted as secondary node 1) and requests to add secondary node 1.
  • Secondary node 1 may determine that it does not support the use of a security algorithm with the same length as the first security algorithm and sends an indication to the master node that the addition of secondary node 1 failed.
  • the master node selects a new secondary node (denoted as secondary node 2) and requests to add secondary node 2.
  • Secondary node 2 may determine that it supports the use of a security algorithm with the same length as the first security algorithm and sends an indication to the master node that the addition of secondary node 2 succeeded.
  • FIG4 is a flow chart of the first communication method exemplarily provided in this application.
  • Step 401 The primary node determines a secondary node based on the key length of the first security algorithm and the key length of the security algorithm supported by the candidate node.
  • Candidate nodes include secondary nodes. When there is only one candidate node, the primary node can determine whether it can serve as a secondary node. When there are multiple candidate nodes, the primary node can select a secondary node from among the multiple candidate nodes. For ease of description, the following uses the latter as an example.
  • the key length of the security algorithm supported by the secondary node is not less than the key length of the first security algorithm.
  • the first security algorithm is a security algorithm used to protect data transmitted between the primary node and the terminal device.
  • the primary node may select as the secondary node a candidate node whose supported security algorithm meets the following conditions 1 or 2, or it may be understood that the security algorithm supported by the secondary node may meet the following conditions 1 or 2.
  • the second key length is not less than the key length of the first security algorithm, wherein the second key length is the maximum key length of the security algorithm supported by the secondary node. Exemplarily, the second key length is equal to the key length of the first security algorithm.
  • the key length of the security algorithm supported by a node when the key length of the security algorithm supported by a node (primary node/secondary node) includes key length 1, the key length of the security algorithm supported by the node also includes key length 2, wherein key length 1 is higher than (or greater than) key length 2. For example, if the key length of the security algorithm supported by a node includes 256 bits, then the key length of the security algorithm supported by the node also includes 128 bits.
  • the security algorithms supported by the master node include security algorithm 1 to security algorithm 3, the key length of security algorithm 1 is 256 bits, and the key lengths of security algorithm 2 and security algorithm 3 are both 128 bits.
  • the multiple alternative nodes include alternative node 1 to alternative node 3, wherein the maximum key length of the security algorithm supported by alternative node 1 is 256 bits, and the maximum key length of the security algorithm supported by alternative node 2 and alternative node 3 is 128 bits.
  • Condition 2 The key length of the security algorithm supported by the secondary node includes the key length of the first security algorithm.
  • the security algorithms supported by the master node include security algorithm 1 to security algorithm 3, the key length of security algorithm 1 is 256 bits, and the key lengths of security algorithm 2 and security algorithm 3 are both 128 bits.
  • the multiple alternative nodes include alternative node 1 to alternative node 3, wherein the key length of the security algorithm supported by alternative node 1 is 256 bits, the key length of the security algorithm supported by alternative node 2 is 128 bits, and the key lengths of the security algorithm supported by alternative node 3 are 256 bits and 128 bits.
  • the master node may select alternative node 1 or alternative node 3 as the auxiliary node.
  • the master node may select alternative node 2 or alternative node 3 as the auxiliary node.
  • condition 1 the logic of the primary node in selecting the secondary node is similar.
  • condition 1 takes condition 1 as an example.
  • the master node may obtain information about the key length of the security algorithm supported by the candidate node.
  • the candidate node may support multiple security algorithms, which may correspond to multiple key lengths, wherein a key length may correspond to one or more security algorithms.
  • the candidate node may support the multiple key lengths.
  • the information about the key lengths of the security algorithms supported by the candidate node may be identifiers of multiple key lengths of multiple security algorithms supported by the candidate node (which may be referred to as identifiers of multiple key lengths supported by the candidate node).
  • the key length of security algorithm 1 is 256 bits
  • the key lengths of security algorithms 2 and 3 are both 128 bits. If the candidate node supports security algorithms 1 to 3, then the information about the key lengths of the security algorithms supported by the candidate node is 256 bits and 128 bits.
  • the key length information of the security algorithm supported by the candidate node may be an identifier of the maximum key length among multiple key lengths supported by the candidate node (which may be simply referred to as the identifier of the maximum key length supported by the candidate node).
  • the key length of security algorithm 1 is 256 bits
  • the key lengths of security algorithms 2 and 3 are both 128 bits. If the candidate node supports security algorithms 1 through 3, then the key length information of the security algorithms supported by the candidate node is 256 bits.
  • the information on the key length of the security algorithm supported by the alternative node may be an indication of whether the alternative node supports a preset key length.
  • the indication may occupy one bit. When the value of the indication is 1, it indicates that the alternative node supports the preset key length. When the value of the indication is 0, it indicates that the alternative node does not support the preset key length.
  • the preset key length may be 256 bits or 128 bits. For example, the preset key length is 256 bits, the key length of security algorithm 1 is 256 bits, and the key lengths of security algorithm 2 and security algorithm 3 are both 128 bits.
  • the alternative node supports security algorithms 1 to 3, then the information on the key length of the security algorithm supported by the alternative node is an indication with a value of 1; if the alternative node only supports security algorithm 3, then the information on the key length of the security algorithm supported by the alternative node is an indication with a value of 0.
  • the "identification of the key length supported by the candidate node” is equivalent to the "identification of the maximum key length supported by the candidate node.”
  • the identification of the maximum key length supported by the candidate node is used as an example. This description also applies to other embodiments.
  • the information on the key length of the security algorithm supported by the alternative node may also be the identifiers of multiple security algorithms supported by the alternative node, where the identifier of each security algorithm includes the identifier of the key length of the security algorithm.
  • the identifier of the security algorithm is "128-NEA2", and the key length is 128, where NEA2 refers to the SNOW3G encryption algorithm.
  • the identifier of the key length can be not only a specific value of the key length (such as 256 bits or 128 bits), but also other pre-agreed identifiers used to indicate the key length.
  • the identifier of the key length is identifier A or identifier B, identifier A is used to indicate 256 bits, and identifier B is used to indicate 128 bits.
  • the identifier of the key length is the value of a preset bit. When the preset bit value is 1, it is used to indicate 256 bits, and when the preset bit value is 0, it is used to indicate 128 bits. The following examples are all given with specific values of the key length.
  • the master node can obtain information about the key length of the security algorithm supported by the candidate node through the following acquisition method 1 or acquisition method 2.
  • Acquisition method 1 Information about the key length of the security algorithm supported by the pre-configured candidate nodes in the master node.
  • the master node includes pre-configuration information, which includes the identifier of the alternative node and the information of the key length of the security algorithm supported by the alternative node.
  • the information of the key length of the security algorithm supported by the alternative node is the identifier of the maximum key length supported by the alternative node
  • the alternative nodes are alternative node 1 to alternative node 3
  • the maximum key length supported by alternative node 1 is 256 bits
  • the maximum key length supported by alternative node 2 is 256 bits
  • the maximum key length supported by alternative node 3 is 128 bits.
  • the pre-configuration information may include the following correspondence: (identifier of alternative node 1 and 256 bits), (identifier of alternative node 2 and 256 bits), (identifier of alternative node 3 and 128 bits).
  • the pre-configured information is configured by a management device (such as an AMF, an operation administration and maintenance (OAM), or an equipment management system (EMS)) or manually.
  • the candidate node may meet one or more of the following conditions: the primary node and the candidate node belong to the same public land mobile network (PLMN), the primary node and the candidate node are located in the same physical area, the signal coverage of the primary node and the candidate node overlap, or the frequency of the primary node and the frequency of the candidate node do not interfere with each other.
  • PLMN public land mobile network
  • Acquisition method 2 The master node obtains information about the key length of the security algorithm supported by the candidate node from the candidate node.
  • the master node includes pre-configuration information, which includes the identifier of the alternative node.
  • the identifier of the alternative node is specifically configured by a management device (such as AMF, OAM or EMS) or manually.
  • the definition of the alternative node can be found in the description of acquisition method 1.
  • the master node sends a security capability request to each candidate node based on the identifier of the candidate node.
  • the security capability request is used to request information about the key lengths of security algorithms supported by the candidate node.
  • the candidate node sends information about the key lengths of security algorithms supported by the candidate node to the master node.
  • the master node may also obtain node information of the candidate node (such as one or more of the candidate node's product serial number, the candidate node's communication standard, and the candidate node's deployment date) through the above-mentioned acquisition method 1 or acquisition method 2. Furthermore, the master node determines information about the key length of the security algorithm supported by the candidate node based on the candidate node information.
  • the node information of the alternative node is the deployment date of the alternative node.
  • the preset rule in the master node is "the maximum key length supported by the alternative nodes with a deployment date on or before January 1, 2024 is 128 bits; the maximum key length supported by the alternative nodes with a deployment date after January 1, 2024 is 256 bits.” If the deployment date of a certain alternative node is March 1, 2024, the master node can determine that the maximum key length supported by the alternative node is 256 bits.
  • the node information of the alternative node is the communication standard of the alternative node.
  • the preset rule in the main node is "the maximum key length supported by alternative nodes below the 5G communication standard is 128 bits; the maximum key length supported by alternative nodes of 5G and above communication standards is 256 bits". If the communication standard of a certain alternative node is 5.5G, the main node can determine that the maximum key length supported by the alternative node is 256 bits.
  • the main node selects a secondary node from the alternative nodes, it can not only consider the key length of the security algorithm supported by the alternative node, but also consider at least one or more of the following: the signal strength of the alternative node received by the terminal device, the usage of the air interface resources of the alternative node, or the priority of the alternative node.
  • the master node may also send a measurement instruction to the terminal device based on the identifier of the candidate node.
  • the measurement instruction includes the identifier of the candidate node and is used to instruct the terminal device to measure the signal strength of the candidate node.
  • the terminal device receives the measurement instruction, measures the signal strength of the candidate node based on the identifier of the candidate node in the measurement instruction, and sends the measurement result to the master node.
  • the measurement result includes the signal strength of the candidate node.
  • the master node selects a secondary node from the candidate nodes based on the signal strength of the candidate node, the usage of air interface resources, and information about the key length of the security algorithm supported by the candidate node.
  • the pre-configuration information of the master node also includes the priority of the candidate node.
  • the master node selects a secondary node from the candidate nodes, it selects the secondary node from the candidate nodes based on the priority of the candidate node and the key length of the security algorithm supported by the candidate node.
  • step 400 may be further included, in which the primary node determines (or selects) the first security algorithm.
  • the master node selects a first security algorithm from the security algorithms supported by the master node based on the priorities of the security algorithms supported by the master node and the security algorithms supported by the terminal device.
  • the master node selects a security algorithm that is supported by both the master node and the terminal device and has a higher priority as the first security algorithm.
  • the master node supports security algorithms 1 to 3, where the priority order of security algorithms 1 to 3 is: security algorithm 1, security algorithm 2, security algorithm 3. If the terminal device supports security algorithms 1 to 2, the master node may determine that the first security algorithm is security algorithm 1.
  • the master node may also first obtain the security algorithms supported by the terminal device.
  • the terminal device sends a registration request to the AMF
  • the registration request carries the security algorithms supported by the terminal device.
  • the AMF sends the security algorithms supported by the terminal device to the master node.
  • the master node is the target node in an Xn handover, and the master node receives the security algorithms supported by the terminal device from the source node.
  • the master node is the target node in an N2 handover, and the master node receives the security algorithms supported by the terminal device from the target AMF.
  • Step 402 The primary node sends a node request to the secondary node.
  • the secondary node receives the node request from the primary node.
  • the node request is used to request the addition of a secondary node.
  • the node request is used to request the node that receives the node request to serve as a secondary node corresponding to the primary node.
  • node 1 receives a node request, and the node request is used to request node 1 to serve as a secondary node corresponding to the primary node.
  • the node request is used to request the node that receives the node request to serve as a secondary node for the URLLC service of the terminal device.
  • node 1 receives a node request, and the node request is used to request node 1 to serve as a secondary node for the URLLC service of the terminal device.
  • the node request includes information about the key length of the first security algorithm.
  • the information about the key length of the first security algorithm can be used by the auxiliary node to determine (or select) a second security algorithm, wherein the second security algorithm is a security algorithm for protecting data transmitted between the auxiliary node and the terminal device.
  • the second security algorithm is a security algorithm for protecting data transmitted between the auxiliary node and the terminal device.
  • the information of the key length of the first security algorithm may be an identifier of the key length of the first security algorithm. For example, if the key length of the first security algorithm is 256 bits, then the information of the key length of the first security algorithm is 256 bits.
  • the information about the key length of the first security algorithm may be an indication of whether the key length of the first security algorithm is a preset key length, where the indication may occupy one bit. When the value of the indication is 1, it indicates that the key length of the first security algorithm is the preset key length; when the value of the indication is 0, it indicates that the key length of the first security algorithm is not the preset key length. For example, if the preset key length is 256 bits and the key length of the first security algorithm is 256 bits, then the information about the key length of the first security algorithm is an indication with a value of 1; if the key length of the first security algorithm is 128 bits, then the information about the key length of the first security algorithm is an indication with a value of 0.
  • the node request may further include a security algorithm supported by the terminal device.
  • the security algorithm supported by the terminal device is used by the secondary node to select a second security algorithm.
  • the node request may further include a node key of the secondary node (e.g., a gNB key).
  • the node key of the secondary node is used by the secondary node to derive the user plane key of the secondary node.
  • the primary node derives the node key of the secondary node based on the node key of the primary node and carries the node key of the secondary node in the node request.
  • the implementation related to FIG4 further includes the following steps 403 and 404.
  • Step 403 The secondary node determines a second security algorithm.
  • the second security algorithm is a security algorithm used to protect data transmitted between the secondary node and the terminal device.
  • the node request includes information about the key length of the first security algorithm.
  • the secondary node After receiving the node request, the secondary node obtains the key length information of the first security algorithm from the node request and, based on the key length information of the first security algorithm, selects a second security algorithm from among the security algorithms supported by the secondary node.
  • the key length of the second security algorithm is equal to the key length of the first security algorithm, and the identifier of the second security algorithm is the same as or different from the identifier of the first security algorithm.
  • the secondary node may also obtain the security algorithms supported by the terminal device from the node request, and determine a second security algorithm from among the security algorithms supported by the secondary node based on the key length of the first security algorithm, the security algorithms supported by the terminal device, and the priority of the security algorithms supported by the secondary node. It will be understood that not only does the key length of the second security algorithm need to be the same as the key length of the first security algorithm, but the second security algorithm also needs to be supported by the terminal device. That is, the security algorithms supported by the terminal device include the second security algorithm, and the second security algorithm is a security algorithm with a higher priority among the multiple security algorithms supported by the secondary node.
  • the terminal device supports security algorithms 1 to 3.
  • the key length of security algorithm 1 is 256 bits, and the key lengths of security algorithms 2 and 3 are both 128 bits.
  • the primary node determines that the first security algorithm is security algorithm 1, and the node request sent to the secondary node includes the key length of the first security algorithm (i.e., 256 bits) and the identifiers of security algorithms 1 to 3 supported by the terminal device.
  • the secondary node supports security algorithm 1 and security algorithm 4, and the priority order of the security algorithms set in the secondary node is: security algorithm 1, security algorithm 4, security algorithm 2, security algorithm 3.
  • the key length of security algorithm 4 is 256 bits.
  • the secondary node obtains the key length of the first security algorithm (i.e., 256 bits) and the identifiers of security algorithms 1 to 3 supported by the terminal device from the node request, and determines that the second security algorithm is security algorithm 1.
  • the node request may not need to carry information about the key length of the first security algorithm.
  • the primary node supports security algorithms 1 to 3
  • the secondary node supports security algorithms 1 and 2
  • the terminal device supports security algorithms 1 and 2, where the key length of security algorithm 1 is 256 bits, and the key lengths of security algorithms 2 and 3 are both 128 bits.
  • the primary node may determine the security algorithm corresponding to the maximum key length supported by the primary node, that is, security algorithm 1, as the first security algorithm, and send a node request to the secondary node, without needing to carry information about the key length of the first security algorithm.
  • the secondary node may determine the security algorithm corresponding to the maximum key length supported by the secondary node, that is, security algorithm 1, as the second security algorithm.
  • the node request does not need to carry information about the key length of the first security algorithm, which are not listed in this application.
  • Step 404 The secondary node transmits data with the terminal device according to the second security algorithm.
  • the secondary node may also send a node response to the primary node, and the node response is used to indicate that the secondary node has been successfully added.
  • the node response includes a success indication (e.g., an acknowledgment (ACK)), which is used to indicate that the secondary node has been successfully added.
  • the node response also includes an identifier of the second security algorithm. After the primary node receives the node response, it obtains the identifier of the second security algorithm from the node response and sends the identifier of the second security algorithm to the terminal device. In this way, the terminal device obtains the identifier of the second security algorithm.
  • the identifier of the second security algorithm is carried in the RRC connection reconfiguration message sent by the primary node to the terminal device.
  • the auxiliary node may obtain the node key of the auxiliary node from the node request, and derive the user plane key of the auxiliary node based on the node key of the auxiliary node.
  • the user plane key of the auxiliary node may be a user plane encryption key, or a user plane integrity protection key, or include a user plane encryption key and a user plane integrity protection key, or a key of the AEAD algorithm used for user plane protection, wherein the AEAD algorithm is used for both data integrity protection and data encryption protection.
  • the secondary node transmits data with the terminal device according to the second security algorithm
  • the secondary node transmits data with the terminal device according to the second security algorithm and the user plane key of the secondary node:
  • the secondary node When the secondary node needs to send first data to the terminal device, the secondary node inputs the secondary node's user plane key and the first data into the second security algorithm to obtain second data, and then sends the second data to the terminal device.
  • the terminal device receives the second data from the secondary node, inputs the second data and the terminal device's user plane key into the second security algorithm, and obtains the first data.
  • the terminal device When the terminal device needs to send first data to the secondary node, the terminal device inputs the terminal device's user plane key and the first data into the second security algorithm to obtain second data, and then sends the second data to the secondary node.
  • the secondary node receives the second data from the terminal device, inputs the second data and the secondary node's user plane key into the second security algorithm, and obtains the first data.
  • the user plane key of the terminal device and the user plane key of the auxiliary node are symmetric keys to each other.
  • a node such as a master node or a slave node
  • the two can use the 256-bit user plane key for transmission protection; if the key length of the security algorithm negotiated by the two is 128 bits, the two can each truncate the 256-bit user plane key to obtain a 128-bit user plane key, and then use the 128-bit user plane key for transmission protection.
  • the master node first determines a first security algorithm, where the first security algorithm is a security algorithm used to protect data transmitted between the master node and the terminal device. Subsequently, the master node selects a secondary node based on the key length of the first security algorithm and then requests to add the secondary node. This makes the selection of the secondary node more reasonable, facilitating the subsequent secondary node to select an appropriate security algorithm.
  • the selected secondary node can meet the following conditions: the master node and the secondary node can each determine an appropriate security algorithm, so that the security strength of the data transmitted between the master node and the terminal device is consistent with the security strength of the data transmitted between the secondary node and the terminal device, so as to meet the requirements of secure communication.
  • the secondary node selected according to the solution of the present application can ensure that the key length of the security algorithm selected by the master node and the secondary node is the same.
  • the terminal device uses data redundancy transmission service
  • two redundant PDU sessions of the terminal device are used to transmit the same data of the service.
  • the data corresponding to the two PDU sessions are protected by the master node and the secondary node respectively using the selected security algorithm.
  • the key length of the two security algorithms is the same, which meets the security assumption of data redundancy transmission.
  • FIG5 is a flow chart of the second communication method exemplarily provided in this application.
  • the primary node determines a secondary node based on the key length of the security algorithm supported by the primary node and the key length of the security algorithm supported by the candidate node.
  • Candidate nodes include secondary nodes. When there is only one candidate node, the primary node can determine whether it can serve as a secondary node. When there are multiple candidate nodes, the primary node can select a secondary node from among the multiple candidate nodes. For ease of description, the following uses the latter as an example.
  • the primary node may select an alternative node whose supported security algorithm meets the following conditions (1) or (2) as the secondary node, or understand that the security algorithm supported by the secondary node may meet the following conditions (1) or (2).
  • the maximum key length of the security algorithm supported by the primary node may be referred to as the first key length
  • the maximum key length of the security algorithm supported by the secondary node may be referred to as the second key length
  • the key length of the security algorithm supported by a node when the key length of the security algorithm supported by a node (primary node/secondary node) includes key length 1, the key length of the security algorithm supported by the node also includes key length 2, wherein key length 1 is higher than key length 2. For example, if the key length of the security algorithm supported by the node includes 256 bits, then the key length of the security algorithm supported by the node also includes 128 bits.
  • the key length of the security algorithm supported by the secondary node includes the key length of the security algorithm supported by the primary node.
  • the security algorithms supported by the master node include security algorithms 1 through 3.
  • the key length of security algorithm 1 is 256 bits, and the key lengths of security algorithms 2 and 3 are both 128 bits.
  • the multiple candidate nodes include candidate nodes 1 through 3.
  • the key length of the security algorithm supported by candidate node 1 is 256 bits
  • the key length of the security algorithm supported by candidate node 2 is 128 bits
  • the key lengths of the security algorithms supported by candidate node 3 are 256 bits and 128 bits.
  • the master node may select candidate node 3 as a secondary node from among candidate nodes 1 through 3 based on the key lengths of security algorithms 1 through 3.
  • condition (1) the logic of the primary node in selecting the secondary node is similar.
  • condition (1) takes condition (1) as an example.
  • the master node may obtain information about the key lengths of security algorithms supported by the candidate nodes.
  • the master node may obtain information about the key lengths of security algorithms supported by the candidate nodes. For details about the information about the key lengths of security algorithms supported by the candidate nodes and how the master node obtains the information about the key lengths of security algorithms supported by the candidate nodes, please refer to the description of step 401.
  • Step 502 The primary node sends a node request to the secondary node.
  • the secondary node receives the node request from the primary node.
  • the node request is used to request adding a secondary node. For details, please refer to the description in step 402.
  • the node request includes information about the key length of the first security algorithm.
  • the function and form of the key length information of the first security algorithm can be found in the description of step 402 .
  • the master node may first select a first security algorithm from among the security algorithms supported by the master node. Specifically, the master node selects the first security algorithm from among the security algorithms supported by the master node based on the priority of the security algorithms supported by the master node and the security algorithms supported by the terminal device. For details, see the description in step 400.
  • step 502 For details not described in step 502 , please refer to the description in step 402 .
  • the implementation related to FIG5 further includes the following steps 503 and 504.
  • the secondary node determines a second security algorithm.
  • the second security algorithm is a security algorithm for protecting data transmitted between the secondary node and the terminal device. For details, see the description in step 403.
  • step 504 the secondary node transmits data to the terminal device according to the second security algorithm.
  • the secondary node transmits data to the terminal device according to the second security algorithm. For details, please refer to the description in step 404.
  • the primary node selects a secondary node based on the security algorithm supported by the primary node and then requests to add the secondary node. This makes the selection of the secondary node more reasonable, making it easier for the subsequent secondary node to select an appropriate security algorithm.
  • the selected secondary node can meet the following conditions: the primary node and the secondary node can each determine an appropriate security algorithm, so that the security strength of the data transmitted between the primary node and the terminal device is consistent with the security strength of the data transmitted between the secondary node and the terminal device, so as to meet the requirements of secure communication.
  • the secondary node selected according to the solution of the present application can ensure that the key length of the security algorithm selected by the primary node and the secondary node is the same.
  • the two redundant PDU sessions of the terminal device are used to transmit the same data of the service.
  • the data corresponding to the two PDU sessions are protected by the primary node and the secondary node respectively using the selected security algorithms.
  • the key lengths of the two security algorithms are the same, which meets the security assumption of data redundancy transmission.
  • FIG6 is a flow chart of the third communication method exemplarily provided in this application.
  • Step 601 The primary node obtains information about security algorithms supported by the secondary node.
  • the security algorithm information includes information about the key length of the security algorithm and/or the identifier of the security algorithm. That is, the primary node obtains information about the key length of the security algorithm supported by the secondary node and/or obtains the identifier of the security algorithm supported by the secondary node.
  • the information about the key lengths of the security algorithms supported by the secondary node may include identifiers of multiple key lengths supported by the secondary node, an identifier of a maximum key length supported by the secondary node, or an indication of whether the secondary node supports a preset key length.
  • the secondary node is one of the candidate nodes.
  • the information about the key lengths of the security algorithms supported by the secondary node may be found in the description of step 401 above.
  • the identifiers of the security algorithms supported by the secondary node may specifically be the identifiers of one or more security algorithms supported by the secondary node. For example, if the secondary node supports security algorithms 1 through 3, and the identifiers of security algorithms 1 through 3 are identifiers 1 through 3, respectively, then the identifiers of the security algorithms supported by the secondary node include identifiers 1 through 3.
  • step 600 may be further included:
  • Step 600 The primary node selects a secondary node from the candidate nodes.
  • the definition of candidate nodes may refer to the description of acquisition method 1 in step 401 .
  • the master node is pre-configured with the identifier of the candidate node.
  • the master node sends a measurement instruction to the terminal device, which includes the identifier of the candidate node.
  • the measurement instruction is used to instruct the terminal device to measure the signal strength of the candidate node.
  • the terminal device receives the measurement instruction, measures the signal strength of the candidate node based on the identifier of the candidate node in the measurement instruction, and sends the measurement result to the master node, which includes the signal strength of the candidate node.
  • the master node selects a secondary node from the candidate nodes based on the signal strength of the candidate node and the usage of air interface resources.
  • the primary node is pre-configured with the identifiers and priorities of the candidate nodes.
  • the primary node can select a secondary node from the candidate nodes based on the priorities of the candidate nodes and the usage of air interface resources.
  • Acquisition method (1) Information about the security algorithms supported by the secondary nodes pre-configured in the primary node.
  • the pre-configuration information also includes information about security algorithms supported by the candidate nodes (that is, the pre-configuration information includes information about security algorithms supported by the secondary nodes).
  • the master node obtains information about security algorithms supported by the secondary nodes from the pre-configuration information based on the identifier of the secondary node.
  • the candidate nodes are candidate nodes 1 to candidate nodes 5, and the pre-configuration information includes the identifiers of candidate nodes 1 to candidate nodes 5, as well as information about security algorithms 1 to information about security algorithms 5 supported by candidate nodes 1 to candidate nodes 5, respectively.
  • the master node selects candidate node 2 as the secondary node, it further determines that the information about security algorithms supported by the secondary node is security algorithm information 2.
  • Step 602 The primary node determines a first security algorithm based on information about security algorithms supported by the secondary node, wherein the first security algorithm is a security algorithm for protecting data transmitted between the primary node and the terminal device.
  • the master node selects a first security algorithm from the security algorithms supported by the master node based on information about security algorithms supported by the slave node and information about security algorithms supported by the master node.
  • the information of the security algorithms supported by the master node includes one or more of the following: identification of multiple key lengths supported by the master node, identification of the maximum key length supported by the master node (i.e., identification of the first key length), an indication of whether the master node supports a preset key length, identification of the security algorithms supported by the master node, or the priority of the security algorithms supported by the master node.
  • the information about security algorithms supported by the master node is a priority list of security algorithms supported by the master node, which includes identifiers and priorities of multiple security algorithms supported by the master node.
  • the identifiers of the security algorithms supported by the master node include the key lengths of the security algorithms. For example, if the identifier of the security algorithm is "128-NEA2," the key length is 128, where NEA2 refers to the SNOW3G encryption algorithm.
  • the primary node determines the first security algorithm based on the information of the key length of the security algorithm supported by the secondary node and the information of the security algorithm supported by the primary node.
  • the master node determines the second key length based on the key length information of the security algorithm supported by the slave node. The smaller key length between the first and second key lengths is then determined. Based on the smaller key length and the priorities of the security algorithms supported by the terminal device and the security algorithms supported by the master node, a security algorithm with a key length lower than (or less than) or equal to the smaller key length is selected from the security algorithms supported by the master node, and the selected security algorithm is used as the first security algorithm.
  • the first key length is the maximum key length of the security algorithm supported by the master node
  • the second key length is the maximum key length of the security algorithm supported by the slave node.
  • the master node may select a security algorithm with a key length lower than or equal to the second key length from the security algorithms supported by the master node based on the security algorithms supported by the terminal device and the priority of the security algorithms supported by the master node, and use the selected security algorithm as the first security algorithm.
  • the second key length is 128 bits
  • the master node supports security algorithms 1 through 3
  • the priority of security algorithms 1 through 3 is: security algorithm 1, security algorithm 2, security algorithm 3.
  • the terminal device supports security algorithms 1 through 3.
  • the key length of security algorithm 1 is 256 bits
  • the key lengths of security algorithms 2 and 3 are both 128 bits.
  • the master node determines that the first key length is 256 bits and that the first key length is longer than the second key length. Based on the second key length (i.e., 128 bits), the support of security algorithms 1 through 3 by the terminal device, and the priority of security algorithms 1 through 3, the master node selects security algorithm 2 as the first security algorithm.
  • the master node may select a security algorithm with a key length less than or equal to the first key length from the security algorithms supported by the master node based on the security algorithms supported by the terminal device and the priority of the security algorithms supported by the master node, and use the selected security algorithm as the first security algorithm.
  • the second key length is 256 bits.
  • the master node determines that the first key length is 256 bits, and the first key length is less than or equal to the second key length. Therefore, based on the first key length (i.e., 256 bits), security algorithms 1 to 3 supported by the terminal device, and the priority of security algorithms 1 to 3, security algorithm 1 is selected as the first security algorithm.
  • Example (2) The master node preliminarily selects a security algorithm based on the security algorithms and priorities supported by the master node and the security algorithms supported by the terminal device. If the key length of the preliminarily selected security algorithm is less than or equal to the second key length, the preliminarily selected security algorithm is determined as the first security algorithm; if the key length of the preliminarily selected security algorithm is greater than the second key length, the security algorithm is reselected based on the security algorithms and priorities supported by the master node and the security algorithms supported by the terminal device, and it is determined whether the key length of the reselected security algorithm is less than or equal to the second key length, and so on, until the first security algorithm is determined.
  • the second key length is 128 bits
  • the master node supports security algorithms 1 to 3
  • the priority order of security algorithms 1 to 3 is: security algorithm 1, security algorithm 2, security algorithm 3.
  • the terminal device supports security algorithms 1 to 3.
  • the key length of security algorithm 1 is 256 bits
  • the key lengths of security algorithms 2 and 3 are both 128 bits.
  • the master node selects security algorithm 1 based on the security algorithms and priorities supported by the master node and the security algorithms supported by the terminal device, and determines that the key length of security algorithm 1 is greater than the second key length.
  • the master node reselects security algorithm 2 based on the security algorithms and priorities supported by the master node and the security algorithms supported by the terminal device, and determines that the key length of security algorithm 2 is equal to the second key length, then determines that security algorithm 2 is the first security algorithm.
  • the master node supports security algorithms 1 to 3, and the priority order of security algorithms 1 to 3 is: security algorithm 1, security algorithm 2, security algorithm 3.
  • the terminal device supports security algorithms 1 to 3.
  • the auxiliary node supports security algorithms 1 and security algorithm 4.
  • the key length of security algorithms 1 and 4 is 256 bits, and the key length of security algorithms 2 and 3 is 128 bits. Then, the master node determines that the key length supported by all three is 256 bits based on the key length of the security algorithm supported by the master node, the key length of the security algorithm supported by the auxiliary node, and the key length of the security algorithm supported by the terminal device.
  • the master node determines that the first security algorithm is security algorithm 1 based on the key length supported by all three (i.e., 256 bits), the security algorithms 1 to 3 supported by the terminal device, and the priority order of the security algorithms supported by the master node.
  • the primary node determines the information of the key length of the security algorithm supported by the secondary node based on the identifier of the security algorithm supported by the secondary node, and then determines the first security algorithm based on the information of the key length of the security algorithm supported by the secondary node and the information of the security algorithm supported by the primary node (for details, please refer to the description in the above case 1).
  • implementation related to FIG6 further includes the following steps 603 to 605:
  • Step 603 The primary node sends a node request to the secondary node.
  • the secondary node receives the node request from the primary node.
  • the node request includes information about the key length of the first security algorithm. This information can be an identifier of the key length of the first security algorithm or an indication of whether the key length of the first security algorithm is a preset key length.
  • the node request is used to request the addition of a secondary node. For details, see the description in step 402.
  • the node request also includes the security algorithm supported by the terminal device.
  • the node request may also include the node key of the secondary node, which is used by the secondary node to derive the user plane key of the secondary node. For details, see the description in step 402.
  • Step 604 The secondary node determines a second security algorithm based on the key length information of the first security algorithm.
  • the secondary node After receiving the node request, the secondary node obtains information about the key length of the first security algorithm from the node request. Based on the information about the key length of the first security algorithm, the secondary node determines a second security algorithm from among the security algorithms supported by the secondary node, where the key length of the first security algorithm is the same as the key length of the second security algorithm. For specific implementation, see the description of Case 1 in Step 403.
  • the secondary node may also send a node response to the primary node, where the node response is used to indicate that the secondary node has been successfully added.
  • the node response is used to indicate that the secondary node has been successfully added.
  • the primary node first identifies the secondary node, then determines a first security algorithm based on information about the security algorithms supported by the secondary node, and then requests the addition of the secondary node based on information about the key length of the first security algorithm.
  • the primary and secondary nodes can each determine an appropriate security algorithm, thereby ensuring that the security strength of data transmitted between the primary node and the terminal device matches the security strength of data transmitted between the secondary node and the terminal device, thereby meeting the requirements for secure communication. For example, according to the present application scheme, it is possible to achieve that the key length of the first security algorithm selected by the primary node and the second security algorithm selected by the secondary node are the same.
  • the two redundant PDU sessions of the terminal device are used to transmit the same data of the service.
  • the data corresponding to the two PDU sessions are protected by the primary node and the secondary node respectively using the selected security algorithms.
  • the key lengths of the two security algorithms are the same, which meets the security assumption of data redundancy transmission.
  • FIG7 is a flow chart of the fourth communication method exemplarily provided in this application.
  • step 701 the primary node obtains information about security algorithms supported by the secondary node. For details, please refer to the description of step 601.
  • Step 700 The master node selects a slave node from the candidate nodes. For details, please refer to the description in Step 600 .
  • Step 702 The primary node determines a first security algorithm and a second security algorithm based on information about security algorithms supported by the secondary node.
  • the first security algorithm is a security algorithm used to protect data transmitted between the primary node and the terminal device.
  • the second security algorithm is a security algorithm used to protect data transmitted between the secondary node and the terminal device.
  • the key length of the first security algorithm is equal to the key length of the second security algorithm.
  • the information about the security algorithms supported by the secondary node includes an identifier of the security algorithms supported by the secondary node.
  • the primary node determines the key length information of the security algorithms supported by the secondary node based on the identifier of the security algorithms supported by the secondary node, and then determines the first security algorithm based on the key length information of the security algorithms supported by the secondary node and the information about the security algorithms supported by the primary node (for details, see the description in step 602).
  • the primary node determines the second security algorithm based on the key length of the first security algorithm and the identifier of the security algorithm supported by the secondary node.
  • the information about security algorithms supported by the secondary node also includes information about the key lengths of the security algorithms supported by the secondary node.
  • the primary node may determine the first security algorithm based on the information about the key lengths of the security algorithms supported by the secondary node and the information about the security algorithms supported by the primary node.
  • the primary node may then determine the second security algorithm based on the key length of the first security algorithm and the identifier of the security algorithm supported by the secondary node.
  • the information of the security algorithms supported by the secondary node includes the identifiers of the security algorithms supported by the secondary node, and the primary node determines the first security algorithm and the second security algorithm based on the identifiers of the security algorithms supported by the secondary node and the information of the security algorithms supported by the primary node.
  • the first security algorithm and the second security algorithm are the same, that is, the master node selects security algorithms with the same identifier as the first security algorithm and the second security algorithm based on the identifiers of the security algorithms supported by the slave node and the identifiers of the security algorithms supported by the master node.
  • the secondary node supports security algorithms 1 to 4
  • the information about the security algorithms supported by the secondary node includes the identifiers of security algorithms 1 to 4
  • the primary node supports security algorithms 1 to 3
  • the information about the security algorithms supported by the primary node includes the identifiers of security algorithms 1 to 3.
  • the primary node can determine, based on the identifiers of the security algorithms supported by the secondary node and the identifiers of the security algorithms supported by the primary node, that both the first security algorithm and the second security algorithm are security algorithm 1, or that both the first security algorithm and the second security algorithm are security algorithm 2, and so on.
  • the primary node may also send the identifier of the second security algorithm to the secondary node.
  • the identifier of the second security algorithm is included in the node request.
  • the identifier of the second security algorithm is included in another message. For example, the primary node first sends a node request to the secondary node, requesting the addition of the secondary node. The primary node then sends the other message to the secondary node, which includes the identifier of the second security algorithm.
  • Step 703 The primary node sends a node request to the secondary node.
  • the secondary node receives the node request from the primary node.
  • the node request is used to request adding a secondary node. For details, please refer to the description in step 402.
  • the node request includes an identifier of the second security algorithm.
  • the node request is further used to instruct the secondary node to transmit data with the terminal device according to the identifier of the second security algorithm included in the node request.
  • Step 704 The secondary node transmits data with the terminal device according to the second security algorithm.
  • the secondary node After the secondary node obtains the identifier of the second security algorithm from the node request, it directly determines the second security algorithm based on the identifier of the second security algorithm. For example, if the node request includes the identifier of security algorithm 1, the secondary node may determine that the second security algorithm is security algorithm 1.
  • the secondary node may verify that the secondary node and/or the terminal device supports the second security algorithm, and then transmit data to the terminal device based on the second security algorithm.
  • the secondary node obtains from the node request an identifier of the security algorithm supported by the terminal device and an identifier of the second security algorithm, and determines that the security algorithms supported by the terminal device include the second security algorithm.
  • the secondary node may also send a node response to the primary node, which indicates that the secondary node has been successfully added. Since the primary node already knows the second security algorithm, the node response may not carry the identifier of the second security algorithm, which helps reduce the amount of transmitted data.
  • two redundant PDU sessions of the terminal device are used to transmit the same data of the service.
  • the data corresponding to the two PDU sessions are protected by a first security algorithm and a second security algorithm, respectively.
  • the key lengths of the two security algorithms are the same, which meets the security assumption of data redundancy transmission.
  • FIG8 is a flow chart of the fifth communication method exemplified in the present application.
  • the secondary node selected first by the primary node may be referred to as secondary node 1
  • the node request sent by the primary node to secondary node 1 may be referred to as node request 1.
  • the secondary node selected later by the primary node may be referred to as secondary node 2
  • the node request sent by the primary node to secondary node 2 may be referred to as node request 2.
  • the first security algorithm is a security algorithm for protecting data transmitted between the master node and the terminal device.
  • the master node selects the first security algorithm from the security algorithms supported by the master node based on the priority of the security algorithms supported by the master node and the security algorithms supported by the terminal device. Specific examples can be found in the description of step 400.
  • step 802 the primary node sends a node request 1 to the secondary node (i.e., secondary node 1).
  • secondary node 1 receives the node request 1 from the primary node.
  • Node request 1 is used to request the addition of secondary node 1 and includes information about the key length of the first security algorithm.
  • the key length of the first security algorithm is a preset key length.
  • the master node determines that the key length of the first security algorithm is the preset key length, it may include information about the key length of the first security algorithm (i.e., the preset key length) in node request 1. For example, if the preset key length is 256 bits, if the master node determines that the key length of the first security algorithm is 256 bits, the node request 1 sent to the slave node 1 may include 256 bits; if the master node determines that the key length of the first security algorithm is 128 bits, the node request 1 sent to the slave node 1 may not include 128 bits.
  • the primary node may select the secondary node 1 from the candidate nodes.
  • the primary node may select the secondary node 1 from the candidate nodes.
  • the implementation related to FIG8 further includes the following steps 803 to 804.
  • Step 803 The secondary node 1 sends a node response 1 to the primary node.
  • the primary node receives the node response 1 from the secondary node 1 .
  • node response 1 is the response corresponding to node request 1.
  • Node response 1 is used to indicate that adding secondary node 1 has failed.
  • node response 1 includes a failure indication (e.g., a negative acknowledgment (NACK)), which is used to indicate that adding secondary node 1 has failed.
  • NACK negative acknowledgment
  • secondary node 1 obtains information about the key length of the first security algorithm from node request 1. Based on the information about the key length of the first security algorithm, if secondary node 1 determines that it does not support the key length of the first security algorithm, secondary node 1 sends node response 1 to the primary node. For example, if the key length supported by secondary node 1 is 128 bits, and the information about the key length of the first security algorithm included in node request 1 is 256 bits, secondary node 1 may determine that it does not support the key length of the first security algorithm and send node response 1 to the primary node.
  • secondary node 1 obtains information about the key length of a first security algorithm from node request 1. Based on the information about the key length of the first security algorithm, if secondary node 1 determines that the key length of the first security algorithm is supported, secondary node 1 then determines a second security algorithm. Furthermore, upon determining that the key lengths of the first security algorithm and the second security algorithm are different, secondary node 1 sends node response 1 to the primary node. For example, if secondary node 1 supports key lengths of 128 bits and 256 bits, and the information about the key length of the first security algorithm included in node request 1 is 256 bits, secondary node 1 may determine that it supports the key length of the first security algorithm.
  • secondary node 1 determines that the key length of the second security algorithm is 128 bits (for example, secondary node 1 determines the second security algorithm based on the priority of the security algorithms supported by secondary node 1, and the key length of the second security algorithm is 128 bits). Secondary node 1 determines that the key length of the first security algorithm (i.e., 256 bits) is different from the key length of the second security algorithm (i.e., 128 bits), and sends node response 1 to the primary node.
  • the key length of the first security algorithm i.e., 256 bits
  • the key length of the second security algorithm i.e., 128 bits
  • secondary node 1 determines the second security algorithm. Further, secondary node 1 determines that the key length of the first security algorithm differs from the key length of the second security algorithm and sends node response 1 to the primary node.
  • the key length information of the first security algorithm included in node request 1 is 256 bits.
  • the key length of the second security algorithm is 128 bits. Secondary node 1 determines that the key length of the first security algorithm (i.e., 256 bits) differs from the key length of the second security algorithm (i.e., 128 bits) and sends node response 1 to the primary node.
  • the node response 1 may further include a reason value corresponding to the failure indication, which is used to indicate the reason why the secondary node 1 returns the failure indication to the primary node.
  • a reason value corresponding to the failure indication which is used to indicate the reason why the secondary node 1 returns the failure indication to the primary node.
  • the reason value is 1, the reason is that the secondary node 1 does not support the key length of the first security algorithm; when the reason value is 2, the reason is that although the secondary node 1 supports the key length of the first security algorithm, the key length of the second security algorithm determined by the secondary node 1 is different from the key length of the first security algorithm; when the reason value is 3, the reason is that the key length of the second security algorithm determined by the secondary node 1 is different from the key length of the first security algorithm, but it does not indicate whether the secondary node 1 supports the key length of the first security algorithm.
  • Step 804 The primary node reselects a secondary node (ie, secondary node 2).
  • the master node selects secondary node 2 from the candidate nodes.
  • secondary node 2 is different from secondary node 1, and the master node specifically selects secondary node 2 from the candidate nodes other than secondary node 1.
  • the master node prioritizes secondary node 1 over secondary node 2.
  • the signal strength of secondary node 1 is higher than the signal strength of secondary node 2.
  • Step 806 The secondary node 2 sends a node response 2 to the primary node.
  • the primary node receives the node response 2 from the secondary node 2 .
  • Node response 2 is a response corresponding to node request 2.
  • Node response 2 is used to indicate that the secondary node 2 is successfully added.
  • node response 2 includes a success indication, which is used to indicate that the secondary node 2 is successfully added.
  • secondary node 2 obtains information about the key length of the first security algorithm from node request 2. Based on the information about the key length of the first security algorithm, secondary node 2 determines that secondary node 2 supports the key length of the first security algorithm. Then, based on the key length of the first security algorithm, secondary node 2 determines a second security algorithm, where the key length of the first security algorithm is equal to the key length of the second security algorithm. Secondary node 2 sends node response 2 to the primary node. For example, the secondary node supports security algorithm 1, and the key length of security algorithm 1 is 256 bits. The information about the key length of the first security algorithm included in node request 2 is 256 bits. The secondary node determines that it supports the key length of the first security algorithm, and then, based on the key length of the first security algorithm, determines that the second security algorithm is security algorithm 1, and sends node response 2 to the primary node.
  • the auxiliary node 2 obtains the information of the key length of the first security algorithm from the node request 2, and determines the second security algorithm based on the information of the key length of the first security algorithm. Further, the auxiliary node 2 determines that the key length of the first security algorithm is the same as the key length of the second security algorithm, and sends a node response 2 to the main node.
  • the auxiliary node supports security algorithm 1, the key length of security algorithm 1 is 256 bits, and the information of the key length of the first security algorithm included in the node request 2 is 256 bits. Then the auxiliary node can determine that it supports the key length of the first security algorithm. Further, the auxiliary node determines that the second security algorithm is security algorithm 1. The auxiliary node determines that the key length of the first security algorithm (i.e., 256 bits) is the same as the key length of the second security algorithm (i.e., 256), and sends a node response 2 to the main node.
  • secondary node 2 determines the second security algorithm. Further, secondary node 2 determines that the key length of the first security algorithm is the same as the key length of the second security algorithm, and sends node response 2 to the primary node.
  • the secondary node supports security algorithm 1
  • the key length of security algorithm 1 is 256 bits
  • the information about the key length of the first security algorithm included in node request 2 is 256 bits.
  • the secondary node determines that the second security algorithm is security algorithm 1
  • the secondary node determines that the key length of the first security algorithm (i.e., 256 bits) is the same as the key length of the second security algorithm (i.e., 256 bits), and sends node response 2 to the primary node.
  • Node Response 2 includes an identifier of the second security algorithm.
  • the master node may obtain the identifier of the second security algorithm from Node Response 2 and send the identifier of the second security algorithm to the terminal device.
  • the terminal device obtains the identifier of the second security algorithm.
  • the identifier of the second security algorithm is carried in an RRC connection reconfiguration message sent by the master node to the terminal device.
  • Step 807 The secondary node 2 transmits data with the terminal device according to the second security algorithm.
  • step 807 For details not described in step 807 , please refer to the description in step 404 .
  • the present application exemplarily provides three judgment methods for the auxiliary node (i.e., auxiliary node 1 or auxiliary node 2) to send a node response to the main node after receiving the node request.
  • auxiliary node i.e., auxiliary node 1 or auxiliary node 2
  • the contents not described in detail in the following three judgment methods can be found in the description of the relevant embodiment of Figure 8.
  • the information of the key length of the first security algorithm may have one or more of the following functions: used for the auxiliary node to determine whether the key length of the first security algorithm is supported, used for the auxiliary node to determine the second security algorithm, used for the auxiliary node to determine whether the key length of the second security algorithm matches the key length of the first security algorithm, or used for the auxiliary node to determine what kind of node response to send to the main node.
  • the node response is used to indicate that the addition of the auxiliary node failed, or the node response is used to indicate that the addition of the auxiliary node was successful.
  • Method A corresponds to the above examples a1 and a2.
  • For the specific process please refer to the first judgment method of the auxiliary node shown in FIG9 .
  • step A1 the secondary node determines whether it supports a key length of a first security algorithm.
  • Step A2 The secondary node sends a node response to the primary node, where the node response indicates that adding the secondary node has failed.
  • step A3 the secondary node determines a second security algorithm according to the key length of the first security algorithm.
  • Step A4 The secondary node sends a node response to the primary node.
  • the node response is used to indicate that the secondary node is added successfully.
  • step B1 the secondary node determines whether it supports the key length of the first security algorithm.
  • step B2 the secondary node sends a node response to the primary node, where the node response is used to indicate that adding the secondary node has failed.
  • Step B3 The secondary node determines a second security algorithm.
  • Step B5 The secondary node sends a node response to the primary node.
  • the node response is used to indicate that adding the secondary node fails.
  • Step B6 The secondary node sends a node response to the primary node.
  • the node response is used to indicate that the secondary node is added successfully.
  • step C2 the secondary node determines whether the key length of the first security algorithm is the same as the key length of the second security algorithm.
  • step C3 the secondary node sends a node response to the primary node, where the node response is used to indicate that adding the secondary node has failed.
  • the main node determines the auxiliary node that can be successfully added by sending a node request to the auxiliary node and receiving a node response from the auxiliary node.
  • the auxiliary node that is successfully added can meet the following conditions: the main node and the auxiliary node can each determine a suitable security algorithm, so that the security strength of the data transmitted between the main node and the terminal device is consistent with the security strength of the data transmitted between the auxiliary node and the terminal device, so as to meet the requirements of secure communication.
  • the auxiliary node added according to the solution of the present application can make the key length of the security algorithm selected by the main node and the auxiliary node the same.
  • the master node may determine that a redundancy condition is satisfied.
  • the redundancy condition may include one or more of the following conditions 1 to 4:
  • the terminal device uses data redundancy transmission (such as URLLC) service;
  • Condition 2 The network establishes a redundant user plane path for the terminal device
  • Condition 3 The network establishes a redundant PDU session for the terminal device.
  • Condition 4 The network implements redundant transmission for terminal devices.
  • the master node may determine that the redundancy condition is satisfied in the process as shown in FIG. 12 .
  • Step 1201 The terminal device sends PDU session request 1 and PDU session request 2 to the AMF.
  • PDU session request 1 carries data network name (DNN) 1 and single network slice selection assistance information (S-NSSAI) 1
  • PDU session request 2 carries DNN2 and S-NSSAI2.
  • DNN1 and DNN2 are the same, and S-NSSAI1 and S-NSSAI2 are different.
  • AMF selects SMF1 according to DNN1 and S-NSSAI1 in PDU session request 1, and forwards PDU session request 1 to SMF1; selects SMF2 according to DNN2 and S-NSSAI2 in PDU session request 2, and forwards PDU session request 2 to SMF2.
  • step 1203 SMF1 determines that PDU session 1 corresponding to PDU session request 1 is a redundant session based on PDU session policy 1 corresponding to the terminal device. It then generates a redundancy sequence number (RSN) 1 and a PDU session pair ID 1. SMF1 sends a redundant session indication 1 to the master node, which carries RSN 1 and PDU session pair ID 1. The PDU session policy 1 corresponding to the terminal device comes from the PCF.
  • RSN redundancy sequence number
  • SMF2 determines that PDU Session 2 corresponding to PDU Session Request 2 is a redundant session and generates RSN2 and PDU Session Pair ID2. SMF2 sends Redundant Session Indication 2 to the master node, which carries RSN2 and PDU Session Pair ID2.
  • the PDU Session Policy 2 corresponding to the terminal device comes from the PCF.
  • step 1204 the master node determines that the RSNs carried in the redundant session indication 1 and the redundant session indication 2 are different, and the PDU session pair IDs carried are the same, and then determines that the two PDU sessions corresponding to the redundant session indication 1 and the redundant session indication 2 are redundant sessions of each other, that is, the master node determines that the redundancy condition is met.
  • the terminal device when the terminal device determines that the data redundancy transmission service is required, it may determine RSN1 and PDU session pair ID1, and RSN2 and PDU session pair ID2, where RSN1 and RSN2 are different and PDU session pair ID1 and PDU session pair ID2 are the same.
  • the terminal device sends PDU session request 1 and PDU session request 2 to the AMF.
  • PDU session request 1 carries not only DNN1 and S-NSSAI1, but also RSN1 and PDU session pair ID1.
  • PDU session request 2 carries not only DNN2 and S-NSSAI2, but also RSN2 and PDU session pair ID2.
  • SMF1 sends redundant session indication 1 to the master node, carrying RSN1 and PDU session pair ID1.
  • SMF2 sends redundant session indication 2 to the master node, carrying RSN2 and PDU session pair ID2.
  • the master node determines that the two PDU sessions corresponding to redundant session indication 1 and redundant session indication 2 are redundant sessions, that is, determines that the redundancy condition is met.
  • the terminal device may not have established a PDU session with the network. Subsequently, when the terminal device determines that the data redundancy transmission service is required, it sends PDU session request 1 and PDU session request 2 to the AMF, and then establishes redundant PDU session 1 and PDU session 2 based on the embodiment of Figure 12.
  • the terminal device has already established PDU session 0 with the network, and the master node and the terminal device have negotiated a security algorithm (denoted as the third security algorithm).
  • the terminal device When the terminal device determines that the data redundancy transmission service is required, it sends PDU session request 1 and PDU session request 2 to the AMF, and then establishes redundant PDU session 1 and PDU session 2 based on the embodiment of Figure 12.
  • the master node can reuse the previous third security algorithm, that is, the first security algorithm is the third security algorithm.
  • the master node can determine the secondary node based on the third security algorithm. For details, please refer to the description of the first communication method and the fifth communication method above.
  • step numbers in any of the flowcharts in Figures 4 to 12 are merely examples of the execution process and do not constitute a limitation on the order in which the steps are executed. In the embodiments of the present application, there is no strict execution order between steps that have no temporal dependencies. Not all of the steps shown in the flowcharts are required to be executed. Some steps can be deleted from each flowchart based on actual needs, or other possible steps can be added to each flowchart based on actual needs.
  • the master node selects the first security algorithm from the security algorithms supported by the master node, it is necessary to consider the security algorithms supported by the terminal device and the priority of the security algorithms supported by the master node. That is, the first security algorithm selected by the master node is a security algorithm supported by both the master node and the terminal device and has a higher priority.
  • the first security algorithm selected by the master node is a security algorithm supported by both the master node and the terminal device and has a higher priority.
  • the auxiliary node selects the second security algorithm from the security algorithms supported by the auxiliary node, it is necessary to consider the security algorithms supported by the terminal device and the priority of the security algorithms supported by the auxiliary node.
  • this application focuses on describing how to ensure that the key length of the first security algorithm is equal to the key length of the second security algorithm, so that the master node protects the data transmitted between the terminal device based on the first security algorithm, and the auxiliary node protects the data transmitted between the terminal device based on the second security algorithm, so as to achieve the security of the communication system.
  • this application only describes the differences among the five communication methods. Except for the differences, the five communication methods can refer to each other. In addition, different implementations or different examples in the same communication method can also refer to each other.
  • the communication device 1300 also includes a storage module 1303 (not shown in Figure 13), and the storage module 1303 is used to pre-configure information on the key length of the security algorithm supported by the alternative node.
  • the processing module 1301 is also used to obtain the key length of the security algorithm supported by the alternative node from the storage module 1303; or, the control transceiver module 1302 obtains information on the key length of the security algorithm supported by the alternative node from the alternative node.
  • the processing module 1301 is specifically configured to: determine a secondary node based on the key length of the first security algorithm and the key length of the security algorithm supported by the candidate node when determining that a redundancy condition is satisfied; or determine a secondary node based on the key length of the security algorithm supported by the primary node and the key length of the security algorithm supported by the candidate node.
  • the redundancy condition includes one or more of the following conditions 1 to 4: condition 1, the terminal device uses URLLC service; condition 2, a redundant user plane path is established for the terminal device; condition 3, a redundant PDU session is established for the terminal device; or condition 4, redundant transmission is implemented for the terminal device.
  • the communication device 1300 further includes a storage module 1303, which is used to pre-configure information about security algorithms supported by the secondary node.
  • a storage module 1303 which is used to pre-configure information about security algorithms supported by the secondary node.
  • the processing module 1301 obtains the information about security algorithms supported by the secondary node, it is specifically configured to obtain the information about security algorithms supported by the secondary node from the storage module 1303.
  • the processing module 1301 obtains the information about security algorithms supported by the secondary node, it is specifically configured to control the transceiver module 1302 to obtain the information about security algorithms supported by the secondary node from the secondary node.
  • the processing module 1301 is specifically configured to: determine a first security algorithm based on information about security algorithms supported by the secondary node when a redundancy condition is determined to be met.
  • the redundancy condition includes one or more of the following conditions 1 to 4: condition 1: the terminal device uses URLLC services; condition 2: a redundant user plane path is established for the terminal device; condition 3: a redundant PDU session is established for the terminal device; or condition 4: redundant transmission is implemented for the terminal device.
  • the information of the security algorithm includes information about the key length of the security algorithm.
  • the processing module 1301 determines the first security algorithm based on the information about the security algorithm supported by the secondary node, it is specifically used to: determine the first security algorithm based on the information about the key length of the security algorithm supported by the secondary node and the information about the security algorithm supported by the primary node.
  • the security algorithm information includes an identifier of the security algorithm.
  • the processing module 1301 is specifically configured to: determine the first security algorithm and a second security algorithm based on the identifier of the security algorithm supported by the secondary node and the information about the security algorithms supported by the primary node, where the second security algorithm is a security algorithm used to protect data transmitted between the secondary node and the terminal device.
  • the transceiver module 1302 is further configured to send the identifier of the second security algorithm to the secondary node.
  • Processing module 1301 is configured to determine a first security algorithm, where the first security algorithm is a security algorithm used to protect data transmitted between the primary node and the terminal device.
  • Transceiver module 1302 is configured to send a node request to a secondary node, requesting the addition of the secondary node.
  • the node request includes information about the key length of the first security algorithm.
  • the transceiver module 1302 is specifically configured to: send a node request including information about the key length of the first security algorithm to the secondary node if the processing module 1301 determines that a redundancy condition is met.
  • the redundancy condition includes one or more of the following conditions 1 to 4: condition 1: the terminal device uses URLLC services; condition 2: a redundant user plane path is established for the terminal device; condition 3: a redundant PDU session is established for the terminal device; or condition 4: redundant transmission is implemented for the terminal device.
  • the node request when the key length of the first security algorithm is a preset key length, the node request includes information about the key length of the first security algorithm.
  • the transceiver module 1302 is further configured to receive a node response from the secondary node, the node response being used to indicate a failure to add the secondary node.
  • the processing module 1301 is further configured to reselect a secondary node, and the transceiver module 1302 is further configured to send a node request to the reselected secondary node.
  • Transceiver module 1302 is configured to receive a node request from a primary node, requesting the addition of a secondary node.
  • the node request includes information about the key length of a first security algorithm used to protect data transmitted between the primary node and a terminal device.
  • Processing module 1301 is configured to determine a second security algorithm based on the key length of the first security algorithm. The second security algorithm is used to protect data transmitted between the secondary node and the terminal device.
  • the processing module 1301 is further configured to control the transceiver module 1302 to transmit data with the terminal device according to the second security algorithm.
  • the transceiver module 1302 is used to receive a node request from the master node, the node request is used to request the addition of a secondary node, and the node request includes an identifier of the second security algorithm; the processing module 1301 is used to control the transceiver module 1302 to transmit data with the terminal device according to the second security algorithm.
  • the processing module 1301 is configured to control the transceiver module 1302 to transmit data with the terminal device according to the second security algorithm, and is further configured to determine whether the secondary node and/or the terminal device supports the second security algorithm.
  • the transceiver module 1302 is further configured to send a node response to the primary node, where the node response is used to indicate that the secondary node is successfully added, and the node response does not carry an identifier of the second security algorithm.
  • the transceiver module 1302 is used to receive a node request, which is used to request the addition of a secondary node.
  • the node request includes information on the key length of the first security algorithm, which is a security algorithm used to protect data transmitted between the primary node and the terminal device.
  • the processing module 1301 is used to determine that the key length of the first security algorithm is not supported; the transceiver module 1302 is further used to send a node response to the primary node, where the node response is used to indicate that adding the secondary node fails; or,
  • the processing module 1301 is configured to select a second security algorithm; when the key length of the first security algorithm is different from the key length of the second security algorithm, the transceiver module 1302 is further configured to send a node response to the primary node, where the node response is used to indicate that the addition of the secondary node has failed; or
  • the processing module 1301 is used to select a second security algorithm based on the key length of the first security algorithm; the transceiver module 1302 is also used to send a node response to the master node, and the node response is used to indicate that the secondary node is successfully added, wherein the key length of the first security algorithm is the same as the key length of the second security algorithm.
  • processing module 1301 and the transceiver module 1302 can be directly obtained by referring to the relevant description in the above method embodiment, and will not be repeated here.
  • communication device 1400 includes a processor 1410 and an interface circuit 1420.
  • Processor 1410 and interface circuit 1420 are coupled to each other.
  • interface circuit 1420 can be a transceiver or an input/output interface.
  • communication device 1400 may also include a memory 1430 for storing instructions executed by processor 1410, input data required by processor 1410 to execute instructions, or data generated after processor 1410 executes instructions.
  • the processor 1410 is used to implement the functions of the above-mentioned processing module 1301, and the interface circuit 1420 is used to implement the functions of the above-mentioned transceiver module 1302.
  • the module of the wireless access node implements the functions of the wireless access node in the above-mentioned method embodiment.
  • the wireless access node is a master node, and the module of the wireless access node receives information from other modules in the wireless access node (such as a radio frequency module or an antenna), and the information is sent by the auxiliary node to the wireless access node; or, the module of the wireless access node sends information to other modules in the wireless access node (such as a radio frequency module or an antenna), and the information is sent by the wireless access node to the auxiliary node.
  • the module of the wireless access node here can be the baseband chip of the wireless access node, or it can be a distributed unit (DU) or other module.
  • the DU here can be a DU under the open radio access network (O-RAN) architecture.
  • processors in the embodiments of the present application may be a central processing unit (CPU), or may be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field programmable gate arrays (FPGAs), or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof.
  • the general-purpose processor may be a microprocessor or any conventional processor.
  • the method steps in the embodiments of the present application can be implemented by hardware or by a processor executing software instructions.
  • the software instructions can be composed of corresponding software modules, which can be stored in random access memory, flash memory, read-only memory, programmable read-only memory, erasable programmable read-only memory, electrically erasable programmable read-only memory, registers, hard disk, removable hard disk, CD-ROM, or any other form of storage medium known in the art.
  • An exemplary storage medium is coupled to the processor so that the processor can read information from the storage medium and write information to the storage medium.
  • the storage medium can also be an integral part of the processor.
  • the processor and storage medium can be located in an ASIC.
  • the ASIC can be located in a wireless access node.
  • the processor and storage medium can also exist as discrete components in the wireless access node.
  • all or part of the embodiments may be implemented using software, hardware, firmware, or any combination thereof.
  • all or part of the embodiments may be implemented in the form of a computer program product.
  • a computer program product includes one or more computer programs or instructions. When the computer program or instructions are loaded and executed on a computer, the processes or functions of the embodiments of the present application are performed in whole or in part.
  • the computer may be a general-purpose computer, a special-purpose computer, a computer network, a network device, a user device, or other programmable device.
  • the computer program or instructions may be stored in a computer-readable storage medium or transferred from one computer-readable storage medium to another.
  • the computer program or instructions may be transferred from one website, computer, server, or data center to another website, computer, server, or data center via wired or wireless means.
  • the computer-readable storage medium may be any available medium that can be accessed by a computer or a data storage device such as a server or data center that integrates one or more available media.
  • the available media may be magnetic media, such as floppy disks, hard disks, or magnetic tapes; optical media, such as digital video disks; or semiconductor media, such as solid-state drives.
  • the computer-readable storage medium may be a volatile or nonvolatile storage medium, or may include both volatile and nonvolatile types of storage media.
  • At least one means one or more
  • plural means two or more.
  • “And/or” describes the association relationship of associated objects, indicating that three relationships may exist.
  • a and/or B can mean: A exists alone, A and B exist at the same time, and B exists alone, where A and B can be singular or plural.
  • the character “/” generally indicates that the previous and next associated objects are in an “or” relationship; in the formula of this application, the character “/” indicates that the previous and next associated objects are in a “division” relationship.
  • “Including at least one of A, B and C” can mean: including A; including B; including C; including A and B; including A and C; including B and C; including A, B and C.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

Un procédé et un appareil de communication, qui sont utilisés pour réaliser la sécurisation d'un système de communication dans un scénario où le système de communication doit prendre en charge simultanément un algorithme à 128 bits et un algorithme à 256 bits. Le procédé de la présente demande comprend les étapes suivantes : un nœud primaire détermine un nœud secondaire sur la base d'une longueur de clé d'un premier algorithme de sécurité (ou d'une longueur de clé d'un algorithme de sécurité pris en charge par le nœud primaire) et de longueurs de clé d'algorithmes de sécurité pris en charge par des nœuds alternatifs, le premier algorithme de sécurité étant un algorithme de sécurité pour protéger des données transmises entre le nœud primaire et un dispositif terminal, et les nœuds alternatifs comprenant le nœud secondaire ; le nœud primaire envoie une demande de nœud au nœud secondaire, la demande de nœud étant utilisée pour demander l'ajout du nœud secondaire ; en outre, le nœud secondaire détermine un second algorithme de sécurité, le second algorithme de sécurité étant utilisé pour protéger des données transmises entre le nœud secondaire et le dispositif terminal, par exemple, la longueur de clé du second algorithme de sécurité étant égale à la longueur de clé du premier algorithme de sécurité.
PCT/CN2025/075515 2024-02-08 2025-01-27 Procédé et appareil de communication Pending WO2025167843A1 (fr)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202410178204.8 2024-02-08
CN202410178204.8A CN120456001A (zh) 2024-02-08 2024-02-08 一种通信方法及装置

Publications (1)

Publication Number Publication Date
WO2025167843A1 true WO2025167843A1 (fr) 2025-08-14

Family

ID=96613181

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2025/075515 Pending WO2025167843A1 (fr) 2024-02-08 2025-01-27 Procédé et appareil de communication

Country Status (2)

Country Link
CN (1) CN120456001A (fr)
WO (1) WO2025167843A1 (fr)

Citations (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2015139434A1 (fr) * 2014-03-21 2015-09-24 中兴通讯股份有限公司 Procédé et appareil de détermination d'un algorithme de sécurité
WO2018201506A1 (fr) * 2017-05-05 2018-11-08 华为技术有限公司 Procédé de communication et dispositif associé
CN110224982A (zh) * 2014-03-21 2019-09-10 太阳专利信托公司 双连接性中的安全性密钥推导
CN111132157A (zh) * 2019-12-31 2020-05-08 京信通信技术(广州)有限公司 密钥处理方法、装置、基站和存储介质
CN111194032A (zh) * 2018-11-14 2020-05-22 华为技术有限公司 一种通信方法及其装置
CN113068180A (zh) * 2018-08-10 2021-07-02 华为技术有限公司 双连接通信方法及其装置、系统
US20230319554A1 (en) * 2020-11-06 2023-10-05 Huawei Technologies Co., Ltd. Key generation method and apparatus
CN118488435A (zh) * 2023-02-10 2024-08-13 华为技术有限公司 一种密码算法协商方法及装置

Patent Citations (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2015139434A1 (fr) * 2014-03-21 2015-09-24 中兴通讯股份有限公司 Procédé et appareil de détermination d'un algorithme de sécurité
CN110224982A (zh) * 2014-03-21 2019-09-10 太阳专利信托公司 双连接性中的安全性密钥推导
WO2018201506A1 (fr) * 2017-05-05 2018-11-08 华为技术有限公司 Procédé de communication et dispositif associé
CN113068180A (zh) * 2018-08-10 2021-07-02 华为技术有限公司 双连接通信方法及其装置、系统
CN111194032A (zh) * 2018-11-14 2020-05-22 华为技术有限公司 一种通信方法及其装置
CN111132157A (zh) * 2019-12-31 2020-05-08 京信通信技术(广州)有限公司 密钥处理方法、装置、基站和存储介质
US20230319554A1 (en) * 2020-11-06 2023-10-05 Huawei Technologies Co., Ltd. Key generation method and apparatus
CN118488435A (zh) * 2023-02-10 2024-08-13 华为技术有限公司 一种密码算法协商方法及装置

Also Published As

Publication number Publication date
CN120456001A (zh) 2025-08-08

Similar Documents

Publication Publication Date Title
US11895157B2 (en) Network security management method, and apparatus
US11533610B2 (en) Key generation method and related apparatus
US8595485B2 (en) Security management method and system for WAPI terminal accessing IMS network
JP2022502908A (ja) Ｎａｓメッセージのセキュリティ保護のためのシステム及び方法
WO2019019736A1 (fr) Procédé de mise en œuvre de sécurité, et appareil et système associés
WO2022147803A1 (fr) Procédé et dispositif de communication sécurisée
WO2013185735A2 (fr) Procédé et système de cryptage
US20220303763A1 (en) Communication method, apparatus, and system
WO2011091771A1 (fr) Procédé, dispositif et système d'authentification de noeud de relais
KR20230008697A (ko) 비-3gpp 핸드오버 준비
CN113676904A (zh) 切片认证方法及装置
CN112995993A (zh) 无线网络切换方法及设备
WO2021195816A1 (fr) Procédé, appareil et système de communication
WO2010069202A1 (fr) Procédé de négociation d'authentification et système associé, passerelle de sécurité, noeud local b
WO2023016160A1 (fr) Procédé d'établissement de session et appareil associé
JP4687788B2 (ja) 無線アクセスシステムおよび無線アクセス方法
WO2022247812A1 (fr) Procédé d'authentification, dispositif de communication et système
CN113784351B (zh) 切片服务验证方法、实体及设备
CN103858485A (zh) 一种rrc连接重建方法、设备和网络系统
CN115226052B (zh) 数据处理方法、区块链功能设备及存储介质
WO2025167843A1 (fr) Procédé et appareil de communication
US20250126476A1 (en) Security decision negotiation method and network element
WO2025066797A1 (fr) Procédé et appareil de communication
WO2025113396A1 (fr) Procédé et appareil de communication
TW202416740A (zh) 認證授權的方法與通信裝置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 25751443

Country of ref document: EP

Kind code of ref document: A1