[go: up one dir, main page]

WO2018076190A1 - Procédé de communication, terminal, dispositif de plan utilisateur de réseau central et dispositif de réseau d'accès - Google Patents

Procédé de communication, terminal, dispositif de plan utilisateur de réseau central et dispositif de réseau d'accès Download PDF

Info

Publication number
WO2018076190A1
WO2018076190A1 PCT/CN2016/103324 CN2016103324W WO2018076190A1 WO 2018076190 A1 WO2018076190 A1 WO 2018076190A1 CN 2016103324 W CN2016103324 W CN 2016103324W WO 2018076190 A1 WO2018076190 A1 WO 2018076190A1
Authority
WO
WIPO (PCT)
Prior art keywords
data
information
signature value
sent
terminal
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2016/103324
Other languages
English (en)
Chinese (zh)
Inventor
王江胜
胡力
陈璟
李�赫
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Huawei Technologies Co Ltd
Original Assignee
Huawei Technologies Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Huawei Technologies Co Ltd filed Critical Huawei Technologies Co Ltd
Priority to PCT/CN2016/103324 priority Critical patent/WO2018076190A1/fr
Publication of WO2018076190A1 publication Critical patent/WO2018076190A1/fr
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials

Definitions

  • the invention designs the communication field, in particular, the communication method, the terminal, the core network user plane device and the access network device.
  • small data has at least the following characteristics: small amount of data and long interval between transmissions.
  • the user equipment can report the power usage information once a month.
  • the power usage information reported by the user equipment is a small data.
  • the transmission of small data like the transmission of other traditional types of data, also requires the security of data, that is, the security of small data during transmission.
  • the user equipment needs to use more resources for a large number of signaling interactions each time before recovering from the idle state of the data transmission to the connection state of the data transmission to transmit the small data. To resume the session between the user device and the network side.
  • the communication method, the terminal, the core network user plane device, the access network device and the communication system provided by the invention can reduce the data transmission time overhead and improve the utilization of communication resources.
  • the present invention provides a communication method, including: a terminal encrypts plaintext data according to a first key and a first security capability of the terminal, to obtain encrypted data; and the terminal sends a user plane device to a core network.
  • Sending data to be sent, the encrypted data and the label, the label includes security capability information, first ciphertext information of the first key, and a first signature value, where the security capability information is A plaintext information or ciphertext information of a security capability, the first signature value being a signature value obtained by signing the security capability information and the first ciphertext information.
  • the terminal encrypts the plaintext data according to the first security capability and the first key to obtain encrypted data, which can improve the security of the data in the transmission process; the terminal sends the encrypted data.
  • the first ciphertext information encrypted by the first key and the security capability information of the terminal are carried in the data to be sent carrying the encrypted data, so that the core network user plane device can be based on the security capability information and the first key.
  • the encrypted data in the data to be sent is decrypted to obtain the plaintext data, and the first ciphertext information of the first key is carried in the data to be sent, so that the first key can be securely protected; secondly, the data to be sent is And carrying the first signature value obtained by the first ciphertext information and the security capability information, so that the core network user plane device can perform security verification according to the first signature value, so that the terminal and the core network user plane device do not need to be used.
  • security verification is performed over a long period of time and using more resources before transmitting the encrypted data.
  • the core network user plane device performs security verification on the data to be sent of the terminal, so that end-to-end secure communication between the core network user plane device and the terminal can be realized.
  • the to-be-sent data further includes a second signature value
  • the communication method further includes: the terminal, according to the first security capability and the second key pair, the first data and The tag is signed to obtain the second signature value, and the first data is the plaintext data or the encrypted data.
  • the terminal also signs one of the plaintext data and the encrypted data, and the label, that is, the integrity signature, and the core network user plane device and/or the access network device correspondingly can complete the integrity.
  • the second signature value obtained by the signature is verified, so that the integrity of the data can be protected.
  • the time for the terminal signature to obtain the second signature value can be reduced; if the terminal signs the encrypted data and the label instead of the plaintext data
  • the core network user plane device can directly verify the second signature value according to the encrypted data without decrypting the encrypted data, thereby reducing the time for the core network user plane device to verify the second signature value.
  • the data to be sent further includes additional information, where the additional information is used for an anti-replay attack; wherein the terminal is configured according to the first security capability and the second key pair.
  • the first data and the label are signed to obtain a second signature value, including: the terminal, according to the first security capability and the second key, the additional information, the first data, and the The tag is signed to obtain the second signature value.
  • the data to be sent sent by the terminal further carries the additional information, and the integrity information is also performed on the additional information, so that the anti-replay protection of the data can be implemented.
  • the second key is a private key of the terminal.
  • the terminal uses its private key for integrity signature, so that the core network user plane device and/or the access network device can use the public key of the terminal to verify the second signature value in the data to be sent. Therefore, the maintenance cost of the core network user plane device and/or the access network device is low.
  • the communication method further includes: receiving, by the terminal, a security context sent by the core network user plane device by using a secure channel, where the security context includes the first key and the label .
  • the security context may further include the plaintext information of the first security capability of the terminal.
  • the terminal acquires a security context from the core network user plane device, and encrypts the plaintext data according to the first key in the security context and the first security capability of the terminal, and sends the security data after the transmission is carried.
  • the data to be sent in the data also carries the label in the security context, so that the core network user plane device and/or the access network device can obtain the data in the to-be-sent data according to various information in the label in the data to be sent, thereby
  • the security network can ensure the secure communication of data without requiring storage and maintenance of security contexts on the core network user plane device and/or the access network device, thereby reducing the operational burden of the core network user plane device and/or the access network device.
  • the communication method further includes: receiving, by the terminal, a security context sent by the core network user plane device by using a secure channel, where the security context includes the first key, the label And the second key, the label further includes second ciphertext information, and the second ciphertext information is ciphertext information of the second key.
  • the security context may further include the first security capability of the terminal.
  • the terminal may further carry the second ciphertext information obtained by encrypting the second key used for the integrity signature in the label of the data to be sent, so that the core network user plane device can be sent.
  • the second ciphertext information carried in the data is decrypted, and the second signature value in the to-be-sent data, that is, the integrity signature value, is verified according to the decrypted second key.
  • This symmetry integrity signature and verification algorithm for integrity signature values results in short computation times.
  • the label further includes first plaintext information, where the first plaintext information includes at least one of the following: routing information of the core network user plane device, identifier information of the label, Identification information of the terminal, identification information of the user plane device of the core network, and valid time information of the label; wherein the first signature value is the security capability information and the location The signature value obtained by signing the first ciphertext information and the first plaintext information.
  • the present invention provides a communication method, including: a core network user plane device receiving data to be sent sent by a terminal, the data to be transmitted includes encrypted data and a label, and the encrypted data is the first according to the terminal.
  • the data obtained by encrypting the plaintext data by the key and the first security capability of the terminal, the label includes security capability information, first ciphertext information of the first key, and a first signature value, the security capability
  • the information is the plaintext information or the ciphertext information of the first security capability
  • the first signature value is a signature value obtained by signing the security capability information and the first ciphertext information; if the core network user plane And the device discards the to-be-sent data if the device fails to verify the first signature value in the label of the to-be-sent data; or if the core network user plane device sends the label to the to-be-sent data If the first signature value is successfully verified, the core network user plane device decrypts the first ciphertext information in the to-be-sent data to
  • the core network user plane device can verify the first signature value in the label of the data to be sent according to the first ciphertext information and the security capability information in the label in the data to be sent.
  • the data to be sent is discarded when the verification fails, or when the verification is successful, the first key in the label is obtained to obtain data in the data to be sent.
  • the communication method enables the terminal to securely transmit data with the core network without wasting a lot of time and resources to restore the session, thereby saving data transmission time overhead and improving resource utilization.
  • the core network user plane device treats the transmitted data for security verification, and can implement an end-to-end secure transmission mechanism between the terminal and the core network user plane device.
  • the to-be-sent data further includes a second signature value, where the second signature value is, according to the first security capability and the second key pair, the first data and the And the first data is the plaintext data
  • the communication method further includes: the core network user plane device according to the second key and the to-be-sent data
  • the security capability information is used to verify the second signature value in the to-be-sent data; when the core network user plane device fails to verify the second signature value in the to-be-sent data, the device is discarded. send data.
  • the terminal since the second signature value is a signature value obtained by signing the plaintext data and the label, the terminal generates the second value compared to the signature value obtained by signing the encrypted data and the label with the second signature value. Signature values can be used for less time.
  • the core network user plane device After the first signature value is successfully verified and the plaintext data is obtained, the second signature value in the data to be sent is verified, and the data to be sent that is failed to be verified is discarded, so that the integrity of the data can be protected.
  • the data to be sent further includes a second signature value, where the second signature value is obtained by the terminal signing the first data and the label according to the second key.
  • the first data is the encrypted data
  • the core network user plane device decrypts the first ciphertext information in the to-be-sent data, obtains the first key, and according to the waiting Transmitting the security capability information and the first key in the data, and decrypting the encrypted data to obtain the plaintext data, including: the core network user plane device according to the second key and the Verifying, by the security capability information in the data to be sent, the second signature value in the to-be-sent data; and verifying, by the core network user plane device, the second signature value in the to-be-sent data Upon successful, the core network user plane device decrypts the first ciphertext information in the to-be-sent data, obtains the first key, and according to the first key and the to-be-sent data The safety energy Information, the encrypted data is decrypted, to obtain the plaintext data.
  • the core network user plane device can send the plain signature data without successfully obtaining the plaintext data after successfully verifying the first signature value.
  • the second signature value in the data is verified so that less time can be used to verify the second signature value.
  • the core network user plane device obtains the plaintext data when the second signature value is verified successfully, otherwise the data to be sent is discarded, so that the integrity of the data can be protected.
  • the communication method further includes: when the core network user plane device fails to verify the second signature value in the to-be-sent data, discarding the to-be-sent data.
  • the data to be sent further includes additional information, where the additional information is used for an anti-replay attack, and the second signature value is the terminal according to the first security capability and the A signature value obtained by signing the additional information, the first data, and the tag by a second key.
  • the data to be sent by the terminal further carries the additional information, and the integrity information is also performed on the additional information, so that the playback protection of the data can be implemented.
  • the second key is a private key of the terminal, where the core network user plane device is configured according to the second key and the security in the to-be-sent data.
  • the core network user plane device can use the public key of the terminal to verify the integrity signature value in the data to be transmitted. This makes the maintenance cost of the key for the core network user plane device low.
  • the communication method further includes: the core network user plane device sends a security context to the terminal by using a secure channel, where the security context includes the first key and the label; The core network user plane device deletes the security context.
  • the security context is not stored and maintained, but the information in the data to be sent sent by the terminal is used to implement secure communication of data, thereby reducing The operational burden of the core network user plane device.
  • the core network user plane device may directly perform subsequent related operations according to the security capability information.
  • the security capability information in the tag is ciphertext information of the first security capability
  • the security context may include plaintext information of the first security capability.
  • the communication method further includes: the core network user plane device sends a security context to the terminal by using a secure channel, where the security context includes the first key, the label, and The second key, the label further includes second ciphertext information, where the second ciphertext information is ciphertext information of the second key; and the core network user plane device deletes the security context;
  • the core network user plane device verifies the second signature value in the to-be-sent data according to the second key and the security capability information in the to-be-sent data, including: The core network user plane device verifies the second signature value in the to-be-sent data according to the security capability information in the to-be-sent data and the second ciphertext information in the to-be-sent data.
  • the terminal carries the encrypted second ciphertext information of the second key used for the integrity signature in the data to be sent, so that the core network user plane device can carry the data to be sent.
  • the second ciphertext information is decrypted to obtain a second key to verify the second signature value in the data to be transmitted, and the symmetry integrity signature and integrity signature value verification algorithm Make the calculation time short.
  • the label further includes first plaintext information, where the first plaintext information includes at least one of the following: routing information of the core network user plane device, identifier information of the label, The identifier information of the terminal, the identifier information of the user plane device of the core network, or the valid time information of the label, where the first signature value is the security capability information, the first ciphertext information, and the location The signature value obtained by signing the first plaintext information.
  • the core network user plane device can verify the identifier information of the terminal to verify whether the terminal belongs to the terminal domain.
  • the core network user plane device can verify the valid time of the label to check whether the label is A label that falls within the validity period.
  • the present invention provides a communication method, including: an access network device receives first data to be sent by a terminal, the first data to be sent includes encrypted data and a label, and the label includes security capability information, a first ciphertext information of the key and a first signature value, where the security capability information is plaintext information of the first security capability of the terminal, and the first signature value is the security capability information and the first a signature value obtained by signing the ciphertext information, where the encrypted data is data obtained by the terminal encrypting the plaintext data according to the first security capability and the first key; Sending, to the core network user plane device, the second to-be-sent data, where the first signature value in the first to-be-sent data is successfully verified, where the second to-be-sent data includes the encrypted data and the label; or And the access network device fails to verify the first signature value in the first to-be-sent data, and discards the first to-be-sent data.
  • the access network device can verify the first to-be-sent data according to the label in the first to-be-sent data, so that the terminal can perform the network with the core network without wasting a lot of time and resources to restore the session. Secure transmission of data, thereby saving data transmission time overhead and improving resource utilization.
  • the access network device verifies the first to-be-sent data, and discards the first to-be-sent data that fails to be verified, thereby reducing the verification pressure of the core network user plane device.
  • the first to-be-sent data further includes a second signature value, where the second signature value is the terminal according to the first security capability and the private key of the terminal.
  • Encrypting data and a signature value obtained by signing the label wherein, the access network device successfully verifies the first signature value in the label of the first to-be-sent data, and then sends the signature to the core network Transmitting, by the user plane device, the second to-be-sent data, the access network device performing the second signature value in the first to-be-sent data according to the security capability information and the public key of the terminal If the access network device verifies the first signature value in the label of the first to-be-sent data successfully, and verifies the second signature value in the first to-be-sent data. If successful, the second to-be-sent data is sent to the core network user plane device.
  • the access network device can verify the second signature value in the data to be sent, so that the integrity of the data can be protected.
  • the second to-be-sent data further includes the second signature value.
  • the data to be sent sent by the access network device to the user equipment of the core network further includes a second signature value
  • the user equipment of the core network can verify the integrity of the data to be sent according to the second signature value.
  • the first to-be-sent data further includes additional information, where the additional information is used for an anti-replay attack, and the second signature value is used by the terminal according to the first security capability and A signature value obtained by signing the encrypted data, the label, and the additional information by a private key of the terminal.
  • the data to be sent sent by the terminal further carries information such as a time stamp, and the information such as the time stamp corresponding to the data to be sent is integrity signed, so that the data can be anti-replayed. protection.
  • the label further includes the identifier information of the terminal
  • the communication method further includes: the access network device verifies whether the terminal belongs to the terminal according to the identifier information of the terminal The access network device discards the first to-be-sent data when the terminal device does not belong to the terminal domain according to the identifier information of the terminal.
  • the label further includes routing information of the core network user plane device
  • the communications method further includes: the access network device determining the core network according to the routing information User plane device.
  • the label further includes identifier information of the core network user plane device
  • the communication method further includes: the access network device according to the identifier of the core network user plane device Verifying that the core network user plane device belongs to the core network user plane device domain; the access network device verifies that the core network user plane device does not belong to the core network user plane device according to the identifier information of the core network user plane device When the domain is in the domain, the first to-be-sent data is discarded.
  • the present invention provides a terminal, the terminal comprising Module of the communication method.
  • the present invention provides a core network user plane device, the core network user plane device comprising a module for performing the communication method of the second aspect.
  • the present invention provides an access network device, the access network device comprising means for performing the communication method of the third aspect.
  • the present invention provides a communication system comprising the terminal of the fourth aspect and the core network user plane device of the fifth aspect.
  • the communication system may further include the access network device of the sixth aspect.
  • the present invention provides a terminal comprising a memory, a processor, a receiver, and a transmitter, the memory for storing code, the processor for executing code in the memory, the receiver and The transmitter is used to communicate with other devices.
  • the processor invokes the receiver and transmitter to implement the communication method in the first aspect.
  • the present invention provides a core network user plane device, including a memory, a processor, a receiver, and a transmitter, the memory for storing code, and the processor for executing code in the memory,
  • the receiver and transmitter are used to communicate with other devices.
  • the processor invokes the receiver and transmitter to implement the communication method of the second aspect.
  • the present invention provides an access network device including a memory, a processor, a receiver, and a transmitter, the memory for storing code, the processor for executing code in the memory, Receivers and transmitters are used to communicate with other devices.
  • the processor invokes the receiver and the transmitter to implement the communication method in the third aspect.
  • the present invention provides a communication system comprising the terminal of the eighth aspect and the core network user plane device of the ninth aspect.
  • the communication system may further include the access network device of the tenth aspect.
  • the invention provides a computer readable medium storing program code for execution by a terminal, the program code comprising instructions for performing the communication method of the first aspect.
  • the present invention provides a computer readable medium storing program code for execution by a core network user plane device, the program code comprising a communication method for performing the second aspect Instructions.
  • the present invention provides a computer readable medium storing program code for execution by an access network device, the program code comprising for performing a third aspect The instruction of the communication method.
  • FIG. 1 is a schematic structural diagram of an application scenario of an embodiment of the present invention.
  • FIG. 2 is a schematic flowchart of a communication method according to an embodiment of the present invention.
  • FIG. 3 is a schematic flowchart of a communication method according to an embodiment of the present invention.
  • FIG. 4 is a schematic structural diagram of a terminal according to an embodiment of the present invention.
  • FIG. 5 is a schematic structural diagram of a core network user plane device according to an embodiment of the present invention.
  • FIG. 6 is a schematic structural diagram of an access network device according to an embodiment of the present invention.
  • FIG. 7 is a schematic structural diagram of a terminal according to an embodiment of the present invention.
  • FIG. 8 is a schematic structural diagram of a core network user plane device according to an embodiment of the present invention.
  • FIG. 9 is a schematic structural diagram of an access network device according to an embodiment of the present invention.
  • FIG. 10 is a schematic structural diagram of a communication system according to an embodiment of the present invention.
  • the communication system shown in FIG. 1 includes a terminal 110, an access network device 120, a core network user plane device 130, a core network control plane device 140, and an Internet 150.
  • the terminal 110 can access one or more core network user plane devices 130 and one or more core network control plane devices 140 in the core network (CN) via the access network device 120 to communicate with the core network.
  • the terminal 110 can also access the Internet 150 through the core network user plane device 130.
  • a terminal may also be called an access terminal, a user equipment (User Equipment, UE), a subscriber unit, a subscriber station, a mobile station, a mobile station, a remote station, a remote terminal, a mobile device, a user terminal, a terminal device, a wireless communication device, and a user. Agent or user device.
  • the UE may be a cellular phone, a cordless phone, a Session Initiation Protocol (SIP) phone, a Wireless Local Loop (WLL) station, a Personal Digital Assistant (PDA), or a wireless communication function.
  • SIP Session Initiation Protocol
  • WLL Wireless Local Loop
  • PDA Personal Digital Assistant
  • Terminal 110 may also be referred to as a Next Generation (NG) UE, such as a terminal in the Internet Of Things (IOT).
  • NG Next Generation
  • IOT Internet Of Things
  • the access network device 120 is an access network (AN), such as a device in a radio access network (RAN).
  • the access network device 120 may be a base station, such as a Global System for Mobile communication (GSM) system or a Base Transceiver Station (BTS) in a Code Division Multiple Access (CDMA) system. It can also be a base station (NodeB) in a Wideband Code Division Multiple Access (WCDMA) system, or an Evolutionary Node B (eNB or a Long Term Evolution (LTE) system).
  • GSM Global System for Mobile communication
  • BTS Base Transceiver Station
  • CDMA Code Division Multiple Access
  • NodeB base station
  • WCDMA Wideband Code Division Multiple Access
  • eNB Evolutionary Node B
  • LTE Long Term Evolution
  • the core network user plane device 130 may also be referred to as a User Plane-Core Network (UP-CN), which can implement a data packet forwarding function, which may be a core network user plane device in a future 5G system, such as an S in an LTE system. -GW similar network device; the core network control plane device 140 may also be called a Control Plane-Core Network (CP-CN), which can implement a control message or signaling forwarding function, such as a mobile management network element (Mobile Management Network, MM) ) Similar network devices.
  • UP-CN User Plane-Core Network
  • CP-CN Control Plane-Core Network
  • An IP network is a network in which computer networks using an IP protocol are connected to each other.
  • the embodiment of the present invention is not limited to the communication system architecture shown in FIG. 1.
  • the device in FIG. 1 may be hardware, functionally divided software, or a combination of the two.
  • the security context of the terminal 110 is stored on the access network device 120.
  • the terminal 110 when the terminal 110 communicates with the access network device 120, the security context of the terminal 110 is stored on the access network device 120.
  • the terminal 110 if the terminal 110 is in an idle state and needs to send data to the access network device, it needs to use more resources and signaling to recover from the idle state to the connected state, such as completing the authentication process, and then restoring with the access network device. Session to send data to the access network device.
  • the terminal and the access network are caused. More resources and time are spent between the device or the core network user plane device, only a small amount of data is transmitted, thereby increasing the time transmission overhead of the data and reducing the utilization of resources.
  • the small data in the embodiment of the present invention may refer to data with a small amount of data, and may also refer to data with a long interval of transmission, and may also refer to data with a small amount of data and a long interval of transmission.
  • the size of the data may be within the data packet.
  • the user's power usage information for one month can be a small amount of data.
  • the terminal 110 When the terminal 110 transmits data with a long interval, it may generally mean that the interval of the data packet sent by the terminal 110 exceeds the time when the terminal 110 enters the idle state. For example, in the smart meter reading system, the terminal reports the power usage information once a month.
  • the present invention proposes a new communication method, terminal, core network user plane device, access network device, and communication system.
  • FIG. 2 is a schematic flowchart of a communication method according to an embodiment of the present invention. It should be understood that FIG. 2 illustrates steps or operations of the communication method, but these steps or operations are merely examples, and embodiments of the present invention may perform other operations or variations of the various operations in FIG. 2.
  • the terminal encrypts the plaintext data according to the first key and the first security capability of the terminal, to obtain encrypted data.
  • the terminal may be the terminal 110 shown in FIG. 1.
  • the terminal encrypts the plaintext data according to the first key and the first security capability of the terminal, and before the encrypted data is obtained, the terminal may store the first key and the terminal for encrypting the plaintext data.
  • a security capability
  • the plaintext data may be the service data of the terminal, or may be other data, such as a context for establishing a session or a bearer.
  • the first security capability of the terminal may include a security algorithm identifier set, such as an encryption algorithm identifier or an integrity protection algorithm identifier.
  • the terminal encrypts the plaintext data according to the first key and the first security capability of the terminal, and the following implementation manner is adopted: the terminal determines the corresponding encryption according to the identifier of the encryption algorithm. The algorithm encrypts the plaintext data using the first key and the encryption algorithm.
  • the first security capability of the terminal may be a security capability determined by the terminal and the core network user plane device according to the security capability supported by the terminal, or may be a security capability pre-agreed by the terminal and the core network user plane device.
  • the security capabilities supported by the terminal may include a set of at least one security algorithm that the terminal may use when encrypting or decrypting.
  • the set of identifiers of all security algorithms that the terminal can use or can support can be referred to as a set of security algorithm identifiers supported by the terminal.
  • the set of security algorithm identifiers supported by the terminal may include at least one encryption algorithm identifier and/or at least one integrity protection algorithm identifier.
  • the first security capability of the terminal is a security capability determined by the terminal and the core network user plane device according to the security capability supported by the terminal, including: the first security capability of the terminal includes the security supported by the terminal and the core network user plane device from the terminal.
  • the algorithm identification set some or all of the security algorithm identifiers determined by negotiation are determined.
  • S220 The terminal sends the to-be-sent data to the core network user plane device, where the to-be-sent data includes the encrypted data and the label.
  • the tag includes first ciphertext information, security capability information, and a first tag value.
  • the first ciphertext information is the ciphertext information obtained after the first key is encrypted;
  • the security capability information may be the plaintext information of the first security capability of the terminal, or may be the ciphertext information of the first security capability, that is, the first The ciphertext obtained by encrypting the plaintext information of the security capability;
  • the first signature value is the signature value obtained after the security capability information and the first ciphertext information are signed.
  • the security capability information may be the ciphertext information obtained by the unified encryption of the first key and the first security capability when the security capability information is the ciphertext information of the first security capability. That is, from the form, the security capability information and the first ciphertext information are carried in the same ciphertext information.
  • the core network user plane device may be the core network user plane device 130 shown in FIG. 1. Correspondingly, the core network user plane device receives the data to be sent sent by the terminal.
  • the terminal when the first key and the first security capability are stored on the terminal, if the terminal needs to send data to the user plane device of the core network (the data is referred to as plaintext data in the embodiment of the present invention), The first security capability and the first key encrypt the plaintext data to obtain the encrypted data. Then, the terminal may compose the encrypted data and the label into the to-be-sent data, and send the to-be-sent data to the core network user plane device.
  • the terminal composes the encrypted data and the label into the data to be transmitted
  • the encrypted data and the label can be encapsulated into the same data packet.
  • the core network user plane device receives After the data packet is obtained, the data to be sent is obtained from the data packet, and the encrypted data and the label can be obtained.
  • the terminal can also encapsulate the encrypted data and the label into different data packets, that is, the data to be sent is encapsulated into multiple data packets.
  • the core network user plane device can obtain the label from one data packet, and then obtain the encrypted data from another data packet.
  • the terminal can also uniformly encapsulate the data to be sent composed of the encrypted data and the label into different data packets.
  • the core network user plane device can obtain the data to be sent from the plurality of data packets, that is, obtain the encrypted data and the label.
  • the core network user plane device verifies the first signature value in the data to be sent, and if the verification fails, discards the data to be sent; or, if the verification succeeds, sends the data to be sent.
  • the first ciphertext information in the label of the data is decrypted to obtain a first key, and the encrypted data is decrypted according to the security capability information and the first key in the data to be sent to obtain plaintext data.
  • the terminal encrypts the plaintext data according to the first security capability and the first key to obtain encrypted data, which can improve the security of the data during transmission; when the terminal sends the encrypted data, the terminal carries the encrypted data.
  • the to-be-sent data carries the first ciphertext information encrypted by the first key and the security capability information of the terminal, so that the core network user plane device can decrypt the encrypted data in the to-be-sent data according to the security capability information and the first key.
  • the first ciphertext information of the first key is carried in the data to be sent, so that the first key can be securely protected; secondly, the first ciphertext information is carried in the data to be sent.
  • the core network user plane device can perform security verification according to the first signature value, so that the terminal and the core network user plane device do not need to send encrypted data in order to resume the session.
  • Security verification is achieved by taking a long time and using more resources.
  • the core network user plane device performs security verification on the to-be-sent data of the terminal, so that the end-to-end security communication between the core network user plane device and the terminal can be realized. letter.
  • step S230 when the security capability information in the to-be-sent data is the plaintext information of the first security capability of the terminal, in step S230, the core network user plane device according to the security capability information in the data to be sent and
  • the specific implementation manner of decrypting the encrypted data by the first key may be as follows:
  • the core network user plane device decrypts the encrypted data according to the first key and the plaintext information of the first security capability.
  • step S230 when the security capability information in the to-be-sent data is the ciphertext information of the first security capability of the terminal, in step S230, the core network user plane device according to the security capability in the data to be sent The information and the first key are used to decrypt the encrypted data, and the following implementation manners may be adopted:
  • the core network user plane device decrypts the security capability information in the data to be sent, obtains the plaintext information of the first security capability, and decrypts the encrypted data according to the first key and the plaintext information of the first security capability.
  • the core network user plane device decrypts the security capability information in the data to be sent, and obtains the plaintext information of the first security capability, meaning that the core The network user plane device also decrypts the first ciphertext information to obtain the first key; or the core network user plane device decrypts the first ciphertext information in the data to be sent to obtain the first key, which means that the core network user
  • the face device is also decrypted by the security capability information to obtain the plaintext information of the first security capability.
  • the core network user plane device decrypts the security capability information in the data to be sent to obtain the plaintext information of the first security capability, and the first ciphertext in the label of the core network user plane device to send the data.
  • the information is decrypted to obtain the first key, and the following steps can be synthesized:
  • the core network user plane device decrypts the same ciphertext information including the first ciphertext information and the security capability information in the data to be sent, and obtains the first key and the plaintext information of the first security capability.
  • the core network user plane device decrypts the encrypted data according to the first key and the plaintext information of the first security capability, which may be implemented in the following manner: the core network user plane device is determined.
  • the encryption algorithm included in the first security capability identifies the corresponding encryption algorithm, and decrypts the encrypted data using the first key and the encryption algorithm.
  • the embodiment of the present invention does not limit the order in which the core network user plane device performs the following steps: the first signature value in the label of the data to be sent is verified; in the label of the data to be sent The first ciphertext information is decrypted to obtain a first key, and the encrypted data is decrypted according to the security capability information and the first key in the data to be transmitted to obtain plaintext data.
  • the core network user plane device may first decrypt the first ciphertext information in the label of the sending data to obtain the first key, and decrypt the encrypted data according to the security capability information and the first key, and then send the data to be sent.
  • the first signature value in the label is verified. If the verification fails, the data to be sent is discarded; if the verification is successful, the plaintext data can be forwarded.
  • the first signature value in the core network user plane device to be sent in the data is successfully verified, and then in the label of the data to be sent.
  • Decrypting the first ciphertext information to obtain a first key, and decrypting the encrypted data according to the security capability information and the first key in the data to be sent may be used to prevent the core network user plane device from avoiding the failure of the first signature value verification before
  • the step of "decrypting the first ciphertext information in the tag to be sent data to obtain the first key and decrypting the encrypted data according to the security capability information and the first key" improves resource utilization.
  • an exemplary implementation manner of verifying the first signature value in the label of the core network user plane device to be sent data may be: signing the first ciphertext information and the security capability information in the label of the data to be sent. And obtaining a first verification signature value for verifying the first signature value; comparing the first signature value in the label in the data to be transmitted with the first verification signature value. If the first signature value does not match the first verification signature value, the verification of the first signature value fails; if the match, the verification of the first signature value is successful.
  • the communication method shown in FIG. 2 may further include: the terminal signs the first data and the label according to the first security capability and the second key of the terminal, to obtain a second signature value,
  • the first data is plaintext data or ciphertext data.
  • the data to be sent sent by the terminal to the user plane device of the core network may further include the second signature value.
  • the data to be sent received by the core network user plane device further includes a second signature value, and if the second signature value is obtained by the terminal signing the first data and the label according to the first security capability and the second key, And the first data is the plaintext data, the communication method performed by the core network user plane device may further include: verifying, according to the second key and the security capability information in the to-be-sent data, the second signature value in the data to be sent; If the verification of the second signature value in the data to be transmitted fails, the data to be transmitted is discarded.
  • the plaintext data may be forwarded.
  • the data to be sent received by the core network user plane device further includes a second signature value, where the second signature value is obtained by the terminal signing the first data and the label according to the first security capability and the second key.
  • the first data is ciphertext data
  • the first ciphertext information in the data to be sent by the core network user plane device is decrypted to obtain the first key, and according to the security capability information in the data to be sent. And decrypting the encrypted data with the first key to obtain plaintext data, including:
  • the core network user plane device verifies the second signature value in the data to be sent according to the second key and the security capability information in the data to be sent; if the second signature value in the data to be sent by the core network user plane device is successfully verified, Then, the first ciphertext information in the data to be sent by the core network user plane device is decrypted, the first key is obtained, and the encrypted data is decrypted according to the first key and the security capability information in the data to be sent, to obtain the plaintext data. .
  • the data to be sent is discarded.
  • the foregoing terminal sends, to the core network user plane device, a to-be-sent data that further includes a second signature value, and the core network user plane device verifies the second signature value in the communication method, because the second signature value is the terminal-to-first data sum.
  • the signature value obtained by the signature of the tag so that the core network user plane device discards the to-be-sent data when the second signature value fails to be verified, thereby preventing the core network user plane device from encrypting the data to be sent that is attacked or tampered with.
  • the plaintext data corresponding to the data is forwarded normally. Thereby achieving data integrity protection.
  • the terminal sends a data to be sent to the core network user plane device, which further includes a second signature value, and the core network user plane device verifies the second signature value in the communication method, and the core network user plane device according to the second key and the
  • the step of verifying the security capability information in the data and verifying the second signature value in the data to be sent may be located in the core network user before the first signature value in the label of the user network device to be sent by the core network is verified. After the face device verifies the first signature value in the tag of the data to be sent.
  • the core network user plane device may first decrypt the encrypted data in the sent data, and obtain the plaintext data, and then verify the first signature value in the label of the data to be sent. If the verification of the first signature value is successful, the second signature value in the data to be transmitted is verified. If the verification of the second signature value fails, the data to be sent is discarded, and if the second signature value is verified, the plaintext number may be forwarded. according to.
  • the core network user plane device may first verify the first signature value in the label of the data to be sent. If the verification of the first signature value is successful, the encrypted data in the transmission data is decrypted to obtain plaintext data. The second signature value in the transmitted data is then verified. If the verification of the second signature value fails, the data to be sent is discarded, and if the second signature value is verified, the plaintext data may be forwarded.
  • the core network user plane device may first verify the first signature value in the label of the data to be sent. If the verification of the first signature value fails, the data to be sent is discarded; if the verification of the first signature value is successful, the second signature value in the transmission data is verified. If the verification of the second signature value fails, the data to be sent is discarded. If the second signature value is verified, the encrypted data in the data to be transmitted is decrypted to obtain plaintext data, and finally the plaintext data is forwarded.
  • the core network user plane device first verifies the first signature value, and then verifies the second signature value, if the second signature value is the signature value obtained by the terminal signing the plaintext data and the label, regardless of the encryption according to the encryption
  • the step of obtaining the plaintext data is to perform the step of obtaining the plaintext data based on the encrypted data before verifying the first signature value or after verifying the first signature value, before the second signature value is verified. Because the core network user plane device needs to obtain the plaintext data first, the plaintext data and the label can be signed to obtain the second verification signature value, so that the second signature value is verified according to the second verification signature value.
  • the core network user plane device verifies the second signature value in the data to be sent according to the second key and the security capability information in the data to be sent, and may adopt the following implementation manner: the core network user plane device is based on the second secret The key and the security capability information in the data to be sent, the first data and the label are signed to obtain a second verification signature value; the second signature value and the second verification signature value are compared, and if the matching, the second signature value is successfully verified. If it does not match, the verification of the second signature value fails.
  • the second verification signature is a signature value obtained by the terminal hashing the first data and the label and encrypting the result of the hash operation according to the first security capability and the second key
  • the second verification signature The value may be a signature value obtained by the core network user plane device hashing the first data and the label, and encrypting the result of the hash operation according to the second key and the security capability information in the to-be-sent data.
  • the core network user plane device signs the first data and the label according to the second key and the security capability information in the to-be-sent data, to obtain the first Second, verify the signature value
  • the data to be sent sent by the terminal to the user equipment of the core network may further include additional information, which is used for anti-replay attacks.
  • the additional information may include at least one of a time stamp and first count information.
  • the first count information may be used to synchronize with the second count information on the core network user plane device.
  • a counter on the terminal such as a NAS counter.
  • the counter on the terminal may be used to measure the number of times the terminal sends the data to be sent to the user equipment of the core network.
  • the data to be sent may be data to be sent carrying only the label, or any data to be sent.
  • a counter corresponding to the counter on the terminal may also exist on the core network user plane device, and the counter on the core network user plane device may also be a NAS counter.
  • the counter on the core network user plane device can be used to measure the number of times the terminal sends the data to be sent to the core network user plane device.
  • the data to be sent can be the data to be sent carrying only the label, or any data to be sent.
  • the counters on the core network user plane device can be synchronized with the counters on the terminal.
  • the first count information may be all or part of the count information represented by the counter on the terminal
  • the second count information may be all or part of the count information represented by the counter on the core network user plane device.
  • the first count information may include the 8 bits, or may be only some of the 8 bits, such as 3 bits.
  • the terminal signs the first data and the label according to the first security capability and the second key of the terminal, and obtains the second signature value.
  • the corresponding implementation manner may be: the terminal according to the first security capability and the second key.
  • the additional information, the first data, and the tag are signed to obtain a second signature value.
  • the additional information may be pre-stored on the terminal.
  • the core network user plane device may also record additional information corresponding to the additional information stored on the terminal, for example, the core network user plane device may store a timestamp synchronized with the timestamp on the terminal, and/or may A second count information synchronized with the first calculated information is stored. It should be noted that the timestamp and the first count information on the terminal, or the timestamp and the second count information on the core network user plane device, cannot be repeated in a short time.
  • the core network user plane device If the core network user plane device records the additional information corresponding to the additional information on the terminal, the core network user plane device receives the data to be sent that further includes the additional information, and after verifying the second signature value in the data to be sent, Can be sent according to additional information on the core network user plane device Additional information in the data is verified.
  • the data to be sent may be discarded; if the verification is successful, the plaintext data corresponding to the encrypted data in the data to be sent may be forwarded. That is to say, the core network user plane device can implement anti-replay protection of the data by using additional information in the data to be transmitted.
  • the additional information in the data to be sent sent by the terminal includes the first calculation information
  • the second information that can be synchronized with the first calculation information is recorded on the user equipment of the core network
  • the user equipment of the core network is based on the core network.
  • the additional information on the user plane device verifies the additional information in the data to be sent, and the following implementation manner can be adopted:
  • the core network user plane device compares the second count information included in the stored additional information with the first count information included in the additional information in the to-be-sent data, if the second count information is synchronized with the first count information in the to-be-sent data If the data to be sent is not subjected to a replay attack, that is, the verification is successful; if the second count information is not synchronized with the first count information in the data to be sent, the data to be sent is subjected to a replay attack, that is, the verification fails. .
  • the second key used by the terminal to sign the first data and the label according to the first security capability and the second key to obtain the second signature value may be a private key of the terminal.
  • the core network user plane device verifies the second signature value in the data to be sent according to the second key and the security capability information in the data to be sent, and may include: the core network user plane device according to the terminal public The security capability information in the key and the data to be transmitted, and the second signature value in the data to be transmitted is verified.
  • the communication method shown in FIG. 2 may further include: the core network user plane device sends a security context to the terminal through the secure channel, where the security context includes the first key and the label described above.
  • the terminal receives the security context sent by the core network user plane device.
  • the core network user plane device can send a security context to the terminal through the secure channel when the terminal first accesses or attaches or performs the tracking area update process.
  • the security channel used by the core network user plane device to send the security context to the terminal may be the terminal and the core network user plane device when the terminal first accesses or attaches or reconnects to the core network where the core network user plane device is located.
  • the terminal and the core network user plane device can use the secure channel to complete the negotiation of the first security capability of the terminal, and determine the security context of the terminal according to the first security capability, and finally to the terminal. Send the security context.
  • the determining, by the core network user plane device, the security context according to the first security capability of the terminal may include: determining the first key, and encrypting the first key according to the first security capability of the terminal, to obtain the first ciphertext. Determining the security capability information; signing the first ciphertext information and the security capability information to obtain a first signature value; determining a label including the first ciphertext information, the security capability information, and the first signature value; determining to include the label and The security context of the first key.
  • the security capability information may be plaintext information or ciphertext information of the first security capability of the terminal.
  • the core network user plane device determines the first key, and the method may be: the core network user plane device randomly generates the first key according to the first security capability of the terminal, or uses the security secret generated after authenticating the terminal. The key is used as the first key.
  • the core network user plane device may further include the implementation manner of determining the security context according to the first security capability of the terminal. : Encrypting the plaintext information of the first security capability to generate ciphertext information of the first security capability.
  • the security context sent by the core network user plane device to the terminal may further include plaintext information of the first security capability.
  • the core network user plane device encrypts the first key, or signs the first ciphertext information and the security capability, or encrypts the plaintext information of the first security capability, and may use a symmetric crypto mechanism or a non- A symmetric cryptosystem is implemented.
  • the encryption or signature algorithm takes a short time, but needs to maintain the key encrypted or signed by the user. If the core network user plane device uses an asymmetric cryptosystem, the core network user plane device does not need to maintain the key used for encryption or signature, and the maintenance cost is low, but the encryption or signature algorithm takes a short time.
  • the core network user plane device uses an asymmetric cryptosystem
  • the related encryption and decryption parameters applied in the asymmetric cryptosystem may have been configured on the core network user plane device.
  • the asymmetric cryptographic mechanism used by the core network user plane device is specifically an RSA public key cryptography algorithm or an Elliptic Curve Cryptography (ECC) algorithm, and the core network user plane device may be pre-configured to include a secret consisting of a public key and a private key. Key pair.
  • ECC Elliptic Curve Cryptography
  • the core network user plane device can use the public key in the key pair to the first key and / Or the plaintext information of the first security capability is encrypted, and the first ciphertext information and the security capability information may be signed by using the private key in the key pair.
  • the core network user plane device can be pre-configured with a digital certificate authorized by a certificate authority (CA). (Digital Certificate).
  • CA certificate authority
  • the asymmetric key mechanism used by the core network user plane device is specifically an identity-based encryption (IBE) mechanism, and the private key of the core network user plane device may be pre-configured on the core network user plane device.
  • the private key is simply referred to as Kpr), the identifier of the core network user plane device (which may be the device domain name of the core network user plane device) and the public system parameters.
  • a specific implementation manner of the step is: the core network user plane device firstly uses the first ciphertext The information and security capability information is hashed, and then the result of the hash operation is encrypted using the private key of the core network user plane device to obtain the first signature value.
  • the core network user plane device may delete the security context.
  • the core network user plane device may delete the first security capability and the security context after a session with the terminal for a period of time and after the session ends for a period of time, or after the terminal enters an idle state (IDLE) state.
  • IDLE idle state
  • the core network user plane device deletes the security context, which can reduce the storage and maintenance burden of the core network user plane device on the security context. Especially in the case of a large number of terminals, the effect will be more obvious.
  • the number of terminals may increase significantly. Storing and maintaining the security context of a large number of terminals can cause a burden on the core network user plane devices. Therefore, if the core network user plane device does not store and maintain the first security capability and security context, the storage and maintenance pressure of the core network user plane device can be greatly reduced.
  • the method when determining, by the core network user plane device, the security context according to the first security capability of the terminal, the method further includes: determining a second key, and encrypting the second key to obtain second ciphertext information.
  • the core network user plane device signs the first ciphertext information and the security capability to obtain the first signature value, and determines the label including the first ciphertext information, the security capability information, and the first signature value, and may include: a core network.
  • the user plane device enters the first ciphertext information, the second ciphertext information, and the security capability.
  • the row signature obtains the first signature value; and the label including the first ciphertext information, the second ciphertext information, the security capability information, and the first signature value is determined.
  • the second key may also be included in the security context.
  • the core network user plane device determines the second key, and the method may be: the core network user plane device randomly generates the second key according to the first security capability of the terminal, or uses the security secret generated after authenticating the terminal.
  • the key acts as the second key.
  • the communication method performed by the terminal may further include: receiving, by the terminal, the security context sent by the user plane device of the core network through the secure channel, where the security context includes the first key, the label, and the second key, and the label further includes the second ciphertext information.
  • the second ciphertext information is ciphertext information of the second key.
  • the terminal using the second key to sign the first data and the label may include: the terminal uses the second key in the security context to Data and tags are signed.
  • the core network user plane device verifies the second signature value in the data to be sent according to the second key and the security capability information in the data to be sent, including: the security capability of the core network user plane device according to the data to be sent.
  • the second ciphertext information in the information and the data to be transmitted is verified by the second signature value in the data to be transmitted.
  • the core network user plane device verifies the second signature value in the data to be sent according to the security capability information in the to-be-sent data and the second ciphertext information in the to-be-sent data, and may include: a core network user plane device pair The second ciphertext information is decrypted to obtain a second key; and the second signature value in the data to be transmitted is verified according to the security capability information in the to-be-sent data and the decrypted second key.
  • the label in the security context sent by the core network user plane device to the terminal may further include first plaintext information, where the first plaintext information may include at least one of the following information: routing information of the core network user plane device, and label Identification information, identification information of the terminal, identification information of the user plane device of the core network, or effective time information of the label.
  • the first signature value included in the label in the security context is the security capability information, the first ciphertext information, and the signature value obtained by signing the first plaintext information.
  • the label in the to-be-sent data sent by the terminal to the core network user plane device may further include the first plaintext information
  • the first plaintext information may include at least one of the following information: routing information of the core network user plane device, and label Identification information, identification information of the terminal, identification information of the user plane device of the core network, or effective time information of the label.
  • the first signature value included in the label in the to-be-sent data is the security capability information, the first ciphertext information, and the signature obtained by signing the first plaintext information. value.
  • the label in the to-be-sent data sent by the terminal received by the core network user plane device may further include the first plaintext information, where the first plaintext information may include at least one of the following information: routing information of the core network user plane device, The identification information of the label, the identification information of the terminal, the identification information of the user equipment of the core network, or the effective time information of the label.
  • the first signature value is a signature value obtained by signing the security capability information, the first ciphertext information, and the first plaintext information.
  • the core network user plane device may update the tag of the terminal when the use of the tag exceeds the expiration date. At this time, the core network user plane device also needs to maintain a data table for recording the valid time.
  • the user equipment of the core network may verify whether the terminal belongs to the terminal domain according to the identifier information of the terminal, and the verification may fail to discard the waiting. send data.
  • the identification information of the terminal may also be used as the audit information to identify the terminal; or the identification information of the terminal may be used as the public key of the terminal for verifying the second signature value in the data to be sent.
  • the identifier information of the core network user plane device may also be used as the audit information to identify the core network user plane device.
  • the identification information of the core network user plane device may be used as the public key of the core network user plane device under the IBE mechanism, and used to verify the first signature value in the label of the data to be sent; or the identification information of the core network user plane device may be It is used to verify whether the core network user plane device belongs to a core network user plane device domain.
  • the core network user plane device verifies the data to be sent sent by the terminal, that is, realizes end-to-end data security protection between the terminal and the core network user plane device, and can resist the passive sniffing attack. Moreover, the core network user plane device verifies the first signature value included in the label in the to-be-sent data, and can implement identity verification of the terminal, and the core network user plane device verifies the second signature value in the to-be-sent data. That is, the integrity protection of data transmitted between the terminal and the core network user plane device can be realized, and the tampering attack can be resisted. In addition, the terminal and the core network user plane device can defend against the replay attack by the timestamp in the data to be sent.
  • the core network user plane device when the core network user plane device sends the security context to the terminal, the core network user plane device may send the security context to the terminal by using the access network device.
  • the access network device may be the access network device 120 shown in FIG. 1.
  • the terminal when the terminal sends the data to be sent to the core network user plane device, the terminal may send the information in the to-be-sent data to the core network user plane device through the access network device.
  • the terminal may transparently transmit information in the data to be sent to the core network user plane device by using the access network device.
  • the label of the data to be sent sent by the terminal to the user plane device of the core network includes the user equipment of the core network.
  • the access network device acts as a communication device between the terminal and the core network user plane device, and after receiving the to-be-sent data sent by the terminal, may be based on the data to be sent.
  • the routing information of the core network user plane device in the tag or the identification information of the core network user plane device transmits the data to be sent by the terminal to the core network user plane device.
  • the access network device may also receive the data to be sent after the terminal sends the data to be sent.
  • the data to be sent of the terminal is verified, and then the information in the data to be transmitted is forwarded to the user plane device of the core network.
  • the communication method at this time is as shown in FIG. 3 .
  • FIG. 3 illustrates the steps or operations of the communication method, but these steps or operations are merely examples, and embodiments of the present invention may perform other operations or variations of the various operations in FIG. Moreover, the various steps in FIG. 3 may be performed in a different order than that presented in FIG. 3, and it is possible that not all operations in FIG. 3 are to be performed.
  • the access network device receives the first to-be-sent data sent by the terminal.
  • the first to-be-sent data includes the encrypted data and the label, where the label includes the security capability information, the first ciphertext information of the first key, and the first signature value, and the security capability information is the plaintext information of the first security capability of the terminal,
  • a signature value is a signature value obtained by signing the security capability information and the first ciphertext information
  • the encrypted data is data obtained by the terminal encrypting the plaintext data according to the first security capability and the first key.
  • the access network device may be the access network device 120 shown in FIG. 1.
  • the first to-be-sent data may be the to-be-sent data sent by the terminal to the core network user plane device in S220 of FIG. 2 .
  • the data to be sent sent by the terminal to the user plane device of the core network may be referred to as the first to-be-sent data.
  • S224 If the access network device fails to verify the first signature value in the first to-be-sent data, discarding the first to-be-sent data.
  • the access network device successfully verifies the first signature value in the first to-be-sent data, sends the second to-be-sent data to the core network user plane device, where the second to-be-sent data includes the encrypted data and the label, where the label includes Security capability information, first ciphertext information, and encrypted data.
  • the core network user plane device receives the second to-be-sent data sent by the access network device.
  • the access network device verifies the first signature value in the first to-be-sent data, and the method used may refer to the label of the core network user plane device to be sent data. The method of verifying the first signature value is not described here.
  • the first signature value is usually a signature obtained by the core network user plane device using the private key corresponding to the public key that the access network device can learn (such as the private key of the core network user plane device). value. In this way, the access network device can verify the first signature value in the label of the first data to be sent according to the learned public key.
  • the first to-be-sent data sent by the terminal to the core network user plane device may also be a second signature value.
  • the second signature value may be a signature value obtained by the terminal signing the encrypted data and the label according to the first security capability and the private key of the terminal.
  • the access network device verifies the first signature value in the label of the first to-be-sent data, and then sends the information to the core network user plane device.
  • Sending the second to-be-sent data includes: the access network device verifies the second signature value in the first to-be-sent data according to the security capability information in the first to-be-sent data and the public key of the terminal; After the first signature value in the label of the first data to be sent is successfully verified, and the second signature value in the first to-be-sent data is successfully verified, the second to-be-sent data is sent to the core network user plane device. .
  • the method for the access network device to verify the second signature value in the first to-be-sent data according to the security capability information in the first to-be-sent data and the public key of the terminal may refer to the foregoing core network user plane device according to the foregoing The method for verifying the second signature value in the data to be sent in the second key and the security capability information to be sent is not described here.
  • the second signature value is usually the signature value obtained by the terminal signing the encrypted data and the label.
  • the second to-be-sent data sent by the access network device to the core network user plane device may further include the second Signature value.
  • the core network user plane device may further verify the second signature value in the second to-be-sent data.
  • the verification method is similar to the method for verifying the second signature value in the data to be sent by the core network user plane device in the communication method shown in FIG. 2, and details are not described herein again.
  • the second signature value in the first to-be-sent data is the terminal according to the a second signature value obtained by signing the encrypted data, the additional information, and the label by the second security key and the second key, and the method for verifying the second signature value in the first to-be-sent data by the access network device, and the foregoing core
  • the method for verifying the second signature value in the to-be-sent data including the additional information is similar to the method of verifying the second signature and the security capability information in the to-be-sent data, and is not described here.
  • the access network device may further receive the first to-be-sent data. And verifying, according to the identifier information of the core network user plane device included in the label in the first to-be-sent data, whether the core network user plane device belongs to a core network domain that communicates with the access network device. If the verification fails, the data to be sent can be discarded.
  • the access network device may further receive the first to-be-sent data according to the first to-be-sent data.
  • the tag for transmitting data includes the identification information of the terminal, and verifies whether the terminal belongs to a terminal domain that communicates with the access network device. If the verification fails, the data to be sent can be discarded.
  • the access network device may The routing information or the identification information determines the target core network user plane device of the terminal to be sent data, and then sends the second to-be-sent data to the target core network user plane.
  • the access network may verify the first to-be-sent data sent by the terminal, and discard the first to-be-sent data that fails to be verified, thereby reducing the core network user plane.
  • the verification pressure of the device to send data may be verified.
  • the access network device periodically broadcasts the public key or certificate of the access network device, and the access network device periodically broadcasts the to-be-sent data to the core network user plane device, and the access network device periodically broadcasts the public key or certificate of the access network device, and The security capabilities of access network devices.
  • the terminal can use the public key or certificate of the access network device when the length of the data to be sent is short, and encrypt the label according to the security capability of the access network device, and in the data to be sent.
  • the access network device may use the private key or certificate of the access network device to decrypt the encrypted label in the data to be sent to obtain a plaintext label; or may use the private key or certificate of the access network device.
  • the encryption key in the data to be sent is decrypted to obtain a plaintext key, and the plaintext key is used to decrypt the encrypted label in the data to be sent to obtain a plaintext label.
  • the label can be verified when needed or the label needs to be used for integrity verification of the data to be sent, thereby further improving the security of data communication.
  • the communication method of the embodiment of the present invention is described above.
  • the terminal, the core network user plane device, and the access network device according to the embodiment of the present invention are described below with reference to FIG. 4 to FIG.
  • FIG. 4 is a schematic structural diagram of a terminal 400 according to an embodiment of the present invention. It should be understood that the terminal shown in FIG. 4 is only an example, and the terminal of the embodiment of the present invention may further include other modules or units, or include modules similar to those of the respective modules in FIG. 4, or not including the FIG. All modules.
  • the processing module 410 is configured to encrypt the plaintext data according to the first key and the first security capability of the terminal to obtain encrypted data.
  • the sending module 430 is configured to send data to be sent to the core network user plane device, where the to-be-sent data includes the encrypted data and a label, where the label includes security capability information, and first ciphertext information of the first key.
  • the first signature value the security capability information is plaintext information or ciphertext information of the first security capability, and the first signature value is obtained by signing the security capability information and the first ciphertext information Signature value.
  • the terminal of the embodiment of the present invention encrypts the plaintext data according to the first security capability and the first key to obtain encrypted data, which can improve the security of the data during transmission; when the terminal sends the encrypted data, the terminal carries the encrypted data.
  • the first ciphertext encrypted after the first key is encrypted in the data to be sent.
  • the security capability information of the information and the terminal enables the core network user plane device to decrypt the encrypted data in the data to be sent according to the security capability information and the first key, to obtain the plaintext data, and the data to be transmitted carries the first
  • the first ciphertext information of the key so that the first key can be securely protected; secondly, the to-be-sent data further carries the first signature value obtained by the first ciphertext information and the security capability information, so that the core network
  • the user plane device can perform security verification according to the first signature value, so that the terminal and the core network user plane device do not need to use a longer time and use more resources to implement security before sending the encrypted data in order to restore
  • the data to be sent further includes a second signature value
  • the processing module is further configured to: compare the first data and the label according to the first security capability and the second key Performing a signature to obtain a second signature value, the first data being the plaintext data or the encrypted data;
  • the data to be sent further includes additional information, where the additional information is used for an anti-replay attack; wherein the processing module is specifically configured to: according to the security capability information and the The second key signs the additional information, the first data, and the tag to obtain the second signature value.
  • the second key is a private key of the terminal.
  • the terminal further includes: a receiving module, configured to receive, by using a secure channel, a security context sent by the core network user plane device, where the security context includes the first key and the label.
  • a receiving module configured to receive, by using a secure channel, a security context sent by the core network user plane device, where the security context includes the first key and the label.
  • the terminal further includes: a receiving module, configured to receive, by using a secure channel, a security context sent by the core network user plane device, where the security context includes the first key, the The label and the second key, the label further includes second ciphertext information, and the second ciphertext information is encrypted information obtained by encrypting the second key.
  • a receiving module configured to receive, by using a secure channel, a security context sent by the core network user plane device, where the security context includes the first key, the The label and the second key, the label further includes second ciphertext information, and the second ciphertext information is encrypted information obtained by encrypting the second key.
  • the label further includes first plaintext information, where the first plaintext information includes at least one of the following: routing information of the core network user plane device, identifier information of the label, The identification information of the terminal, the identification information of the user plane device of the core network, and the valid time information of the label; wherein the first signature value is the security capability information, the first ciphertext information, and the The signature value obtained by signing the first plaintext information.
  • FIG. 5 is a schematic structural diagram of a core network user plane device 500 according to an embodiment of the present invention. It should be understood that the core network user plane device shown in FIG. 5 is only an example, and the core network user plane device of the embodiment of the present invention may further include other modules or units, or include modules similar in function to the modules in FIG. 5, Or not all of the modules in Figure 5 are included.
  • the receiving module 510 is configured to receive data to be sent sent by the terminal, where the to-be-sent data includes encrypted data and a label, where the encrypted data is used by the terminal according to the first key and the first security capability of the terminal to the plaintext data.
  • the label includes security capability information, first ciphertext information of the first key, and a first signature value, where the security capability information is plaintext information or ciphertext of the first security capability.
  • the information, the first signature value is a signature value obtained by signing the security capability information and the first ciphertext information.
  • the processing module 520 is configured to discard the to-be-sent data when the first signature value in the label of the to-be-sent data fails to be verified.
  • the processing module 520 is configured to: when the first signature value in the label of the data to be sent is successfully verified, decrypt the first ciphertext information in the to-be-sent data, Obtaining the first key, and decrypting the encrypted data according to the security capability information and the first key in the to-be-sent data to obtain the plaintext data.
  • the core network user plane device may verify the first signature value in the label of the data to be sent according to the security capability information in the label in the data to be sent and the encrypted data.
  • the data to be sent is discarded when the verification fails, or when the verification is successful, the first key in the label is obtained to obtain data in the data to be sent.
  • the communication method enables the terminal to securely transmit data with the core network without wasting a lot of time and resources to restore the session, thereby saving data transmission time overhead and improving resource utilization.
  • the core network user plane device treats the transmitted data for security verification, and can implement an end-to-end secure transmission mechanism between the terminal and the core network user plane device.
  • the to-be-sent data further includes a second signature value, where the second signature value is, according to the first security capability and the second key pair, the first data and the And the first data is the plaintext data
  • the processing module is further configured to: according to the second key and the security capability information in the to-be-sent data, Determining, by the second signature value in the sent data, the verification, in the data to be sent When the signature verification fails, the data to be sent is discarded.
  • the data to be sent further includes a second signature value, where the second signature value is the first data and the terminal according to the second key and the first security capability.
  • the first data is the encrypted data
  • the processing module is specifically configured to: according to the second key and the security capability information in the to-be-sent data, Determining the second signature value in the data to be sent; and verifying the first ciphertext information in the to-be-sent data when the second signature value in the to-be-sent data is successfully verified Obtaining the first key, and decrypting the encrypted data according to the first key and the security capability information in the to-be-sent data to obtain the plaintext data.
  • the processing module is further configured to: when the verification of the second signature value in the to-be-sent data fails, discard the to-be-sent data.
  • the to-be-sent data further includes additional information, where the additional information is used to resist an attack, and the second signature is the terminal according to the first security capability and the first A signature value obtained by signing the additional information, the first data, and the label by a second key.
  • the second key is a private key of the terminal
  • the processing module is specifically configured to: according to the public key of the terminal and the to-be-sent data Security capability information, verifying the second signature value in the to-be-sent data.
  • the core network user plane device further includes: a sending module, configured to send a security context to the terminal by using a secure channel, where the security context includes the first key and the label .
  • the processing module is further configured to delete the security context.
  • the core network user plane device further includes: a sending module, configured to send a security context to the terminal by using a secure channel, where the security context includes the first key, the label And the second key, the label further includes second ciphertext information, and the second ciphertext information is ciphertext information of the second key.
  • the processing module is further configured to: delete the security context, where the processing module is specifically configured to: according to the security capability information in the to-be-sent data and the second ciphertext in the to-be-sent data The information verifies the second signature value in the to-be-sent data.
  • the label further includes first plaintext information, where the first plaintext information includes at least one of the following: routing information of the core network user plane device, identifier information of the label, Identification information of the terminal, identification information of the user equipment of the core network, or The effective time information of the tag.
  • the first signature value is a signature value obtained by signing the security capability information, the first ciphertext information, and the first plaintext information.
  • FIG. 6 is a schematic structural diagram of an access network device 600 according to an embodiment of the present invention. It should be understood that the access network device shown in FIG. 6 is only an example, and the access network device in the embodiment of the present invention may further include other modules or units, or include modules similar to those of the modules in FIG. 6, or not To include all the modules in Figure 6.
  • the receiving module 610 is configured to receive the first to-be-sent data sent by the terminal, where the first to-be-sent data includes the encrypted data and the label, where the label includes the security capability information, the first ciphertext information of the first key, and the first a signature value, the security capability information is plaintext information of the first security capability of the terminal, and the first signature value is a signature value obtained by signing the security capability information and the first ciphertext information,
  • the encrypted data is data obtained by the terminal encrypting the plaintext data according to the first security capability and the first key.
  • the sending module 630 is configured to: when the access network device successfully verifies the first signature value in the first to-be-sent data, send the second to-be-sent data to the core network user plane device, where The data to be transmitted includes the encrypted data and the tag.
  • the sending module 630 is configured to discard the first to-be-sent data when the access network device successfully verifies the first signature value in the first to-be-sent data.
  • the access network device in the embodiment of the present invention can verify the data to be sent according to the label in the data to be sent, so that the access network device can ensure the secure communication of data without storing and maintaining the security context, thereby reducing the access network.
  • the operational burden of the device can verify the data to be sent according to the label in the data to be sent, so that the access network device can ensure the secure communication of data without storing and maintaining the security context, thereby reducing the access network.
  • the access network device verifies the data to be sent, and discards the data to be sent that fails to be verified, which can alleviate the verification pressure of the user equipment of the core network.
  • the first to-be-sent data further includes a second signature value, where the second signature value is the terminal according to the first security capability and the private key of the terminal.
  • the encrypted data and the signature value obtained by signing the tag.
  • the sending module is specifically configured to: verify, according to the security capability information and the public key of the terminal, the second signature value in the first to-be-sent data; Determining that the first signature value in the label of the first to-be-sent data is successful, and the second signature value in the first to-be-sent data When the verification is successful, the second to-be-sent data is sent to the core network user plane device.
  • the second to-be-sent data further includes the second signature value.
  • the first to-be-sent data further includes additional information, where the additional information is used for an anti-replay attack, and the second signature value is used by the terminal according to the first security capability and A signature value obtained by signing the encrypted data, the label, and the additional information by a private key of the terminal.
  • FIG. 7 is a schematic structural diagram of a terminal 700 according to an embodiment of the present invention.
  • the terminal 700 includes a memory 710, a processor 720, and a transmitter 740.
  • the terminal 700 may further include a receiver 730.
  • the memory 710 is configured to store a program.
  • the processor 720 is configured to execute the program stored by the memory 710.
  • the processor 720 executes the program stored in the memory 710, it is specifically configured to encrypt the plaintext data according to the first key and the first security capability of the terminal to obtain encrypted data.
  • the transmitter 740 is configured to send data to be sent to the core network user plane device, where the to-be-sent data includes the encrypted data and a label, where the label includes security capability information, and first ciphertext information of the first key.
  • the first signature value the security capability information is plaintext information or ciphertext information of the first security capability, and the first signature value is obtained by signing the security capability information and the first ciphertext information Signature value.
  • the terminal of the embodiment of the present invention encrypts the plaintext data according to the first security capability and the first key to obtain encrypted data, which can improve the security of the data during transmission; when the terminal sends the encrypted data, the terminal carries the encrypted data.
  • the to-be-sent data carries the first ciphertext information encrypted by the first key and the security capability information of the terminal, so that the core network user plane device can decrypt the encrypted data in the to-be-sent data according to the security capability information and the first key.
  • To obtain the plaintext data and the first ciphertext information of the first key is carried in the data to be sent, so that the first key can be securely protected; secondly, the first ciphertext information is carried in the data to be sent.
  • the core network user plane device can perform security verification according to the first signature value, so that the terminal and the core network user plane device do not need to send encrypted data in order to resume the session.
  • Security verification is achieved by taking a long time and using more resources.
  • the core network user plane device performs security verification on the data to be sent of the terminal, so that the core network can be implemented. End-to-end secure communication between the device and the terminal.
  • the to-be-sent data further includes a second signature value
  • the processor is further configured to: perform, by using the first security capability and the second key, the first data and the label Signing, obtaining the second signature value, the first data being the plaintext data or the encrypted data.
  • the to-be-sent data further includes additional information, where the additional information is used for an anti-replay attack.
  • the processing module is specifically configured to: sign the additional information, the first data, and the label according to the security capability and the second key to obtain the second signature value.
  • the second key is a private key of the terminal.
  • the receiver is configured to receive, by using a secure channel, a security context sent by the core network user plane device, where the security context includes the first key and the label.
  • the receiver is configured to receive, by using a secure channel, a security context sent by the core network user plane device, where the security context includes the first key, the label, and the The second key, the label further includes second ciphertext information, and the second ciphertext information is encrypted information obtained by encrypting the second key.
  • the label further includes first plaintext information, where the first plaintext information includes at least one of the following: routing information of the core network user plane device, identifier information of the label, The identification information of the terminal, the identification information of the user plane device of the core network, and the valid time information of the label; wherein the first signature value is the security capability information, the first ciphertext information, and the The signature value obtained by signing the first plaintext information.
  • terminal of the embodiment of the present invention shown in FIG. 7 may correspond to the terminal shown in FIG. 4, and the foregoing and other operations and/or functions of the respective units in the terminal of the embodiment of the present invention are respectively implemented to implement FIG. 2 or FIG.
  • the corresponding flow executed by the terminal in the communication method in 3 is not described here for brevity.
  • FIG. 8 is a schematic structural diagram of a core network user plane device according to an embodiment of the present invention.
  • the core network user plane device 800 includes a memory 810, a processor 820, and a receiver 830.
  • the core network user plane device 800 may also include a transmitter 840.
  • the memory 810 is configured to store a program.
  • the processor 820 is configured to execute a program stored by the memory 810.
  • the receiver 830 When the processor 820 executes the program stored by the memory 810, the receiver 830 is used Receiving data to be sent sent by the terminal, the data to be sent includes the encrypted data and the label, where the encrypted data is data obtained by the terminal encrypting the plaintext data according to the first key and the first security capability of the terminal,
  • the tag includes security capability information, first ciphertext information of the first key, and a first signature value, where the security capability information is plaintext information or ciphertext information of the first security capability, the first
  • the signature value is a signature value obtained by signing the security capability information and the first ciphertext information.
  • the processor 820 is further configured to discard the to-be-sent data when the first signature value in the label of the to-be-sent data fails to be verified.
  • the processor 820 is further configured to decrypt the first ciphertext information in the to-be-sent data after the first signature value in the label of the data to be sent is successfully verified. Obtaining the first key, and decrypting the encrypted data according to the security capability information and the first key in the to-be-sent data to obtain the plaintext data.
  • the core network user plane device can verify the data to be sent according to the information in the label in the data to be sent.
  • the data to be sent is discarded when the verification fails, or when the verification is successful, the first key in the label is obtained to obtain data in the data to be sent.
  • the communication method enables the terminal to securely transmit data with the core network without wasting a lot of time and resources to restore the session, thereby saving data transmission time overhead and improving resource utilization.
  • the core network user plane device treats the transmitted data for security verification, and can implement an end-to-end secure transmission mechanism between the terminal and the core network user plane device.
  • the to-be-sent data further includes a second signature value, where the second signature value is, according to the first security capability and the second key pair, the first data and the The label is obtained by signature, and the first data is the plaintext data.
  • the processor is further configured to: verify, according to the second key and the security capability information in the to-be-sent data, the second signature value in the to-be-sent data; When the verification of the second signature value in the transmission data fails, the data to be transmitted is discarded.
  • the to-be-sent data further includes a second signature value, where the second signature value is, according to the first security capability and the second key pair, the first data and the The label is obtained by signature, and the first data is the encrypted data.
  • the processor is specifically configured to: verify, according to the second key and the security capability information in the to-be-sent data, the second signature value in the to-be-sent data; Describe the number in the sent data Decrypting the first ciphertext information in the to-be-sent data to obtain the first key, and according to the first key and the to-be-sent data, The security capability information is obtained, and the encrypted data is decrypted to obtain the plaintext data.
  • the processor is further configured to: when the verification of the second signature value in the to-be-sent data fails, discard the to-be-sent data.
  • the data to be sent further includes additional information, where the additional information is used for an anti-replay attack, and the second signature value is the terminal according to the first security capability and the A signature value obtained by signing the additional information, the first data, and the tag by a second key.
  • the second key is a private key of the terminal.
  • the processor is specifically configured to: verify the second signature value in the to-be-sent data according to the public key of the terminal and the security capability information in the to-be-sent data.
  • the sender is configured to send a security context to the terminal by using a secure channel, where the security context includes the first key and the label.
  • the processor is further configured to delete the security context.
  • the sender is configured to send a security context to the terminal by using a secure channel, where the security context includes the first key, the label, and the second key,
  • the tag further includes second ciphertext information, and the second ciphertext information is ciphertext information of the second key.
  • the processor is further configured to: delete the security context, where the processor is specifically configured to: according to the security capability information in the to-be-sent data and the second ciphertext in the to-be-sent data The information verifies the second signature value in the to-be-sent data.
  • the label further includes first plaintext information, where the first plaintext information includes at least one of the following: routing information of the core network user plane device, identifier information of the label, The identifier information of the terminal, the identifier information of the user plane device of the core network, or the valid time information of the label, where the first signature value is the security capability information, the first ciphertext information, and the location The signature value obtained by signing the first plaintext information.
  • first plaintext information includes at least one of the following: routing information of the core network user plane device, identifier information of the label, The identifier information of the terminal, the identifier information of the user plane device of the core network, or the valid time information of the label, where the first signature value is the security capability information, the first ciphertext information, and the location The signature value obtained by signing the first plaintext information.
  • the core network user plane device of the embodiment of the present invention shown in FIG. 8 may correspond to the core network user plane device shown in FIG. 5, and the foregoing and other units of each unit in the core network user plane device according to the embodiment of the present invention are The operations and/or functions are respectively implemented in the communication method of FIG. 2 or FIG. 3 to be executed by the core network user plane device. For brevity, details are not described herein again.
  • FIG. 9 is a schematic structural diagram of an access network device according to an embodiment of the present invention.
  • Access network equipment 900 package A memory 910, a processor 920, a receiver 930, and a transmitter 940 are included.
  • the memory 910 is configured to store a program.
  • the processor 920 is configured to execute a program stored by the memory 910.
  • the receiver 930 is configured to receive the first to-be-sent data of the terminal, where the first to-be-sent data includes the encrypted data and the label, where the label includes the security capability information.
  • the first ciphertext information of the first key and the first signature value where the security capability information is plaintext information of the first security capability of the terminal, and the first signature value is the security capability information and the A signature value obtained by signing the first ciphertext information, where the encrypted data is data obtained by the terminal encrypting the plaintext data according to the first security capability and the first key.
  • the transmitter 940 is configured to: when the access network device successfully verifies the first signature value in the first to-be-sent data, send the second to-be-sent data to the core network user plane device, where The data to be transmitted includes the encrypted data and the tag.
  • the transmitter 940 is configured to discard the first to-be-sent data after the access network device successfully verifies the first signature value in the first to-be-sent data.
  • the access network device in the embodiment of the present invention can verify the data to be sent according to the label in the data to be sent, so that the access network device can ensure the secure communication of data without storing and maintaining the security context, thereby reducing the access network.
  • the operational burden of the device can verify the data to be sent according to the label in the data to be sent, so that the access network device can ensure the secure communication of data without storing and maintaining the security context, thereby reducing the access network.
  • the access network device verifies the data to be sent, and discards the data to be sent that fails to be verified, which can alleviate the verification pressure of the user equipment of the core network.
  • the first to-be-sent data further includes a second signature value, where the second signature value is the terminal according to the first security capability and the private key of the terminal.
  • the processor is specifically configured to: verify, according to the security capability information and the public key of the terminal, the second signature value in the first to-be-sent data; When the first signature value in the label of the first to-be-sent data is successfully verified, and the second signature value in the first to-be-sent data is successfully verified, to the core network user plane device Sending the second to-be-sent data.
  • the second to-be-sent data further includes the second signature value.
  • the first to-be-sent data further includes additional information, where the additional information is used for an anti-replay attack, and the second signature value is used by the terminal according to the first security capability and The private key of the terminal signs the encrypted data, the label, and the additional information The signature value to.
  • the access network device of the embodiment of the present invention shown in FIG. 9 may correspond to the access network device shown in FIG. 6, and the above and other operations of each unit in the access network device according to the embodiment of the present invention and/or
  • the functions of the communication method in FIG. 2 or FIG. 3 are respectively omitted for the sake of brevity.
  • FIG. 10 is a schematic structural diagram of a communication system 1000 according to an embodiment of the present invention. It should be understood that the communication system illustrated in FIG. 10 is merely an example, and the communication system of the embodiment of the present invention may further include other devices or units, or include devices or modules similar to those of the respective devices in FIG. 10, or are not intended to be included. All the devices in Figure 10.
  • the communication system 1000 includes a terminal 1010, a core network user plane device 1020, and an access network device 1030.
  • the terminal 1010 may be the terminal 400 shown in FIG. 4 or the terminal 700 shown in FIG. 7.
  • the core network user plane device 1020 may be the core network user plane device 500 shown in FIG. 5 or the core network user shown in FIG.
  • the face device 800, the access network device 1030 may be the access network device 600 shown in FIG. 6 or the access network device 900 shown in FIG.
  • the terminal 1010 in the communication system 1000 is the terminal 400 or the terminal 700
  • the core network user plane device 1020 is the core network user plane device 500 or the core network user plane device 800
  • the terminal sends the data to be sent carrying the security processed data.
  • the tag is also carried in the network, so that the core network user plane device and the terminal do not waste a lot of time and resources to restore the session, so that the terminal and the core network user plane device can securely transmit data, thereby saving data transmission time overhead. And improve the utilization of resources.
  • the core network user plane device 1020 is the core network user plane device 500 or the core network user plane device 800
  • the access network device 1030 is the access network device 600 or the access network.
  • the terminal carries the label in the data to be sent that carries the data after the security processing, so that the core network user plane device, the access network device, and the terminal do not waste a lot of time and resources to restore the session.
  • the data can be securely transmitted by the terminal, the access network device, and the core network user plane device, thereby saving data transmission time overhead and improving resource utilization.
  • the access network device can verify the data to be sent according to the label in the data to be sent, so that the access network device can ensure the secure communication of data without storing and maintaining the security context, thereby reducing the operation of the access network device. burden.
  • the processor in the embodiment of the present invention may be an integrated circuit chip with signal processing capability.
  • each step of the foregoing method embodiment may be completed by an integrated logic circuit of hardware in a processor or an instruction in a form of software.
  • the processor may be a general-purpose processor, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a Field Programmable Gate Array (FPGA), or the like. Programming logic devices, discrete gates or transistor logic devices, discrete hardware components.
  • the methods, steps, and logical block diagrams disclosed in the embodiments of the present invention may be implemented or carried out.
  • the general purpose processor may be a microprocessor or the processor or any conventional processor or the like.
  • the steps of the method disclosed in the embodiments of the present invention may be directly implemented by the hardware decoding processor, or may be performed by a combination of hardware and software modules in the decoding processor.
  • the software module can be located in a conventional storage medium such as random access memory, flash memory, read only memory, programmable read only memory or electrically erasable programmable memory, registers, and the like.
  • the storage medium is located in the memory, and the processor reads the information in the memory and combines the hardware to complete the steps of the above method.
  • the memory in the embodiments of the present invention may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memory.
  • the non-volatile memory may be a read-only memory (ROM), a programmable read only memory (PROM), an erasable programmable read only memory (Erasable PROM, EPROM), or an electric Erase programmable read only memory (EEPROM) or flash memory.
  • the volatile memory can be a Random Access Memory (RAM) that acts as an external cache.
  • RAM Random Access Memory
  • many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (Synchronous DRAM).
  • SDRAM Double Data Rate SDRAM
  • DDR SDRAM Double Data Rate SDRAM
  • ESDRAM Enhanced Synchronous Dynamic Random Access Memory
  • SLDRAM Synchronous Connection Dynamic Random Access Memory
  • DR RAM direct memory bus random access memory
  • system and “network” are used interchangeably herein.
  • the term “and/or” in this article is merely an association describing the associated object, indicating that there can be three types. Relationships, for example, A and/or B, may indicate that there are three cases where A exists separately, and both A and B exist, and B exists alone.
  • the character "/" in this article generally indicates that the contextual object is an "or" relationship.
  • B corresponding to A means that B is associated with A, and B can be determined according to A.
  • determining B from A does not mean that B is only determined based on A, and that B can also be determined based on A and/or other information.
  • the disclosed systems, devices, and methods may be implemented in other manners.
  • the device embodiments described above are merely illustrative.
  • the division of the unit is only a logical function division.
  • there may be another division manner for example, multiple units or components may be combined or Can be integrated into another system, or some features can be ignored or not executed.
  • the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or unit, and may be in an electrical, mechanical or other form.
  • the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.
  • each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.
  • the functions may be stored in a computer readable storage medium if implemented in the form of a software functional unit and sold or used as a standalone product. Based on such understanding, the technical solution of the present invention is essentially or a part contributing to the prior art or a part of the technical solution.
  • the points may be embodied in the form of a software product stored in a storage medium, including instructions for causing a computer device (which may be a personal computer, server, or network device, etc.) to perform various embodiments of the present invention All or part of the steps of the method.
  • the foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, and the like, which can store program codes. .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

La présente invention concerne un procédé de communication, un terminal, un dispositif de plan utilisateur de réseau central, un dispositif de réseau d'accès et un système de communication. Le procédé de communication selon la présente invention consiste à : chiffrer, au moyen du terminal, des données de texte en clair conformément à une première clé et à une première capacité de sécurité du terminal, pour obtenir des données chiffrées ; envoyer, au moyen du terminal, des données à envoyer au dispositif de plan utilisateur de réseau central, les données à envoyer comprenant les données chiffrées et des étiquettes, les étiquettes comprenant des informations de capacité de sécurité, des premières informations de texte chiffré de la première clé et une première valeur de signature, les informations de capacité de sécurité étant les informations de texte en clair ou les informations de texte chiffré de la première capacité de sécurité, la première valeur de signature étant une valeur de signature obtenue par signature des informations de capacité de sécurité et des premières informations de texte chiffré. Le procédé de communication, le terminal, le dispositif de plan utilisateur de réseau central et le dispositif de réseau d'accès, et le système de communication selon la présente invention permettent de réduire des temps systèmes de transmission de données et d'améliorer une utilisation de ressources.
PCT/CN2016/103324 2016-10-26 2016-10-26 Procédé de communication, terminal, dispositif de plan utilisateur de réseau central et dispositif de réseau d'accès Ceased WO2018076190A1 (fr)

Priority Applications (1)

Application Number Priority Date Filing Date Title
PCT/CN2016/103324 WO2018076190A1 (fr) 2016-10-26 2016-10-26 Procédé de communication, terminal, dispositif de plan utilisateur de réseau central et dispositif de réseau d'accès

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2016/103324 WO2018076190A1 (fr) 2016-10-26 2016-10-26 Procédé de communication, terminal, dispositif de plan utilisateur de réseau central et dispositif de réseau d'accès

Publications (1)

Publication Number Publication Date
WO2018076190A1 true WO2018076190A1 (fr) 2018-05-03

Family

ID=62024174

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/103324 Ceased WO2018076190A1 (fr) 2016-10-26 2016-10-26 Procédé de communication, terminal, dispositif de plan utilisateur de réseau central et dispositif de réseau d'accès

Country Status (1)

Country Link
WO (1) WO2018076190A1 (fr)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112272376A (zh) * 2020-10-22 2021-01-26 中国联合网络通信集团有限公司 一种奖励方法及装置
CN112291785A (zh) * 2020-10-22 2021-01-29 中国联合网络通信集团有限公司 一种奖励方法及装置
CN112887971A (zh) * 2019-11-30 2021-06-01 华为技术有限公司 数据传输方法和装置

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2002032044A2 (fr) * 2000-10-13 2002-04-18 Eversystems Inc. Messagerie a cle secrete
CN101203025A (zh) * 2006-12-15 2008-06-18 上海晨兴电子科技有限公司 安全的移动信息发送和接收方法
CN101442409A (zh) * 2007-11-23 2009-05-27 东方钢铁电子商务有限公司 用于b2b数据交换的加密方法及系统
CN104580180A (zh) * 2014-12-26 2015-04-29 北京佳月隶平软件有限公司 数据加密方法、数据解密方法及装置

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2002032044A2 (fr) * 2000-10-13 2002-04-18 Eversystems Inc. Messagerie a cle secrete
CN101203025A (zh) * 2006-12-15 2008-06-18 上海晨兴电子科技有限公司 安全的移动信息发送和接收方法
CN101442409A (zh) * 2007-11-23 2009-05-27 东方钢铁电子商务有限公司 用于b2b数据交换的加密方法及系统
CN104580180A (zh) * 2014-12-26 2015-04-29 北京佳月隶平软件有限公司 数据加密方法、数据解密方法及装置

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112887971A (zh) * 2019-11-30 2021-06-01 华为技术有限公司 数据传输方法和装置
CN112887971B (zh) * 2019-11-30 2023-03-21 华为技术有限公司 数据传输方法和装置
CN112272376A (zh) * 2020-10-22 2021-01-26 中国联合网络通信集团有限公司 一种奖励方法及装置
CN112291785A (zh) * 2020-10-22 2021-01-29 中国联合网络通信集团有限公司 一种奖励方法及装置
CN112291785B (zh) * 2020-10-22 2022-07-22 中国联合网络通信集团有限公司 一种奖励方法及装置

Similar Documents

Publication Publication Date Title
US8627092B2 (en) Asymmetric cryptography for wireless systems
US9264404B1 (en) Encrypting data using time stamps
US20150079941A1 (en) Secure Paging
WO2018045817A1 (fr) Procédé d'authentification de réseau mobile, dispositif terminal, serveur, et entité d'authentification de réseau
Abdo et al. Ensured confidentiality authentication and key agreement protocol for EPS
JP7551080B2 (ja) 最適化された公開鍵基盤を備える組み込みシステムのネットワークを保護および管理するための方法ならびにアーキテクチャ
GB2384402A (en) Secure data transmission links
CN105281909A (zh) 一种加解密机制及采用该加解密机制的物联网锁系统
CN112887971B (zh) 数据传输方法和装置
EP2992646B1 (fr) Traitement de données de surveillance de performances
CN101405987A (zh) 无线系统的非对称加密
CN102480713A (zh) 一种汇聚节点与移动通信网络间的通信方法、系统及装置
CN111836260B (zh) 一种认证信息处理方法、终端和网络设备
CN110234102B (zh) 通信方法和设备
WO2020215958A1 (fr) Procédé de traitement d'informations d'authentification, et terminal et dispositif de réseau
US20240205204A1 (en) Data transmission protocol execution methods and apparatuses
CN108599944A (zh) 一种基于手机身份的验证码短信透明加密方法
US20240348588A1 (en) Data processing method and apparatus, computer device, and storage medium
CN108011856A (zh) 一种传输数据的方法和装置
CN110691359A (zh) 一种电力营销专业的蓝牙通信的安全防护方法
Chakrabarty et al. Black networks for bluetooth low energy
CN102413463A (zh) 填充序列长度可变的无线媒体接入层鉴权和密钥协商方法
WO2009074092A1 (fr) Procédé et système allégés d'authentification d'accès
CN112118568A (zh) 一种设备身份鉴权的方法及设备
Saxena et al. BVPSMS: A batch verification protocol for end-to-end secure SMS for mobile users

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16919919

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 16919919

Country of ref document: EP

Kind code of ref document: A1