Huawei Technologies Co., Limited

Tencent Technology (shenzhen) Company Limited

Shenzhen Royole Technologies Co., Ltd.

Zte Corporation

Delta Electronics (shanghai) Co., Ltd

He Li

Jing Lan Chen

Li Hu

Rong Wu

Kai Pan

Yizhuang Wu

Longhua Guo

Shufeng Shi

Jing Chen

Ridong Xu

Biao Zhang

Jinzhou Ye

Boqiang Luo

Huan Li

Weisheng Jin

Gang Cheng

Mazin Ali Al-Shalash

Youyang Yu

Ahmad Shawky Muhanna

Ji Wang

Ao Lei

Zhanchao Liu

Ziming Zhuang

Xuan Pan

Bingzhao Li

Xiaoying Xu

Shuiping Long

Yang Liu

Chong Lou

Liang Zhang

Qiang Yi

Xiang Zou

Xinyuan Xia

Hualin Zhu

Chao Jiang

Fei Lu

Rui Xu

Yu Zhou

Jiangsheng Wang

Liwei Qiu

Jing Zhou

Qiru Chen

Yuanyuan Zhong

Jianqun Chen

Chao Han

Yiyang Liu

Junjie Zhai

Huimin Pei

Boyu Qiu

Gudan Wang

Fang Lu

This application provides security activation methods and communication apparatuses. In an example method, a first access network device in a first communication standard requests a second access network device in a second communication standard to allocate a resource for dual connectivity of a terminal device, and sends, to the second access network device, a user plane security policy. The first access network device further receives identification information of a bearer and a security activation status from the second access network device and sends the identification information of the bearer and the security activation status to the terminal device.

Security activation method and communication apparatus

Embodiments of this application provide a communication method, apparatus, and system, to improve security of a vehicle-to-everything (V2X) PC5 establishment procedure. In the method, a first terminal device obtains a first security protection method, where the first security protection method is a security protection method determined in a discovery procedure between the first terminal device and a second terminal device. Also in the method, the first terminal device determines a second security protection method according to the first security protection method, where the second security protection method is a security protection method for a PC5 connection between the first terminal device and the second terminal device. For example, a security level of the second security protection method is higher than a security level of the first security protection method. The communication method is applicable to the V2X communication field.

Communication method, apparatus, and system

An authentication management function AUSF receives an authentication request message from an access and mobility management function AMF, where the authentication request message carries a subscription concealed identifier SUCI. The AUSF sends an authentication vector get request message to a unified data management UDM function, where the authentication vector get request message carries the SUCI. The AUSF receives an authentication vector get response message from the UDM, where the authentication vector get response message includes authentication and key management for application AKMA indication information. The AUSF generates, based on the AKMA indication information, an authentication and key management for application-key identifier based on a routing indicator RID in the SUCI.

Key identifier generation method and related apparatus

Embodiments of the present disclosure provide a key management method and a communication apparatus, and relate to the field of communication technologies, to securely transmit multicast service data, and prevent an unauthorized terminal device from obtaining the multicast service data. The method includes: A terminal device obtains a target key, where the target key includes at least one of a target multimedia broadcast/multicast service service key (MSK), a first sub-key corresponding to the target MSK, or a second sub-key corresponding to the target MSK, the first sub-key is for confidentiality protection calculation, and the second sub-key is for integrity protection calculation. The terminal device receives target data, on which security protection is performed, from a multicast user-plane processing network element. Then, the terminal device processes the target data using the target key.

Key management method and communication apparatus

Embodiments of this application relate to the field of communication technologies, and provide a data transmission method and an apparatus, to ensure security of radio capability information of a terminal in a transmission process. The method includes: A terminal performs NAS security protection on radio capability information based on a NAS security context before establishing an AS security context; then the terminal sends the NAS-security-protected radio capability information to a mobility management network element; and after receiving the NAS-security-protected radio capability information, the mobility management network element performs security deprotection on the NAS-security-protected radio capability information, to obtain and store the radio capability information of the terminal. In this way, in a scenario in which an access network device requires the radio capability information of the terminal, the mobility management network element may send the radio capability information to the access network device.

Data transmission method and apparatus

A communication method, apparatus, and system are provided, to resolve problems in a conventional technology that an AKMA authentication procedure is complex and signaling overheads are large. Principles of the method are as follows: In a registration procedure of a terminal device, AKMA authentication is implicitly indicated based on primary authentication. For example, if primary authentication succeeds, it may be considered that AKMA authentication also succeeds. In addition, an AKMA temporary identifier is allocated to the terminal device after AKMA authentication succeeds. According to the method, apparatus, and system in this application, no additional AKMA authentication is required. This simplifies a procedure and reduces signaling overheads.

This application provides a key management method, a device, and a system. The method includes: A terminal device sends a first application session establishment request message to a first application function network element, where the establishment request message carries identification information of a first key, and the first key is an authentication and key management for applications AKMA key. The terminal device receives a first authentication request message in a procedure of the re-authentication. The terminal device sends a response message for the first authentication request message in the procedure of the re-authentication. The terminal device receives a response message for the establishment request message. The terminal device derives a communication key between the terminal device and the first application function network element by using the first key.

Key management method, device, and system

A method for determining a user plane security algorithm, a system, and an apparatus. The method may include: a second device selects a non-null user plane confidentiality protection algorithm based on a security capability of a first device and a security capability of the second device in a case in which user plane confidentiality protection between the second device and the first device is enabled and control plane confidentiality protection between the second device and the first device is not enabled. The second device sends a first message to the first device. The first message includes first algorithm indication information indicating the user plane confidentiality protection algorithm. Therefore, the first device can obtain the non-null user plane confidentiality protection algorithm. Embodiments can be adopted to determine an effective user plane confidentiality protection algorithm, for confidentiality protecting user plane data.

Method, system, and apparatus for determining user plane security algorithm

This application provides a communication system, method, and apparatus. The system is applied to implement authentication and key management for applications (AKMA) service-based data transmission between a terminal device and an application function network element. The system includes an AKMA anchor function network element and a network exposure function network element. The network exposure function network element obtains first identification information from a unified data management network element, where the first identification information is used to determine an authentication server function network element corresponding to the terminal device, and sends the first identification information to the AKMA anchor function network element. The AKMA anchor function network element obtains, from the unified data management network element based on the first identification information, identification information of the authentication server function network element corresponding to the terminal device.

Communication system, method, and apparatus

Embodiments of this application provide example communication methods and apparatuses. One example communication method is applied to a communications device, where a subscriber identification module (SIM) card is installed in the communications device, and where the example communication method includes determining, by the communications device, that the SIM card is removed. The communications device can then send alarm information to a network device, where the alarm information indicates that the SIM card in the communications device is removed, and where security protection is performed on the alarm information based on security context stored in the communications device. The communications device can then delete the security context.

Communication method and apparatus

An information sending method, a key generation method, and an apparatus, where a core network element first determines whether a terminal device needs to perform a key activation procedure, and then sends a first message to an access network element, where the first message indicates whether the access network element needs to send, to the terminal device, a second message to trigger the terminal device to perform the key activation procedure. After receiving the first message, the access network element determines, based on the first message, whether the second message needs to be sent to the terminal device, and sends the second message to the terminal device when the second message needs to be sent to the terminal device.

Information sending method, key generation method, and apparatus

Embodiments of this application provide security protection methods and apparatuses. One method includes: obtaining, by a master station, a user plane security policy, wherein the user plane security policy indicates whether to activate a user plane security protection, the master station communicates with a secondary station under a dual connectivity scenario; sending, by the master station, a message comprising the user plane security policy to the secondary station; receiving, by the secondary station, the message from the master station; and determining, by the secondary station, a user plane security algorithm based on the user plane security policy.

Security protection method and apparatus, and access network device

A communications method includes: an integrated access and backhaul (IAB) node receives an uplink data packet from a terminal; the IAB node determines a packet data convergence protocol (PDCP) layer security status of the uplink data packet; the IAB node determines a target secure tunnel from a plurality of secure tunnels between the IAB node and an IAB donor based on the PDCP layer security status of the uplink data packet; and the IAB node sends the uplink data packet to the IAB donor through the target secure tunnel. This application is applicable to a data transmission process.

Communications method and apparatus to reduce a data transmission latency between an IAB node and IAB donor

This application relates to the field of wireless communications technologies. Embodiments of this application provide a security protection method, an apparatus, and a system, to resolve a problem of low efficiency in handing over a terminal between serving base stations. The method in this application includes: receiving, by a target access network device, a correspondence between user plane information and a security policy from a source access network device; and determining, by the target access network device based on the correspondence between user plane information and a security policy, a first user plane protection algorithm corresponding to the user plane information, where the first user plane protection algorithm includes one or both of a user plane encryption algorithm and a user plane integrity protection algorithm. This application is applicable to a procedure in which the terminal is handed over between serving base stations.

Security protection method, apparatus, and system

A method includes receiving, from a gateway mobile location center, a reliable positioning requirement for obtaining the location of a terminal device. The method also includes determining based on the received reliable position requirement a positioning method that is based on the terminal device reporting and a network-assisted positioning. The method further includes obtaining a first location reported by the terminal device and a second location reported by a base station. The method additionally includes determining location information of the terminal device based on the first location and the second location. The method also includes sending a positioning response to an application function entity from the gateway mobile location center. The positioning response comprises the location information of the terminal device.

Terminal device location determining method and device

Growing community of inventors

Shanghai, China

He Li