Security protection negotiation method and network element

A security protection negotiation method, comprising:

• receiving, by user equipment (UE), a first message sent by a session management function (SMF) comprising security protection information used on a user plane in a current session, wherein the security protection information comprises a security protection algorithm, an index identifying a security protection context, and a message authentication code, the security protection algorithm comprising an encryption and decryption protection algorithm and an integrity protection algorithm, and the message authentication code being an authentication code generated after the SMF performs the integrity protection algorithm on the first message using an integrity protection key contained in the security protection context;
• performing, by the UE, authentication on the first message based on the security protection information;
• and
• determining that the authentication performed by the UE on the first message is successful:
• starting, by the UE, user plane security protection, and sending, to the SMF, a second message indicating the authentication performed by the UE on the first message has been successful.

A session management function (SMF), comprising:

• a processor configured to determine security protection information used on a user plane in a current session, wherein the security protection information comprises a security protection algorithm, an index for identifying a security protection context, and a message authentication code, the security protection algorithm comprising an encryption and decryption protection algorithm and an integrity protection algorithm, and the message authentication code being an authentication code generated after the integrity protection algorithm is performed on a first message comprising the security protection information by using an integrity protection key contained in the security protection context;
• a transceiver configured to send to user equipment (UE) the first message, wherein the UE uses the security protection information to start user plane security protection after the UE determines a successful authentication of the first message based on the security protection information;
• and
• the transceiver, configured to receive a second message sent by the UE indicating the successful authentication, wherein
• the transceiver is further configured to send, to a user plane function (UPF), a third message comprising the security protection algorithm and the security protection context that are determined by the processing unit and that are used on the user plane in the current session, wherein the third message is used to trigger the UPF to start user plane security protection based on the security protection algorithm and the security protection context.