Security protection method, apparatus, and system

An apparatus, comprising:

• at least one processor;
• and
• a memory coupled to the at least one processor and storing programming instructions stored thereon which, when executed by the at least one processor, cause the apparatus to:
• receive, from a source access network device, a handover request message including a first security policy of a PDU session;
• wherein the first security policy indicates whether to activate a user plane security protection for the PDU session;
• activate, based on the security, a first user plane security protection for the PDU session based on the first security policy indicates to activate the user plane security protection;
• send, by the target access network device, the first security policy of the PDU session to a session management function (SW) node;
• receive, by the target access network device, a second security policy of the PDU session from the SW node;
• and
• update, by the target access network device, the first security policy based on the second security policy.

A communication system, comprising a target access network device and a session management function (SMF) node;

• wherein the target access network device is configured to:
• receive, from a source access network device, a handover request message including a first security policy of a PDU session;
• wherein the first security policy indicates whether to activate a user plane security protection for the PDU session;
• activate a first user plane security protection for the PDU session based on the first security policy indicates to activate the user plane security protection;
• and
• send the first security policy of the PDU session to the SMF node;
• wherein the SMF node is configured to:
• receive the first security policy of the PDU session from the target access network device;
• verify whether the first security policy received from the target access network device is same as a second security policy stored in the SMF node that corresponds to the PDU session;
• and
• send the second security policy to the target access network device if the first security policy received from the target access network device is different from the second security policy stored in the SMF node;
• the target access network device is further configured to:
• receive the second security policy of the PDU session from the SWF node;
• and
• update the first security policy based on the second security policy.

A security protection method, comprising:

• receiving, by a target access network device from a source access network device, a handover request message including a first security policy of a PDU session;
• wherein the first security policy indicates whether to activate a user plane security protection for the PDU session;
• activating, by the target access network device, a first user plane security protection for the PDU session based on the first security policy indicates to activate the user plane security protection;
• sending, by the target access network device, the first security policy of the PDU session to a session management function (SMF) node;
• receiving, by the SWF node, the first security policy of the PDU session from the target access network device;
• verifying, by the SWF node, whether the first security policy received from the target access network device is same as a second security policy stored in the SWF node that corresponds to the PDU session;
• sending, by the SWF node, the second security policy to the target access network device if the first security policy received from the target access network device is different from the second security policy stored in the SWF node;
• receiving, by the target access network device, the second security policy from the SWF node;
• and
• updating, by the target access network device, the first security policy based on the second security policy.