# US 11,445,365 B2 · Communication method and communications apparatus > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,445,365 B2 - Document ID: US11445365B2 - Status: Granted - Kind: B2 - Application number: 17/513,021 - Filed: 2021-10-28 - Published: 2022-02-24 - Granted: 2022-09-13 - Earliest claimed: 2019-04-28 - Assignees: Huawei Technologies Co., Ltd. - Applicants: Huawei Technologies Co., Ltd. - Inventors: He Li; Li Hu; Rong Wu - Web page: https://patentgrep.com/patent/US11445365B2 ## CPC - H04W 12/033: of the user plane, e.g. user's traffic - H04W 76/27: Transitions between radio resource control [RRC] states - H04W 12/041: Key generation or derivation - H04W 12/0431: Key distribution or pre-distribution; Key agreement - H04W 12/10: Integrity - H04W 12/37: Managing security policies for mobile devices or for controlling mobile applications - H04W 76/19: Connection re-establishment - H04W 76/11: Allocation or use of connection identifiers - H04W 76/12: Setup of transport tunnels - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract A communication method and a communications apparatus, where the method includes: after receiving an RRC resume request message from a UE, determining, by a target access network device, a first user plane security protection method between the target access network device and the UE based on a context information obtaining response from a source access network device; determining a first user plane security key between the target access network device and the UE; when receiving first uplink user plane data from the UE, performing user plane security deprotection on the first uplink user plane data based on the first user plane security key and the first user plane security protection method, to obtain uplink user plane data; and sending the uplink user plane data. ## Claims ### Claim 1 A communications system, comprising: a target access network device configured to: receive a radio resource control (RRC) resume request from a user equipment (UE), wherein the RRC resume request comprises an inactive-radio network temporary identifier (I-RNTI); and send a context information obtaining request comprising the I-RNTI; and a source access network device configured to: receive the context information obtaining request from the target access network device; obtain first indication information based on the I-RNTI, wherein the first indication information indicates a user plane security protection method used before the source access network device and the UE enter an inactive state from a connected state, and wherein the user plane security protection method indicates whether at least one of user plane encryption protection or user plane integrity protection is enabled; and send a context information obtaining response to the target access network device, wherein the context information obtaining response comprises the first indication information, wherein the target access network device is further configured to: receive the context information obtaining response from the source access network device; and activate, using the user plane security protection method, user plane security between the target access network device and the UE when the user plane security protection method can be supported. ### Claim 2 (depends on 1) The communications system according to claim 1, wherein the target access network device is further configured to send an RRC message to the UE when the user plane security protection method cannot be supported, and wherein the RRC message is configured to trigger the UE to re-establish an RRC connection to the target access network device. ### Claim 3 (depends on 1) The communications system according to claim 1, wherein the context information obtaining response further comprises an encryption algorithm and an integrity protection algorithm that are used by the source access network device and a new access stratum key (KgNB*) generated by the source access network device, and wherein the target access network device is further configured such that when the target access network device supports the encryption algorithm and the integrity protection algorithm, the target access network device determines a first user plane security key between the target access network device and the UE based on the KgNB*. ### Claim 4 (depends on 1) The communications system according to claim 1, wherein the target access network device is further configured to: receive first uplink user plane data from the UE; and perform user plane security deprotection on the first uplink user plane data to obtain uplink user plane data. ### Claim 5 (depends on 1) The communications system according to claim 1, wherein the context information obtaining response further comprises at least one user plane security policy of the UE, and wherein the at least one user plane security policy comprises at least one of a user plane encryption protection policy or a user plane integrity protection policy. ### Claim 6 (depends on 1) The communications system according to claim 1, wherein the context information obtaining response further comprises a protocol data unit (PDU) session identifier (ID) corresponding to the first indication information. ### Claim 7 (depends on 1) The communications system according to claim 1, wherein the source access network device is further configured to: send an RRC release message to the UE, wherein the RRC release message indicates to the UE to enter the inactive state; store the first indication information; delete an RRC encryption key, a user plane encryption key, and a user plane integrity protection key; and store an RRC integrity protection key and the first indication information. ### Claim 8 (depends on 1) The communications system according to claim 1, wherein the target access network device is further configured to determine whether the user plane security protection method can be supported. ### Claim 9 A target access network device, comprising: at least one processor; and a memory coupled to the at least one processor and configured to store program instructions, which when executed by the at least one processor, cause the target access network device to: receive a radio resource control (RRC) resume request from a user equipment (UE), wherein the RRC resume request comprises an inactive-radio network temporary identifier (I-RNTI); send a context information obtaining request comprising the I-RNTI to a source access network device; receive a context information obtaining response from the source access network device, wherein the context information obtaining response comprises first indication information, wherein the first indication information indicates a user plane security protection method used before the UE enters an inactive state from a connected state, and wherein the user plane security protection method indicates whether at least one of user plane encryption protection or user plane integrity protection is enabled; and activate, using the user plane security protection method, user plane security between the target access network device and the UE when the user plane security protection method can be supported. ### Claim 10 (depends on 9) The target access network device according to claim 9, wherein the program instructions further cause the target access network device to send an RRC message to the UE when the user plane security protection method cannot be supported, and wherein the RRC message is configured to trigger the UE to re-establish an RRC connection to the target access network device. ### Claim 11 (depends on 9) The target access network device according to claim 9, wherein the context information obtaining response further comprises an encryption algorithm and an integrity protection algorithm that are used by the source access network device and a new access stratum key (KgNB*) generated by the source access network device, and wherein the program instructions further cause the target access network device to determine a first user plane security key between the target access network device and the UE based on the KgNB* when the target access network device supports the encryption algorithm and the integrity protection algorithm. ### Claim 12 (depends on 9) The target access network device according to claim 9, wherein the program instructions further cause the target access network device to: receive first uplink user plane data from the UE; perform user plane security deprotection on the first uplink user plane data to obtain uplink user plane data; and send the uplink user plane data. ### Claim 13 (depends on 9) The target access network device according to claim 9, wherein the context information obtaining response further comprises at least one user plane security policy of the UE, and wherein the at least one user plane security policy comprises at least one of a user plane encryption protection policy or a user plane integrity protection policy. ### Claim 14 (depends on 9) The target access network device according to claim 9, wherein the context information obtaining response further comprises a protocol data unit (PDU) session identifier (ID) corresponding to the first indication information. ### Claim 15 (depends on 9) The target access network device according to claim 9, wherein the program instructions further cause the target access network device to determine whether the user plane security protection method can be supported. ### Claim 16 An apparatus, comprising: at least one processor; and a memory coupled to the at least one processor and configured to store program instructions, which when executed by the at least one processor, cause the apparatus to: store first indication information, wherein the first indication information indicates a user plane security protection method used before the apparatus enters an inactive state from a connected state, and wherein the user plane security protection method indicates whether at least one of user plane encryption protection or user plane integrity protection is enabled; send a radio resource control (RRC) resume request to a target access network device; and activate, using the user plane security protection method, user plane security between the apparatus and the target access network device when receiving an RRC resume message from the target access network device. ### Claim 17 (depends on 16) The apparatus according to claim 16, wherein the program instructions further cause the apparatus to: determine a first user plane security key between the apparatus and the target access network device; perform user plane security protection on uplink user plane data based on the user plane security protection method and the first user plane security key; obtain first uplink user plane data based on performing the user plane security protection on the uplink user plane data; and send the first uplink user plane data to the target access network device. ### Claim 18 (depends on 17) The apparatus according to claim 17, wherein the program instructions further cause the apparatus to determine the first user plane security key between the apparatus and the target access network device according to the user plane security protection method. ### Claim 19 (depends on 16) The apparatus according to claim 16, wherein the program instructions further cause the apparatus to receive an RRC release message from a source access network device, and wherein the RRC release message indicates to the apparatus to enter the inactive state. ### Claim 20 (depends on 16) The apparatus according to claim 16, wherein the program instructions further cause the apparatus to receive an RRC connection reconfiguration message from a source access network device, and wherein the RRC connection reconfiguration message comprises the first indication information. ### Claim 21 A method comprising: receiving, by a target access network device, a radio resource control (RRC) resume request from a user equipment (UE), wherein the RRC resume request comprises an inactive-radio network temporary identifier (I-RNTI); sending, by the target access network device, a context information obtaining request comprising the I-RNTI to a source access network device; receiving, by the target access network device, a context information obtaining response from the source access network device, wherein the context information obtaining response comprises first indication information, wherein the first indication information indicates a user plane security protection method used before the UE enters an inactive state from a connected state, and wherein the user plane security protection method indicates whether at least one of user plane encryption protection or user plane integrity protection is enabled; and activating, by the target access network device using the user plane security protection method, user plane security between the target access network device and the UE when the user plane security protection method can be supported. ### Claim 22 (depends on 21) The method according to claim 21, further comprising sending, by the target access network device, an RRC message to the UE when the user plane security protection method cannot be supported, and wherein the RRC message is configured to trigger the UE to re-establish an RRC connection to the target access network device. ### Claim 23 (depends on 21) The method according to claim 21, wherein the context information obtaining response further comprises an encryption algorithm and an integrity protection algorithm that are used by the source access network device and a new access stratum key (KgNB*) generated by the source access network device, and wherein the method further comprises determining, by the target access network device, a first user plane security key between the target access network device and the UE based on the KgNB* when the target access network device supports the encryption algorithm and the integrity protection algorithm. ### Claim 24 (depends on 21) The method according to claim 21, further comprising: receiving, by the target access network device, first uplink user plane data from the UE; performing, by the target access network device, user plane security deprotection on the first uplink user plane data to obtain uplink user plane data; and sending, by the target access network device, the uplink user plane data. ### Claim 25 (depends on 21) The method according to claim 21, wherein the context information obtaining response further comprises at least one user plane security policy of the UE, and wherein the at least one user plane security policy comprises at least one of a user plane encryption protection policy or a user plane integrity protection policy. ### Claim 26 (depends on 21) The method according to claim 21, wherein the context information obtaining response further comprises a protocol data unit (PDU) session identifier (ID) corresponding to the first indication information. ### Claim 27 (depends on 21) The method according to claim 21, further comprising determining, by the target access network device, whether the user plane security protection method can be supported. ### Claim 28 A method comprising: storing, by an apparatus, first indication information, wherein the first indication information indicates a user plane security protection method used before the apparatus enters an inactive state from a connected state, and wherein the user plane security protection method indicates whether at least one of user plane encryption protection or user plane integrity protection is enabled; sending, by the apparatus, a radio resource control (RRC) resume request to a target access network device; and activating, by the apparatus using the user plane security protection method, user plane security between the apparatus and the target access network device when receiving an RRC resume message from the target access network device. ### Claim 29 The method according to 28, further comprising: determining, by the apparatus, a first user plane security key between the apparatus and the target access network device; performing, by the apparatus, user plane security protection on uplink user plane data based on the user plane security protection method and the first user plane security key; obtaining, by the apparatus, first uplink user plane data based on performing the user plane security protection on the uplink user plane data; and sending, by the apparatus, the first uplink user plane data to the target access network device. ### Claim 30 The method according to 29, wherein determining the first user plane security key comprises determining, by the apparatus, the first user plane security key between the apparatus and the target access network device according to the user plane security protection method. ### Claim 31 The method according to 28, further comprising receiving, by the apparatus, an RRC connection reconfiguration message from a source access network device, wherein the RRC connection reconfiguration message comprises the first indication information. ### Claim 32 A communications method, comprising: receiving, by a target access network device, a radio resource control (RRC) resume request from a user equipment (UE), wherein the RRC resume request comprises an inactive—radio network temporary identifier (I-RNTI); sending, by the target access network device, a context information obtaining request comprising the I-RNTI; receiving, by the source access network device, the context information obtaining request from the target access network device; obtaining, by the source access network device, first indication information based on the I-RNTI, wherein the first indication information indicates a user plane security protection method used before the source access network device and the UE enter an inactive state from a connected state, and wherein the user plane security protection method indicates whether at least one of user plane encryption protection or user plane integrity protection is enabled; sending, by the source access network device, a context information obtaining response to the target access network device, wherein the context information obtaining response comprises the first indication information; receiving, by the target access network device, the context information obtaining response from the source access network device; and activating, by the target access network device using the user plane security protection method, user plane security between the target access network device and the UE when the user plane security protection method can be supported. ### Claim 33 The communications method according to 32, further comprising sending, by the target access network device, an RRC message to the UE when the user plane security protection method cannot be supported, wherein the RRC message is configured to trigger the UE to re-establish an RRC connection to the target access network device. ### Claim 34 (depends on 32) The communications method according to claim 32, wherein the context information obtaining response further comprises an encryption algorithm and an integrity protection algorithm that are used by the source access network device and a new access stratum key (KgNB*) generated by the source access network device, and wherein the communications method further comprises determining, by the target access network device, a first user plane security key between the target access network device and the UE based on the KgNB* when the target access network device supports the encryption algorithm and the integrity protection algorithm. ### Claim 35 (depends on 32) The communications method according to claim 32, wherein the context information obtaining response further comprises at least one user plane security policy of the UE, and wherein the at least one user plane security policy comprises at least one of a user plane encryption protection policy or a user plane integrity protection policy. ### Claim 36 (depends on 32) The communications method according to claim 32, wherein the context information obtaining response further comprises a protocol data unit (PDU) session identifier (ID) corresponding to the first indication information. ### Claim 37 (depends on 32) The communications method according to claim 32, further comprising: sending, by the source access network device, an RRC release message to the UE, wherein the RRC release message indicates to the UE to enter the inactive state; storing, by the source access network device, the first indication information; deleting, by the source access network device, an RRC encryption key, a user plane encryption key, and a user plane integrity protection key; and storing, by the source access network device, an RRC integrity protection key and the first indication information. ### Claim 38 (depends on 32) The communications method according to claim 32, further comprising determining, by the target access network device, whether the user plane security protection method can be supported.