Security implementation method, device, and system
AssigneeHuawei Technologies Co., Ltd.
InventorsBo Zhang, Rong Wu, Lu Gan
Life of this patent
Estimating the term…
Abstract
A security implementation method includes obtaining, by a first device, a security policy of a session and at least one key, and sending, by the first device, protected data to a second device, where the protected data is obtained by protecting security of session data of the session using the at least one key based on the security policy of the session, and the second device is configured to restore the protected data using the at least one key based on the security policy to obtain the session data, where when the first device is a terminal device, the second device is an access network node or a user plane node, or when the first device is an access network node or a user plane node, the second device is a terminal device.
Claims18
A security implementation method implemented by an apparatus and comprising:
- obtaining a security policy of a session between the apparatus and an access network node, wherein the security policy indicates a protection mode of the session;
- obtaining at least one key, wherein the at least one key comprises a first key or a second key, wherein the first key is based on a user plane encryption algorithm identifier, and wherein the second key is based on a user plane integrity protection algorithm identifier;
- performing, based on the protection mode, security protection on session data of the session using the at least one key to obtain protected data of the session, wherein performing the security protection comprises protecting first security of the session data using the first key or protecting second security of the session data using the second key, wherein protecting the first security of the session includes protecting a confidentiality of the session, and wherein protecting the second security of the session includes protecting an integrity of the session;
- and
- sending the protected data of the session to the access network node.
An apparatus comprising:
- a processor coupled to a memory storing instructions and configured to execute the instructions to cause the apparatus to:
- obtain a security policy of a session between the apparatus and an access network node, wherein the security policy of the session indicates a protection mode of the session;
- obtain at least one key, wherein the at least one key comprises a first key or a second key, wherein the first key is based on a user plane encryption algorithm identifier, and wherein the second key is based on a user plan integrity protection algorithm identifier;
- perform, based on the protection mode, security protection on session data of the session using the at least one key to obtain protected data of the session, wherein performing the security protection comprises protecting first security of the session data using the first key or protecting second security of the session data using the second key, wherein protecting the first security includes protecting a confidentiality of the session, and wherein protecting the second security of the session includes protecting an integrity of the session;
- and
- send the protected data of the session to the access network node.
A non-transitory storage device configured to store instructions, which when executed by a processor of an apparatus, cause the apparatus to:
- obtain a security policy of a session between the apparatus and an access network node, wherein the security policy of the session indicates a protection mode of the session;
- obtain at least one key, wherein the at least one key comprises a first key or a second key based, wherein the first key is based on a user plane encryption algorithm identifier, and wherein the second key is based on the user plane integrity protection algorithm identifier;
- perform, based on the protection mode, security protection on session data of the session using the at least one key to obtain protected data of the session, wherein performing the security protection comprises protecting first security of the session data using the first key or protecting second security of the session data using the second key, wherein protecting the first security of the session includes protecting a confidentiality of the session, and wherein protecting the second security of the session includes protecting an integrity of the session, and
- send the protected data of the session to the access network node.
Dependencies are inferred from the claim text.