Data transmission method, first device, and second device
A data transmission method, a first device, and a second device, for use in implementing secure data transmission between a terminal device in a non-active state and a base station. The method comprises: a first device determines a transmission message comprising transmission data and a secure context identifier of a terminal device, the terminal device being in a non-active state; the first device sends the transmission message to a second device; the second device matches the secure context identifier of the terminal device with a secure context identifier of at least one local terminal device, and determines, on the basis of the matching result, whether to activate the security of the terminal device.
1. A method for transmitting data, comprising:
determining, by a first device, a transmission message comprising transmission data, and a security context identifier of an inactive terminal device, wherein the inactive terminal device is in an inactive state in which the terminal device is connected with a core network but is not air-interface connected with a base station; and
transmitting, by the first device, the transmission message to a second device;
wherein the security context identifier of the inactive terminal device is used for the second device to match the security context identifier of the inactive terminal device with a security context identifier of at least one local terminal device, and to decide whether to activate security of the inactive terminal device according to a matching result.
2. The method according to claim 1 , wherein before the determining by the first device, the transmission message comprising the transmission data, and the security context identifier of the inactive terminal device, the method further comprises:
protecting, by the first device, the transmission data for integrity using a security context corresponding to the security context identifier of the inactive terminal device.
3. The method according to claim 2 , wherein the security context comprises one or more of:
a key,
an encryption algorithm,
an integrity-protection algorithm,
a carrier identifier,
a counter, or
a security constant.
4. The method according to claim 1 , wherein the first device is the inactive terminal device, the second device is a base station, and the transmission message is layer-2 control signaling or a Radio Resource Control (RRC) message.
5. The method according to claim 1 , wherein the first device is a base station, the second device is the inactive terminal device, and the transmission message is one of:
layer-2 control signaling,
a Radio Resource Control (RRC) message, or
physical-layer control signaling.
6. A method for transmitting data, comprising:
receiving, by a second device, a transmission message transmitted from a first device, wherein the transmission message comprises transmission data, and a security context identifier of an inactive terminal device, wherein the inactive terminal device is in an inactive state in which the terminal device is connected with a core network but is not air-interface connected with a base station;
matching, by the second device, the security context identifier of the inactive terminal device with a security context identifier of at least one local terminal device; and
deciding, by the second device, whether to active security of the inactive terminal device according to a result of the matching.
7. The method according to claim 6 , wherein the deciding, by the second device, whether to active the security of the inactive terminal device according to the result of the matching comprises:
when the security context identifier of the inactive terminal device is matched successfully with the security context identifier of the at least one local terminal device, activating, by the second device, the security of the inactive terminal device; or
when the security context identifier of the inactive terminal device fails to be matched with the security context identifier of the at least one local terminal device, deciding, by the second device, not to activate the security of the inactive terminal device.
8. The method according to claim 6 , wherein after the activating, by the second device, the security of the inactive terminal device, the method further comprises:
obtaining, by the second device, a security context corresponding to the security context identifier of the inactive terminal device;
verifying, by the second device, the transmission data for integrity protection according to the security context; and
deciding, by the second device, whether to transmit data with the first device according to a result of the verifying.
9. The method according to claim 8 , wherein the deciding, by the second device, whether to transmit data with the first device according to the result of the verifying comprises:
when the transmission data is verified successfully for integrity protection, deciding, by the second device, to transmit data with the first device; or
when the transmission data fails to be verified for integrity protection, deciding, by the second device, not to transmit data with the first device.
10. The method according to claim 8 , wherein the security context comprises one or more of:
a key,
an encryption algorithm,
an integrity-protection algorithm,
a carrier identifier,
a counter, or
a security constant.
11. The method according to claim 6 , wherein the first device is the inactive terminal device, the second device is a base station, and the transmission message is layer-2 control signaling or a Radio Resource Control (RRC) message.
12. The method according to claim 6 , wherein the first device is a base station, the second device is the inactive terminal device, and the transmission message is one of:
layer-2 control signaling,
a Radio Resource Control (RRC) message, or
physical-layer control signaling.
13. A second device, comprising: a processor, a memory, and a transceiver, wherein:
the processor is configured to read and execute program in the memory:
to receive, through the transceiver, a transmission message transmitted from a first device, wherein the transmission message comprises transmission data, and a security context identifier of an inactive terminal device, wherein the inactive terminal device is in an inactive state in which the terminal device is connected with a core network but is not air-interface connected with a base station;
to match the security context identifier of the inactive terminal device in the transmission message received through the transceiver with a security context identifier of at least one local terminal device; and
to decide whether to active security of the inactive terminal device according to a matching result.
14. The second device according to claim 13 , wherein the processor configured to decide whether to active the security of the inactive terminal device, according to the matching result is configured:
when the security context identifier of the inactive terminal device is matched successfully with the security context identifier of the at least one local terminal device, to activate the security of the inactive terminal device; or
when the security context identifier of the inactive terminal device fails to be matched with the security context identifier of the at least one terminal device, to decide not to activate the security of the inactive terminal device.
15. The second device according to claim 13 , wherein the processor is further configured:
after the security of the inactive terminal device is activated, to obtain a security context corresponding to the security context identifier of the inactive terminal device;
to verify the transmission data for integrity protection according to the security context; and
to decide whether to transmit data with the first device, according to a verification result.
16. The second device according to claim 15 , wherein the processor configured to decide whether to transmit data with the first device, according to the verification result is configured:
when the transmission data is verified successfully for integrity protection, to decide to transmit data with the first device; or
when the transmission data fails to be verified for integrity protection, to decide not to transmit data with the first device.
17. The second device according to claim 15 , wherein the security context comprises one or more of:
a key,
an encryption algorithm,
an integrity-protection algorithm,
a carrier identifier,
a counter, or
a security constant.
18. The second device according to claim 13 , wherein the first device is the inactive terminal device, the second device is a base station, and the transmission message is layer-2 control signaling or a Radio Resource Control (RRC) message.
19. The second device according to claim 13 , wherein the first device is a base station, the second device is the inactive terminal device, the transmission message is one of:
layer-2 control signaling,
a Radio Resource Control (RRC) message, or
physical-layer control signaling.