Security negotiation method and apparatus
A security negotiation method includes receiving, by a terminal, security negotiation information from a centralized unit control plane (CU-CP)/a centralized unit user plane (CU-UP), where the security negotiation information includes an integrity protection indication identifier of the CU-UP, and determining, by the terminal based on the integrity protection indication identifier, whether to enable user-plane integrity protection of the terminal.
1. A security negotiation method, wherein the security negotiation method comprises:
sending, by an apparatus, a first session establishment request to a session management function (SMF) entity;
receiving, by the apparatus, security negotiation information from a centralized unit control plane (CU-CP), wherein the security negotiation information comprises an integrity protection indication identifier of a centralized unit user plane (CU-UP) disposed in a separate entity than the CU-CP, and wherein the security negotiation information further comprises an encryption protection indication identifier of the CU-UP;
determining, by the apparatus, based on the integrity protection indication identifier from the CU-CP, whether to enable session-based user-plane integrity protection of the apparatus, wherein determining whether to enable the session-based user-plane integrity protection of the apparatus comprises determining to enable the session-based user-plane integrity protection of the apparatus when the integrity protection indication identifier indicates that integrity protection of the CU-UP is enabled;
determining, by the apparatus, based on the encryption protection indication identifier, whether to enable session-based encryption protection of the apparatus; and
sending, by the apparatus after determining to enable the session-based user-plane integrity protection of the apparatus, an integrity protection parameter to the CU-CP.
2. The security negotiation method of claim 1 , wherein the security negotiation information further comprises a key generation parameter, wherein the security negotiation method further comprises generating, by the apparatus, a user-plane integrity protection key of the CU-UP based on the key generation parameter, and wherein the key generation parameter comprises one or more of:
an instance identifier;
a CU-UP identifier;
a distributed unit (DU) identifier;
a data bearer identifier;
a bearer identifier;
a stream identifier;
a session identifier;
a slice identifier;
a media access control (MAC) layer identifier;
a Radio Resource Control (RRC) signaling counter;
a frequency identifier;
a cell identifier;
a fresh parameter;
a user-plane integrity protection algorithm type identifier length of the CU-UP;
a user-plane integrity protection algorithm type identifier length of the CU-CP;
a user-plane encryption protection type identifier length of the CU-UP; or
a user-plane encryption protection type identifier length of the CU-CP.
3. The security negotiation method of claim 1 , wherein determining whether to enable the session-based user-plane integrity protection of the apparatus comprises determining not to enable the session-based user-plane integrity protection of the apparatus when the integrity protection indication identifier indicates that integrity protection of the CU-UP is not enabled.
4. The security negotiation method of claim 3 , wherein after determining not to enable the session-based user-plane integrity protection of the apparatus, the security negotiation method further comprises sending, by the apparatus, a security negotiation response to the CU-CP, and wherein the security negotiation response comprises an integrity protection parameter and an indication identifier indicating that the session-based user-plane integrity protection of the apparatus is enabled.
5. The security negotiation method of claim 1 , wherein receiving the security negotiation information comprises receiving, by the apparatus, the security negotiation information via a Radio Resource Control (RRC) reconfiguration message.
6. A security negotiation apparatus comprising:
a memory configured to store instructions; and
a processor coupled to the memory, wherein the instructions cause the processor to be configured to:
send a first session establishment request to a session management function (SMF) entity;
receive security negotiation information from a centralized unit control plane (CU-CP), wherein the security negotiation information comprises an integrity protection indication identifier of a centralized unit user plane (CU-UP) disposed in a separate entity than the CU-CP, and wherein the security negotiation information further comprises an encryption protection indication identifier of the CU-UP;
determine, based on the integrity protection indication identifier from the CU-CP, whether to enable session-based user-plane integrity protection of the security negotiation apparatus, wherein determining whether to enable the session-based user-plane integrity protection of the security negotiation apparatus comprises determining to enable the session-based user-plane integrity protection of the security negotiation apparatus when the integrity protection indication identifier indicates that integrity protection of the CU-UP is enabled;
determine, based on the encryption protection indication identifier, whether to enable session-based encryption protection of the apparatus; and
send, after determining to enable the session-based user-plane integrity protection of the security negotiation apparatus, an integrity protection parameter to the CU-CP.
7. The security negotiation apparatus of claim 6 , wherein the security negotiation information further comprises a key generation parameter, and wherein the key generation parameter comprises one or more of:
an instance identifier;
a CU-UP identifier;
a distributed unit (DU) identifier;
a data bearer identifier;
a bearer identifier;
a stream identifier;
a session identifier;
a slice identifier;
a media access control (MAC) layer identifier;
a Radio Resource Control (RRC) signaling counter;
a frequency identifier;
a cell identifier;
a fresh parameter;
a user-plane integrity protection algorithm type identifier length of the CU-UP;
a user-plane integrity protection algorithm type identifier length of the CU-CP;
a user-plane encryption protection type identifier length of the CU-UP; or
a user-plane encryption protection type identifier length of the CU-CP.
8. The security negotiation apparatus of claim 6 , wherein the instructions further cause the processor to be configured to determine not to enable the session-based user-plane integrity protection of the security negotiation apparatus when the integrity protection indication identifier indicates that integrity protection of the CU-UP is not enabled.
9. The security negotiation apparatus of claim 8 , wherein the instructions further cause the processor to be configured to send a security negotiation response to the CU CP.
10. The security negotiation apparatus of claim 9 , wherein the security negotiation response comprises an integrity protection parameter.
11. The security negotiation apparatus of claim 10 , wherein the security negotiation response further comprises an indication identifier indicating that the session-based user-plane integrity protection of the security negotiation apparatus is enabled.