Key configuration method, security policy determining method, and apparatus
This application provides a key configuration method. A session management network element receives a request for end-to-end communication and obtains a security policy, where the security policy is determined based on at least one of: a user security requirement that is of the user equipment and that is preconfigured on a home subscriber server, a service security requirement from the user equipment, a security capability requirement supported by the user equipment, a security capability requirement from a carrier network, and a security requirement of a device on the other end of the end-to-end communication. The session management network element obtains a protection key used for protecting the end-to-end communication. The session management network element sends the security policy to the devices on two ends of the end-to-end communication.
1. A method for determining a security policy, comprising:
sending, by a mobility management network device, a session request to a session management network device, wherein the session request comprises a user equipment identity (UE ID) and a session identity (ID);
receiving, by the session management network device, the session request from the mobility management network device;
determining, by the session management network device, a security policy based on a user security requirement of the user equipment in response to determining that a priority of the user security requirement is higher that a priority of the security requirement of an operator network, wherein the user security requirement is obtained from a subscriber repository and the security requirement of the operator network is stored in the session management network device; and
sending, by the session management network device, the security policy to a base station.
2. The method according to claim 1 , wherein the user security requirement is configured to indicate whether encryption is required and whether integrity protection is required.
3. The method according to claim 2 , wherein the security policy is configured to indicate whether encryption is required and whether integrity protection is required.
4. The method according to claim 3 , wherein the user security requirement further comprises a key length of a key and the security policy further comprises the key length of the key.
5. The method according to claim 1 , wherein the session request comprises a slice identity (ID).
6. A system for determining a security policy, comprising:
a mobility management network device; and
a session management network device in communication with the mobility management network device;
the mobility management network device configured to: send a session request to the session management network device, wherein the session request comprises a user equipment identity (UE ID) and a session identity (ID);
the session management network device is configured to:
receive the session request from the mobility management network device;
determine a security policy based on a user security requirement of a user equipment having the UE ID in response to determining that a priority of the user security requirement is higher that a priority of a security requirement of an operator network, wherein the user security requirement is obtained from a subscriber repository and the security requirement of the operator network is stored in the session management network device; and
send the security policy to a base station.
7. The method according to claim 6 , wherein the user security requirement is configured to indicate whether encryption is required and whether integrity protection is required.
8. The method according to claim 7 , wherein the security policy is configured to indicate whether encryption is required and whether integrity protection is required.
9. The method according to claim 8 , wherein the user security requirement comprises a key length of a key and the security policy further comprises the key length of the key.
10. The method according to claim 6 , wherein the session request comprises a slice identity (ID).
11. A method for determining a security policy, comprising:
receiving, by a session management network element, a session request from a mobile management network device, wherein the session request comprises a user equipment identity (UE ID) and a session identity (ID);
determining, by the session management network device, a security policy based on a user security requirement of a user equipment having the UE ID in response to determining that a priority of the user security requirement is higher that a priority of a security requirement of an operator network, wherein the user security requirement is obtained from a subscriber repository and the security requirement of the operator network is stored in the session management network device; and
sending, by the session management network device, the security policy to a base station.
12. The method according to claim 11 , wherein the user security requirement is configured to indicate whether encryption is required and whether integrity protection is required.
13. The method according to claim 12 , wherein the security policy is configured to indicate whether encryption is required and whether integrity protection is required.
14. The method according to claim 13 , wherein the user security requirement comprises a key length of a key and the security policy comprises the key length of the key.
15. The method according to claim 11 , wherein the session request comprises a slice identity (ID).
16. A session management network device, the session management network device comprising:
at least one processor; and
one or more memories coupled to the at least one processor and storing programming instructions for execution by the at least one processor to:
receive a session request from a mobility management network device, wherein the session request comprises a user equipment identity (UE ID) and a session identity (ID);
determine a security policy based on a user security requirement of a user equipment having the UE ID in response to determining that a priority of the user security requirement is higher that a priority of a security requirement of an operator network, wherein the user security requirement is obtained from a subscriber repository and the security requirement of the operator network is stored in the session management network device; and
send the security policy to a base station.
17. The session management network device according to claim 16 , wherein the user security requirement is configured to indicate whether encryption is required and whether integrity protection is required.
18. The session management network device according to claim 17 , wherein the security policy is configured to indicate whether encryption is required and whether integrity protection is required.
19. The session management network device according to claim 18 , wherein the user security requirement comprises a key length of a key and the security policy further comprises the key length of the key.
20. A non-transitory computer readable storage medium, the non-transitory computer readable storage medium storing instructions for execution by at least one processor to:
receive a session request from a mobile management network device, wherein the session request comprises a user equipment identity (UE ID) and a session identity (ID);
determine a security policy based on a user security requirement of a user equipment having the UE ID in response to determining that a priority of the user security requirement is higher that a priority of a security requirement of an operator network, wherein the user security requirement is obtained from a subscriber repository and the security requirement of the operator network is stored in the session management network device; and
send the security policy to a base station.