Air interface information security protection method and apparatus

1. A method for protecting air interface information, comprising:

determining, by a terminal, a first message authentication code (MAC) value based on a security key and air interface information, wherein the security key is a non-access stratum (NAS) security key between the terminal and a core network device, wherein the air interface information includes a power level and a frequency band of the terminal; and

sending, by the terminal, the air interface information and the first MAC value to a base station or to the core network device.

2. The method according to claim 1 , wherein the core network device comprises a mobility management entity (MME) or an access and mobility management function (AMF); and

the security key is obtained based on any one of following keys: a key Kasme between the terminal and the MME, a key Kamf between the terminal and the AMF, a NAS integrity protection key between the terminal and the core network device, or a NAS confidentiality protection key between the terminal and the core network device.

3. The method according to claim 1 , wherein the determining the first MAC value based on the security key and the air interface information comprises:

determining, by the terminal, the first MAC value based on the security key, the air interface information, and an input parameter, wherein

the input parameter comprises a fresh parameter and/or a cell identifier, and the fresh parameter comprises one or more of a part of or all bits of an uplink NAS count, a part of or all bits of a downlink NAS count, or a random number.

4. The method according to claim 1 , wherein the sending, by the terminal, the air interface information and the first MAC value to the base station comprises:

sending, by the terminal, a first radio resource control (RRC) message to the base station, wherein the first RRC message carries the air interface information and the first MAC value; or

sending, by the terminal, a second RRC message to the base station, wherein the second RRC message carries a NAS message having the air interface information and the first MAC value.

5. The method according to claim 1 , further comprising:

receiving, by the terminal, a request message from the base station to request the air interface information, wherein the request message carries a second MAC value; and

verifying, by the terminal, the second MAC value.

6. The method according to claim 1 , wherein the air interface information is a radio capability or a radio capability identifier.

7. An apparatus operating as a terminal or used in a terminal, comprising:

a processor configured to determine a first message authentication code (MAC) value based on a security key and air interface information, wherein the security key is a non-access stratum (NAS) security key between the terminal and a core network device, wherein the air interface information includes a power level and a frequency band of the terminal; and

a transmitter configured to send the air interface information and the first MAC value to a base station.

8. The apparatus according to claim 7 , wherein the core network device comprises a mobility management entity (MME) or an access and mobility management function (AMF); and

the security key is obtained based on any one of following keys: a key Kasme between the terminal and the MME, a key Kamf between the terminal and the AMF, a NAS integrity protection key between the terminal and the core network device, or a NAS confidentiality protection key between the terminal and the core network device.

9. The apparatus according to claim 7 , wherein the processor is configured to:

determine the first MAC value based on the security key, the air interface information, and an input parameter, wherein

the input parameter comprises a fresh parameter and/or a cell identifier, and the fresh parameter comprises one or more of a part of or all bits of an uplink NAS count count, a part of or all bits of a downlink NAS count count, or a random number.

10. The apparatus according to claim 7 , wherein the transmitter is configured to:

send a first radio resource control (RRC) message to the base station, wherein the first RRC message carries the air interface information and the first MAC value; or

send a second RRC message to the base station, wherein the second RRC message carries a NAS message having the air interface information and the first MAC value.

11. The apparatus according to claim 7 , wherein the transmitter is further configured to:

receive a request message from the base station to request the air interface information, wherein the request message carries a second MAC value; and

the processor is further configured to verify the second MAC value.

12. The apparatus according to claim 7 , wherein the air interface information is a radio capability or a radio capability identifier.

13. A non-transitory machine-readable storage medium having instructions stored therein, which when executed by a processor, cause the processor to perform operations, the operations comprising:

determining, by a terminal, a first message authentication code (MAC) value based on a security key and air interface information, wherein the security key is a non-access stratum (NAS) security key between the terminal and a core network device, wherein the air interface information includes a power level and a frequency band of the terminal; and

sending, by the terminal, the air interface information and the first MAC value to a base station or to the core network device.

14. The non-transitory machine-readable storage medium according to claim 13 , wherein the core network device comprises a mobility management entity (MME) or an access and mobility management function (AMF); and

the security key is obtained based on any one of following keys: a key Kasme between the terminal and the MME, a key Kamf between the terminal and the AMF, a NAS integrity protection key between the terminal and the core network device, or a NAS confidentiality protection key between the terminal and the core network device.

15. The non-transitory machine-readable storage medium according to claim 13 , wherein the determining the first MAC value based on the security key and the air interface information comprises:

determining, by the terminal, the first MAC value based on the security key, the air interface information, and an input parameter, wherein

the input parameter comprises a fresh parameter and/or a cell identifier, and the fresh parameter comprises one or more of a part of or all bits of an uplink NAS count, a part of or all bits of a downlink NAS count, or a random number.

16. The non-transitory machine-readable storage medium according to claim 13 , wherein the sending the air interface information and the first MAC value to the base station comprises:

sending, by the terminal, a first radio resource control (RRC) message to the base station, wherein the first RRC message carries the air interface information and the first MAC value; or

sending, by the terminal, a second RRC message to the base station, wherein the second RRC message carries a NAS message having the air interface information and the first MAC value.

17. The non-transitory machine-readable storage medium according to claim 13 , the operations further comprising:

receiving, by the terminal, a request message from the base station to request the air interface information, wherein the request message carries a second MAC value; and

verifying, by the terminal, the second MAC value.

18. The non-transitory machine-readable storage medium according to claim 13 , wherein the air interface information is a radio capability or a radio capability identifier.