Communication method and apparatus
This application provides a communication method and apparatus. A transmitting apparatus performs first security processing on first control data of a user plane to obtain second control data. The first security processing comprises at least one of encryption processing or integrity protection processing. Furthermore, a packet header of the second control data comprises first security indication information, and the first security indication information indicates that the second control data underwent the first security processing. The transmitting apparatus then sends the second control data to a receiving apparatus. The receiving apparatus performs at least one of decryption processing or integrity verification processing on the second control data. In this way, network security is improved.
1 . A method, comprising:
performing first security processing, at a media access control (MAC) layer, on first control data of a user plane to obtain second control data, the first security processing comprises at least one of encryption processing or integrity protection processing, and wherein the performing the first security processing comprises:
performing the first security processing on at least two MAC sub protocol data units (PDUs) in the first control data to obtain the second control data, wherein a MAC subPDU in the at least two MAC subPDUs comprises a control PDU or a MAC control element (CE), and the at least two MAC subPDUs belong to a same MAC PDU; and
sending the second control data, wherein a packet header of the second control data comprises first security indication information, and the first security indication information indicates that the second control data underwent the first security processing.
2 . The method according to claim 1 , wherein before the performing the first security processing, at the MAC layer, on the first control data of the user plane to obtain the second control data, the method further comprises:
determining, based on a preset first control data type, that the first security processing is to be performed on the first control data; and
the first control data type comprises one or more of the following control data types:
a control PDU from a service data adaptation protocol (SDAP) layer;
a control PDU from a packet data convergence protocol (PDCP) layer;
a control PDU from a radio link control (RLC) layer; or
a MAC CE.
3 . The method according to claim 2 , wherein the determining,
based on the preset first control data type, that the first security processing is to be performed on the first control data comprises:
obtaining first indication information, wherein the first indication information indicates that a first data packet belongs to the first control data type; determining the first control data based on the first data packet; and determining to perform the first security processing on the first control data.
4 . The method according to claim 1 , wherein the performing the first security processing, at the MAC layer, on the first control data is based on at least one of the following parameters:
a sequence number corresponding to the first control data;
a count value corresponding to the first control data;
a type parameter corresponding to the first control data;
a logical channel identifier corresponding to the first control data; or
a radio bearer identifier corresponding to the first control data.
5 . The method according to claim 1 , wherein a packet header of a MAC PDU corresponding to the second control data comprises second security indication information; and the second security indication information indicates whether the MAC PDU underwent the first security processing, or the second security indication information indicates that the MAC PDU comprises a MAC subPDU that underwent the first security processing.
6 . The method according to claim 1 , wherein integrity check information corresponding to the integrity protection processing comprises a message authentication code-integrity or a truncated message authentication code-integrity.
7 . A method, comprising:
receiving second control data via a user plane, wherein a packet header of the second control data comprises first security indication information, the first security indication information indicates that the second control data underwent first security processing, and the first security processing comprises at least one of encryption processing or integrity protection processing; and
performing second security processing, at a media access control (MAC) layer, on the second control data, wherein the second security processing comprises at least one of decryption processing or integrity verification processing, and the preforming the second security processing comprises:
performing the second security processing on at least two MAC sub protocol data units (PDUs) in the second control data, wherein a MAC subPDU in the at least two MAC subPDUs comprises a control PDU or a MAC control element (CE), and the at least two MAC subPDUs belong to a same MAC PDU.
8 . The method according to claim 7 , wherein the performing the second security processing, at the MAC layer, on the second control data is based on at least one of the following parameters:
a sequence number corresponding to first control data;
a count value corresponding to the first control data;
a type parameter corresponding to the first control data;
a logical channel identifier corresponding to the first control data; or
a radio bearer identifier corresponding to the first control data.
9 . An apparatus, comprising:
one or more processors; and
one or more memories coupled to the one or more processors and storing programming instructions for execution by the one or more processors to cause the apparatus to:
perform first security processing, at a media access control (MAC) layer, on first control data of a user plane to obtain second control data, the first security processing comprises at least one of encryption processing or integrity protection processing, and wherein the performing the first security processing comprises:
performing the first security processing on at least two MAC sub protocol data units (PDUs) in the first control data to obtain the second control data, wherein a MAC subPDU in the at least two MAC subPDUs comprises a control PDU or a MAC control element (CE), and the at least two MAC subPDUs belong to a same MAC PDU; and
send the second control data, wherein a packet header of the second control data comprises first security indication information, and the first security indication information indicates that the second control data underwent the first security processing.
10 . The apparatus according to claim 9 , wherein before the performing the first security processing, at the MAC layer, on the first control data of the user plane to obtain the second control data, the apparatus is further caused to:
determine, based on a preset first control data type, that the first security processing is to be performed on the first control data; and
the first control data type comprises one or more of the following control data types:
a control PDU from a service data adaptation protocol (SDAP) layer;
a control PDU from a packet data convergence protocol (PDCP) layer;
a control PDU from a radio link control (RLC) layer; or
a MAC CE.
11 . The apparatus according to claim 10 , wherein the determining,
based on the preset first control data type, that the first security processing is to be performed on the first control data comprises:
obtaining first indication information, wherein the first indication information indicates that a first data packet belongs to the first control data type; determining the first control data based on the first data packet; and determining to perform the first security processing on the first control data.
12 . The apparatus according to claim 9 , wherein the performing the first security processing, at the MAC layer, on the first control data is based on at least one of the following parameters:
a sequence number corresponding to the first control data;
a count value corresponding to the first control data;
a type parameter corresponding to the first control data;
a logical channel identifier corresponding to the first control data; or
a radio bearer identifier corresponding to the first control data.