Granted Patent B2

US 12,568,360 · App. 18/427,313 · Granted Mar 3, 2026

Inventors: Longhua Guo (Shanghai, CN); Yuanping Zhu (Shanghai, CN); Rong Wu (Shenzhen, CN)

Assignee: Huawei Technologies Co., Ltd.

H04W12/041H04W12/033H04W12/037H04W12/08

Abstract

Claims (79)

1 . A key determining method applied to a donor node central unit containing a control plane entity and a user plane entity, the method comprising:

deriving, by the control plane entity, a first key based on a root key, an internet protocol (IP) address of a distributed unit of an integrated access and backhaul node, and a first IP address of the user plane entity,

wherein the first key is different from the root key, and

wherein the root key is a key obtained by the control plane entity from a network in a procedure in which the integrated access and backhaul node registers with the network; and

sending, by the control plane entity, a first message to the user plane entity,

wherein the first message comprises a one-to-one correspondence between the first key and the first IP address, and

wherein the first key and first IP address are for establishing a user plane secure transmission channel between the user plane entity and the distributed unit.

2 . The method according to claim 1 , further comprising:

sending, by the control plane entity, first indication information to the user plane entity; and

receiving, by the control plane entity, one or more IP addresses from the user plane entity,

wherein the one or more IP addresses comprise the first IP address.

3 . The method according to claim 2 , wherein the one or more IP addresses further comprises a second IP address, the method further comprises:

deriving, by the control plane entity, a second key based on the root key, the IP address of the distributed unit, and the second IP address,

wherein the first message comprises the one-to-one correspondence between the first key and the first IP address and a one-to-one correspondence between the second key and the second IP address.

4 . The method according to claim 1 , wherein the first key is KIAB, and the root key is KgNB.

5 . The method according to claim 1 further comprising:

deriving, by the control plane entity, a third key based on the root key, the IP address of the distributed unit, and an IP address of the control plane entity; and

establishing, by the control plane entity, a control plane secure transmission channel between the control plane entity and the distributed unit based on the third key.

6 . The method according to claim 1 further comprising:

receiving, by the user plane entity, the first message; and

establishing, by the user plane entity, a user plane secure transmission channel between the user plane entity and the distributed unit based on the first key and the first IP address.

7 . The method according to claim 6 , wherein the first message comprises a one-to-one correspondence between a plurality of IP addresses of the user plane entity and a plurality of keys, wherein the plurality of keys comprise the first key, and wherein the first key is corresponding to the first IP address; and the method further comprises:

determining, by the user plane entity, to establish the user plane secure transmission channel by using the first IP address; and

determining, by the user plane entity based on the one-to-one

correspondence that a key corresponding to the first IP address is the first key.

8 . The method according to claim 7 further comprising:

receiving, by the user plane entity, first indication information from the control plane entity; and

sending, by the user plane entity based on the first indication information, the plurality of IP addresses to the control plane entity.

9 . A system comprising a control plane entity of a donor node central unit and a user plane entity of the donor node central unit, wherein:

the control plane entity comprises at least one first processor and at least one first memory, and is configured to:

derive a first key based on a root key, an internet protocol (IP) address of a distributed unit of an integrated access and backhaul node, and a first IP address of the user plane entity,

wherein the first key is different from the root key, and

wherein the root key is a key obtained by the control plane entity from a network in a procedure in which the integrated access and backhaul node registers with the network;

send a first message to the user plane entity, wherein the first message comprises a one-to-one correspondence between the first key and the first IP address; and

the user plane entity comprises at least one second processor and at least one second memory, and is configured to:

receive the first message; and

establish a user plane secure transmission channel between the user plane entity and the distributed unit based on the first key and the first IP address.

10 . The system according to claim 9 , wherein the control plane entity is further configured to:

send first indication information to the user plane entity; and

receive one or more IP addresses of the user plane entity from the user plane entity, wherein the one or more IP addresses comprise the first IP address; and

the user plane entity is further configured to:

receive the first indication information from the control plane entity; and

send the one or more IP addresses to the control plane entity based on the first indication information.

11 . The system according to claim 10 , wherein the one or more IP addresses further comprises a second IP address, the control plane entity is further configured to derive a second key based on the root key, the IP address of the distributed unit, and the second IP address,

wherein the first message comprises the one-to-one correspondence between the first key and the first IP address and a one-to-one correspondence between the second key and the second IP address.

12 . The system according to claim 9 , wherein the control plane entity is further configured to:

derive a third key based on the root key, the IP address of the distributed unit, and an IP address of the control plane entity; and

establish a control plane secure transmission channel between the control plane entity and the distributed unit based on the third key.

13 . A control plane entity of a donor node central unit, wherein the donor node central unit further contains a user plane entity, and the control plane entity comprises:

a memory configured to store a computer program; and

a processor configured to invoke the computer program from the memory and run the computer program so as to enable the control plane entity to:

derive a first key based on a root key, an internet protocol (IP) address of a distributed unit of an integrated access and backhaul node, and a first IP address of the user plane entity,

wherein the first key is different from the root key, and

wherein the root key is a key obtained by the control plane entity from a network in a procedure in which the integrated access and backhaul node registers with the network; and

send a first message to the user plane entity,

wherein the first message comprises a one-to-one correspondence between the first key and the first IP address, and

wherein the first key and first IP address are for establishing a user plane secure transmission channel between the user plane entity and the distributed unit.

14 . The control plane entity according to claim 13 , wherein the processor is further configured to invoke the computer program from the memory and run the computer program to further enable the control plane entity to:

send first indication information to the user plane entity; and

receive one or more IP addresses from the user plane entity, wherein the one or more IP addresses comprise the first IP address.

15 . The control plane entity according to claim 14 , wherein the one or more IP addresses further comprises a second IP address, and the processor is further configured to invoke the computer program from the memory and run the computer program so as to further enable the control plane entity to derive a second key based on the root key, the IP address of the distributed unit, and the second IP address,

wherein the first message comprises the one-to-one correspondence between the first key and the first IP address and a one-to-one correspondence between the second key and the second IP address.

16 . The control plane entity according to claim 13 , wherein the processor is further configured to invoke the computer program from the memory and run the computer program to further enable the control plane entity to:

derive a third key based on the root key, the IP address of the distributed unit, and an IP address of the control plane entity; and

establish a control plane secure transmission channel between the control plane entity and the distributed unit based on the third key.

17 . A non-transitory computer-readable storage medium that stores a computer program and, based on the computer program run by a control plane entity of a donor node central unit, the control plane entity is enabled to:

derive a first key based on a root key, an internet protocol (IP) address of a distributed unit of an integrated access and backhaul node, and a first IP address of a user plane entity of the donor node central unit,

wherein the first key is different from the root key, and

wherein the root key is a key obtained from a network in a procedure in which the integrated access and backhaul node registers with the network; and

send a first message to the user plane entity,

wherein the first message comprises a one-to-one correspondence between the first key and the first IP address, and

wherein the first key and first IP address are for establishing a user plane secure transmission channel between the user plane entity and the distributed unit.

18 . The non-transitory computer-readable storage medium according to claim 17 , wherein upon the computer program being run by the control plane entity, the control plane entity is further enabled to:

send first indication information to the user plane entity; and

receive one or more IP addresses from the user plane entity, wherein the one or more IP addresses comprise the first IP address.

19 . The non-transitory computer-readable storage medium according to claim 17 , wherein the first key is KIAB, and the root key is KgNB.

20 . The non-transitory computer-readable storage medium according to claim 17 , wherein upon the computer program being run by the control plane entity, the control plane entity is further enabled to:

derive a third key based on the root key, the IP address of the distributed unit, and an IP address of the control plane entity; and

establish a control plane secure transmission channel between the control plane entity and the distributed unit based on the third key.

Assignments (1)

Priority Claims (1)

Continuity (2)

References Cited (30)