WO2007022717A1

WO2007022717A1 - A verifying method for ranging request and the wireless access network

Info

Publication number: WO2007022717A1
Application number: PCT/CN2006/002150
Authority: WO
Inventors: Jianjun Wu; Zhengfei Xiao
Original assignee: Huawei Technologies Co., Ltd.
Priority date: 2005-08-23
Filing date: 2006-08-23
Publication date: 2007-03-01

Abstract

A verifying method for ranging request and the wireless access network said method includes: a user terminal sends the ranging request to the object base station; the object base station obtains authentication key, and verifies said ranging request according to said authentication key. The scheme of the present invention reduces the signaling spending in the network, meanwhile, assures Authenticator which stores said MSS key information, and retransmits key application to the object BS effectually and correctly.

Description

Ranging request face method and wireless access network

The present invention relates to the field of communications, and in particular, to a method for verifying a ranging request and a wireless access network in the case of an Authenticator. Background technique

With the rapid development of Internet services and the widespread use of wireless networks, more and more security requirements have been put forward for wireless access networks, in addition to the widely used methods of device authentication, user authentication and service authorization. In addition to improving the security of wireless communication, the establishment of a secure channel between a user terminal (MSS) and a base station (BS), exchange of confidential information, and BS and Authenticator, Authenticator, and authentication server The establishment of a secure channel between (Authenticate Server), the exchange of confidential information, etc. are all issues that require special attention at present.

FIG. 1 shows a schematic diagram of a secure network architecture system of a wireless access network in the prior art. As shown in Figure 1, the following network elements are mainly involved in the secure network architecture of the radio access network: MSS, BS, Authenticator, and Authentication Server. The main function of the MSS in the security architecture is to initiate authentication and authentication, exchange information required to generate a root key with the Authentication Server, generate a root key, and generate data encryption for the air interface according to the root key. The authentication key (AK, Authorization Key) and other key information derived from the AK for encrypting data and managing message consistency check; the function of the BS in the above security architecture is to provide a security system channel for Authenticator and MSS. Compress and encrypt the air interface data, exchange the confidential information between the BS and the MSS, provide the MSS with a secure channel from the BS to the Authenticator, etc. The main function of the Authenticator in the above security architecture is to authenticate, authorize and charge the MSS. Providing a proxy function, according to the root key information and the identity of the BS provided by the Authentication Server and the MSS, generating an AK required to establish a secure channel between the BS and the MSS, and distributing the A to the corresponding BS; Key features include: Authenticate, authorize, and bill for MSS, generate and distribute root key information to Authenti Cator , timely notification when user information changes The consequences of Authenticator and other network element user information changes.

In this way, data transmitted over the air interface can be securely transmitted by encryption, and management messages transmitted over the air interface can also be securely transmitted by using a Message Authentication Code (MAC) for consistency check. If the HASH algorithm is adopted, the message authentication code is called Hash Message Authentication Code (HMAC). In the WiMAX system, in addition to the message authentication code using the HASH algorithm, a Cipher based Message Authentication Code (CMAC) can also be used for consistency correction.

Considering the above architecture, when the MSS moves into the coverage of the target BS, after synchronizing with the target BS and obtaining the uplink and downlink parameters of the air interface, the ranging process will be performed, and the target BS is notified by sending the RNG-REQ, The MSS has successfully moved and accessed to the target BS. (In the case of handover, the MSS will communicate with the peer user through the target BS; while the MSS is in idle mode, by notifying the BS that the MSS has moved and accessed the target. Under the BS, the paging controller is notified by the target BS that the MSS has updated the location, and the paging controller is notified to update the location information of the MSS in time, so that the MSS can correctly send the message/data through the target BS when being paged. Sent to the MSS) Generally, in order to ensure the consistency of the air interface management message, this message will be appended with HMAC/CMAC for the BS to perform the consistency check. Once the consistency check is passed, the process of re-authentication, authorization and authentication can be omitted. . When the BS performs the consistency check, it needs to obtain AK. As described above, the AK needs to be regenerated on the Authenticator using the key information stored in the Authenticator and the information of the target BS. Then two things can happen:

(1) The Authenticator to which the target BS belongs stores key information of the MSS.

(2) The Authenticator to which the target BS belongs does not have the key information of the MSS, and the key information of the MSS is stored in the original Authenticator.

How to complete the consistency check of RNG-REQ and subsequent management messages becomes a problem.

In the prior art, when the Authenticator changes during the handover process and the Authenticator to which the target BS belongs does not have the key information of the MSS, the target BS follows the flow shown in Figure 2. R G-REQ and subsequent consistency check of management messages.

5201. The MSS moves from the original BS to the target BS, synchronizes with the target BS, and receives the uplink and downlink air interface resource allocation parameters of the target BS, and then sends the RNG-REQ to the target BS, and then the HMAC information is attached;

5202. The target BS sends an AK_Request to the service Authenticator to which it belongs, which includes the MSS, the identifier of the target BS, and the message body and HMAC in the ranging request.

5203. The service Authenticator requests the original Authenticator to request the latter to generate the air interface key AK for the target BS, and forwards the identifier of the MSS, the target BS, and the message body and the HMAC in the ranging request to the original Authenticator;

5204. The original Authenticator generates an air interface key AK for the target BS according to the identifiers of the MSS and the target BS and the stored key information of the MSS, and performs consistency check on the message body and the HMAC in the ranging request according to the AK. After the verification is passed, the AK and the corresponding AKID, the life cycle of the AK, and other key information (such as EIK) are sent to the target BS through the service Authenticator;

5205. The target BS obtains an air interface key AK, and analyzes and processes the content of the RNG-REQ.

5206. Construct a response RNG-RSP and an attached HMAC.

Thereafter, the AK can be used to check the received management message of the MSS containing the HMAC, and the HMAC can be added to the management message that needs to be sent to the MSS for consistency verification by the peer, and can also be used by the AK for The encryption key on the data path ensures the confidentiality of the session traffic over the air interface.

In the prior art, in order to perform the initial consistency check, the entire RNG-REQ message body and the HMAC are sent to the original Authenticator through the service Authenticator, and the increase of the content causes the signaling overhead in the internal interface of the network; The message sent by the BS to the service Authenticator does not contain any information about the original Authenticator, which causes the service Authenticator to fail to forward the message to the original Authenticator correctly and correctly. The whole process has certain irrationalities and needs to be improved. Summary of the invention The invention provides a method for verifying the ranging request and a wireless access network, which solves the problem that the existing process is unreasonable and wastes the signaling overhead of the internal interface of the network.

The method of the invention comprises:

A method for verifying a ranging request includes the following steps:

The user terminal sends a ranging request to the target base station;

The target base station obtains an authentication key, and performs the calibration request according to the authentication key.

The step of the user terminal sending a ranging request to the target base station further includes:

The user terminal synchronizes with the target base station, and receives an air interface resource allocation parameter that identifies the uplink and downlink of the target base station.

In the step of the user terminal transmitting a ranging request to the target base station, the ranging request carries a message authentication code.

The message authentication code is a hash message authentication code or an encrypted message authentication code. The step of the target base station acquiring the authentication key includes:

The target base station sends an authentication key request to the service authenticator, where the authentication key request includes the user terminal and the original authenticator location information;

The original authenticator interacts with the service authenticator to identify the user terminal and the target base station identification information, and generates an authentication key of the user terminal for the target base station.

The original authenticator location information may be the original authenticator identification information or the method described in the original base station identification information. If the original authenticator location information is the original base station identification information, the method includes The original base station identification information is searched for the original authenticator.

The step of the original authenticator and the service authenticator interacting with the user terminal and the target base station identification information, and generating the authentication key of the user terminal for the target base station, further includes:

The service authenticator sends an authentication key application request to the original authenticator, where the identifier of the user terminal and the target base station is included;

The original authenticator according to the identity of the user terminal and the target base station, and the key letter stored by the original authenticator And generating an authentication key and related information of the user terminal for the target base station;

The service authenticator sends the authentication key and related information to the target base station.

The service authenticator sends a key application request to the original authenticator, which includes the identifier of the user terminal; the original authenticator sends the stored key information of the user terminal to the service authenticator, and the service authenticator according to the user terminal and The identifier of the target base station and the key information of the user terminal generate an authentication key and related information of the user terminal for the target base station;

The target base station obtains an authentication key, and performs a face-finding step on the ranging request, and further includes:

The target base station sends an authentication key request to the service authenticator to which it belongs, where the authentication key request includes the identifiers of the user terminal and the paging controller;

The paging controller interacts with the service authenticator to identify the user terminal and the target base station identity information, and generates an authentication key of the user terminal for the target base station.

The target base station obtains the authentication key, and in the step of verifying the ranging request, if the service authenticator to which the target base station belongs holds the key information of the user terminal, the target base station directly uses the The authentication key information is used to verify the ranging request.

The target base station obtains an authentication key, and performs a verification step on the ranging request, and further includes:

The target base station sends an authentication key request to the service authenticator, where the authentication key request includes the user terminal information;

The service authenticator generates an answer key and related information of the user terminal for the target base station according to the user terminal identifier and the target base station identifier.

The step of obtaining the authentication key by the target base station, further includes:

The target base station sends an authentication key request to the original authenticator, where the authentication key request includes user terminal information; The original authenticator generates an authentication key for the target base station and transmits the authentication key to the target base station.

The authentication key related information includes an authentication key identifier, an activation period of the authentication key, and key information.

The method further includes the steps of:

The target base station constructs a ranging request response and an additional message authentication code therein and transmits it to the user terminal.

The method further includes the steps of:

The target base station uses the authentication key to check the received management message of the user terminal.

The method further includes the steps of:

An encryption key is generated by the authentication key.

A radio access network, comprising a user terminal, an original base station for accessing the user terminal, and an original authenticator storing key information of the user terminal, for the target base station after the user terminal moves and the service connected to the target base station The authenticator, and the authentication server;

The user terminal is configured with:

a ranging request sending unit, configured to send a ranging request to the target base station;

The target base station is configured with:

An authentication key obtaining unit, configured to obtain an authentication key;

a verification unit, configured to verify the ranging request.

The user terminal is further configured to:

A synchronization unit, configured to synchronize with the target base station.

The authentication key obtaining unit further sets:

The authentication key request sending unit is configured to send an authentication key request to the service authenticator, where the authentication key request includes the user terminal and the original authenticator location information;

The service authenticator also sets: An authentication key request request sending unit, configured to send an authentication key request request to the original authenticator, where the identifier of the user terminal and the target base station is included;

The original authenticator also sets:

The authentication key and related information generating unit is configured to generate an authentication key and related information of the user terminal for the target base station according to the identifiers of the user terminal and the target base station and the key information stored by the original authenticator;

The authentication key and related information sending unit is configured to send the authentication key and related information to the target base station.

The target base station is further configured to:

An authentication key request sending unit, configured to send an authentication key request to the original authenticator, where the authentication key request includes user terminal information;

The original authenticator also sets:

An authentication key sending unit is configured to send the authentication key to the target base station.

The target base station is further configured to:

a ranging request response generating unit, configured to construct a ranging request response and an additional message authentication code; and a ranging request response sending unit, configured to send the ranging request response to the user terminal. The solution of the present invention proposes a consistency check for RNG-REQ and a subsequent management message consistency check scheme. The improved scheme reduces the signaling overhead inside the network, and ensures that the Authenticator that saves the MSS key information effectively and correctly forwards the key application message to the target BS, and finally obtains the AK to analyze the content of the RNG-REQ and Processing, while constructing a response RNG-RSP and an attached HMAC/CMAC. After that, the AK can be used to check the received management message of the MSS containing the HMAC/CMAC, and the HMAC/CMAC can be added to the management message that needs to be sent to the MSS for consistency check by the peer, and can also be performed by the AK. The confidentiality is generated for the encryption key on the data path to ensure that the session service is transmitted over the air interface. DRAWINGS

1 is a schematic diagram of a security network architecture system of a radio access network in the prior art; 2 is a schematic diagram of a verification process when a target BS carries a message authentication code (MAC) for a ranging request in the case of an Authenticator in the prior art;

3 is a schematic diagram of a verification process when a MAC address is carried in a ranging request in the case of an Authenticator according to Embodiment 1 of the present invention;

4 is a schematic flowchart of a first scheme for generating an authentication key according to the present invention;

FIG. 5 is a schematic flowchart of a second scheme for generating an authentication key according to the present invention;

6 is a schematic flowchart of Embodiment 2 of the present invention;

Figure 7 is a schematic flow chart of the solution 3 of the present invention;

8 is a schematic structural diagram of a radio access network according to the present invention;

9 is a structural diagram of a system when a radio access network acquires an authentication key from a service Authenticator according to the present invention;

FIG. 10 is a system structural diagram of a wireless access network according to the present invention when acquiring an authentication key to an original Authenticator. detailed description

Specific embodiments of the present invention are described below in conjunction with the drawings.

In the solution of the present invention, the user terminal may be a mobile subscriber station (MSS) or a mobile station (MS). In the following content of the present invention, the MSS is taken as an example for description.

In the process of changing the access point from the original target BS to the target BS when the MSS moves into the coverage of the target BS, the target BS receives the ranging request (RNG-REQ) with the HMAC/CMAC sent by the MSS. When there is no AK associated with the MSS and the target BS identity, the RNG-REQ cannot be checked for consistency. In this case, the present invention needs to notify the original Authenticator storing the MSS key information to transmit the AK and the corresponding AKID, the life cycle of the AK, and other key information (such as EIK: EAP Integrity Key) to the target BS. The content of the RNG-REQ is analyzed and processed, while the response (RNG-RSP) and the additional HMAC/CMAC are constructed. Thereafter, the AK can be used to check the received management message of the MSS containing the HMAC/CMAC, and can also attach the management message to be sent to the MSS. The HMAC/CMAC performs a consistency check on the peer (MSS), and the AK can also generate an encryption key for use on the data path to ensure the confidentiality of the session service over the air interface.

If the Authenticator to which the target BS belongs stores the key information of the MSS, the Authenticator generates the AK of the MSS and the corresponding AKID, the life cycle of the AK, and other key information (such as EIK) according to the MSS identifier and the target BS identifier. : EAP Integrity Key ), and send them to the target BS. In this case, the message interaction between the service Authenticator and the original Authenticator in the corresponding embodiments 1 and 2 will be omitted. Example 1:

Switching occurs during MSS move and cross Authenticator case for RNGJ EQ band

The consistency check of HMAC and the subsequent consistency check process of management messages are shown in Figure 3:

5301. The MSS sends an RNG-REQ to the target BS, where the RNG-REQ carries a MAC.

After the MSS moves from the serving BS to the target BS and synchronizes with the target BS to receive the air interface resource allocation parameters of the uplink and downlink of the target BS, the MSS sends an RNG-REQ management message to the target BS, and the message is followed by the MAC information. In this embodiment, HMAC is used.

5302. The target BS sends an authentication key request (AK_Request) to the service Authenticator to which it belongs, where the AK_Request includes the MSS and the target BS identification information, and the original Authenticator location information.

The target BS sends an AK_Request to the service Authenticator to which it belongs, which contains

MSS, the identity of the target BS and the direct/indirect location information of the original Authenticator, wherein the identifiers of the MSS and the target BS are for generating an air interface key AK related to the MSS and the target BS, and the direct/indirect location information of the original Authenticator is for serving The Authenticator can address the original Authenticates location information of the original Authenticates, which can be the original Authenticator identification information or the original BS identification information. If the original Authenticator location information is the original BS identity information, the original Authenticator needs to be searched by the Authenticator to which the original BS belongs according to the original BS identity information. 5303. The original Authenticator interacts with the serving Authenticator to identify the MSS and the target BS, and generates an authentication key of the MSS for the target BS.

In this step, the service Authenticator exchanges the MSS and the target BS identification information with the original Authenticator according to the original Authenticator location information in step S2, and generates an authentication key for the target BS.

5304. The target BS processes the RNG-REQ according to the authentication key.

The target BS obtains the authentication key AK, and analyzes and processes the content of the R G-REQ;

5305. The target BS constructs a response RNG-RSP and an additional HMAC therein.

In the foregoing solution, the solution for generating an authentication key may be implemented by the following two solutions: As shown in FIG. 4, the solution 1 includes the following steps:

S401. The service Authenticator sends an AK_Request to the original Authenticator, where the identifier of the MSS and the target BS is included;

S402. The original Authenticator generates an AK and related information for the MSS for the target BS according to the identifiers of the MSS and the target BS and the key information stored by the original Authenticator.

S403. The service Authenticator sends the AK and related information to the target BS.

Scheme 2 is shown in Figure 5 and includes the following steps:

S501. The service Authenticator sends a key application request to the original Authenticator, which includes the identifier of the MSS.

S502: The original Authenticator sends the stored key information of the MSS to the service Authenticator, and the service Authenticator generates the AK and related information for the MSS according to the identifiers of the MSS and the target BS and the key information of the MSS.

S503. The service Authenticator sends the AK and related information to the target BS.

In the above content, the AK related information may include an AKID, an AK life cycle, and other context information.

Thereafter, the AK can be used to check the received management message of the MSS containing the H AC, and the HMAC can be added to the management message that needs to be sent to the MSS for consistency verification by the peer, and can also be used by the AK for Encryption key on the data path to ensure that the session service is connected in the air Confidentiality of transmission on the mouth. Example 2:

The consistency check in the idle state of the MSS mobile process and in the case of the Authenticator for the RNG_REQ with the HMAC and the subsequent management message consistency check procedure are as shown in Fig. 6: In this case, the paging controller ( That is, the original Authenticator is different from the Authenticator to which the target BS belongs, and the key information of the MSS is stored on the paging controller (ie, the original Authenticator).

5601. The MSS sends an RNG-REQ to the target BS, where the RNG-REQ carries an identifier of the MAC and the paging controller (ie, the original Authenticator).

After the MSS moves from the serving BS to the target BS and synchronizes with the target BS to receive the uplink and downlink air interface resource allocation parameters of the target BS, the MSS sends an RNG-REQ management message to the target BS, and the message is followed by the MAC information and The paging controller identifier, in this embodiment, the MAC information uses HMAC.

In this step, the original Authenticator has the function of generating and distributing an authentication key, and is integrated with the paging controller.

5602. The target BS sends an authentication key request (AK_Request) to the service Authenticator to which it belongs, where the AK_Request includes the MSS and the target BS identification information, and the location information of the paging controller (ie, the original Authenticator). ;

The target BS sends an AK_Request to the service Authenticator to which it belongs, including the MSS, the identity of the target BS, and the direct location information of the paging controller (ie, the original Authenticator), wherein the identifiers of the MSS and the target BS are generated to generate the MSS. The air interface key AK associated with the target BS, and the direct location information of the paging controller (ie, the original Authenticator) is intended to serve the Authenticator to the paging controller (ie, the original Authenticator). The location information of the paging controller (ie, the original Authenticator) is the original Authenticator identification information.

S603. The paging controller (ie, the original Authenticator) interacts with the service Authenticator.

The MSS and the target BS identify the information, and generate an authentication key for the MSS for the target BS;

In this step, the service Authenticator is based on the paging controller in step S2 (ie, the original Authenticator) location information, interacting with the paging controller (ie, the original Authenticator) with the MSS and the target BS identity information, and generating an authentication key for the MSS for the target BS.

The scheme for generating the authentication key may adopt the scheme corresponding to FIG. 4 or FIG. 5.

5604. The target BS processes the RNG-REQ according to the authentication key.

The target BS obtains the authentication key AK, analyzes and processes the content of the RNG-REQ, and notifies the paging controller of the location update message of the MSS;

5605. The target BS constructs a response R G-RSP and an additional HMAC therein.

Example 3:

If the target BS is allowed to directly access the original Authenticator application AK and the target BS obtains the network identity of the original authenticator, even in the case of crossing the Authenticator, as shown in FIG. 7, the target BS can obtain the authentication key by the following steps. :

5701. The target BS sends an authentication key request to the original authenticator (Authenticator), where the authentication key request includes MSS information.

5702. The original Authenticator generates an authentication key for the target BS, and sends the authentication key to the target BS.

As shown in FIG. 8, it is a schematic structural diagram of a radio access network according to the present invention. As can be seen from the figure, the radio access network of the present invention mainly includes: an MSS 10, an original BS 20 for MSS access, and key information for storing the MSS. The original Authenticator 30, the target BS 40 after the MSS is moved and the Authenticator 50 connected to the target BS, and the Authentication Server 60;

The invention is provided in the MSS with:

The ranging request sending unit 110 is configured to send a ranging request to the target BS 40.

In the target BS40 settings are:

The authentication key obtaining unit 410 is configured to obtain an authentication key.

The verification unit 420 is configured to verify the ranging request.

a ranging request response generating unit 430, configured to construct a ranging request response and an additional message authentication code therein;

The ranging request response sending unit 440 is configured to send the ranging request response to the MSS 10. The MSS 10 is configured with:

The synchronization unit 120 is configured to synchronize with the target base station.

In the foregoing solution, the specific setting method of the authentication key obtaining unit 410 may be determined according to the obtaining of the authentication key from the service Authenticator 50 or the original Authenticator 30, as follows:

Solution 1: Obtain an authentication key from the service Authenticator50.

As shown in FIG. 9, the authentication key obtaining unit 410 further sets:

The first authentication key request sending unit 411 is configured to send an authentication key request to the service Authenticator 50, where the authentication key request includes location information of the MSS 10 and the original Authenticator 30;

The original Authenticator 30 interacts with the service Authenticator 50 to identify the MSS 10 and the target BS 40, and generates an authentication key for the MSS 10 for the target BS 40.

Under this scheme, the service Authenticator50 settings are:

The authentication key application request sending unit 510 is configured to send an authentication key request request to the original Authenticator 30, where the identifiers of the MSS 10 and the target BS 40 are included;

In the original Authenticator 30 settings are:

The authentication key and related information generating unit 310 is configured to generate an authentication key and related information of the MSS 10 for the target BS 40 according to the identifiers of the MSS 10 and the target BS 40 and the key information stored by the original Authenticator 30;

The authentication key and related information transmitting unit 320 is configured to send the authentication key and related information to the target BS 40. Option 2: Obtain an authentication key from the original Authenticator 30

When the serving BS can directly obtain the authentication key from the original Authenticator 30, as shown in FIG. 10, the authentication key obtaining unit 410 is configured with:

The second authentication key request sending unit 412 is configured to send an authentication key request to the original Authenticator 30, where the authentication key request includes the MSS10 information;

The original Authenticator 30 is configured with: The authentication key sending unit 330 is configured to send the authentication key to the target BS 40.

The solution of the present invention proposes a consistency check for RNG-REQ in the case of Authenticates: and a management message consistency check scheme thereafter. The invention is applicable to both the movement of the MSS during the call and the movement of the MSS in the idle state. In the present invention, the original Authenticator is defined as an Authenticator that stores key information capable of generating the MSS AK, and is not necessarily an Authenticator to which the original BS belongs. The improved process reduces the signaling overhead inside the network, and ensures that the target BS effectively and correctly forwards the key application message to the original Authenticator, so that the target BS finally obtains the AK to analyze and process the content of the RNG-REQ. At the same time, construct a response RNG-RSP and an attached HMAC/CMAC. After that, the AK can be used to check the received management message of the MSS containing the HMAC/CMAC, and the HMAC/CMAC can be added to the management message that needs to be sent to the MSS for consistency check by the peer, and can also be performed by the AK. The confidentiality is generated for the encryption key on the data path to ensure that the session service is transmitted over the air interface.

It is apparent that those skilled in the art can make various modifications and variations to the invention without departing from the spirit and scope of the invention. Thus, it is intended that the present invention cover the modifications and variations of the inventions

Claims

Rights request

A method for verifying a ranging request, comprising the steps of:

The user terminal sends a ranging request to the target base station;

The method according to claim 1, wherein the step of the user terminal transmitting a ranging request to the target base station further includes:

The method according to claim 1, wherein in the step of the user terminal transmitting a ranging request to the target base station, the ranging request carries a message authentication code.

The method according to claim 3, wherein the message authentication code is a hash message authentication code or an encrypted message authentication code.

The method according to claim 1, wherein the step of obtaining, by the target base station, the authentication key comprises:

The method according to claim 5, wherein the original authenticator location information may be original authenticator identification information or original base station identification information.

The method according to claim 6, wherein if the original authenticator location information is original base station identification information, the method further includes searching for the original authentication according to the original base station identification information. By.

The method according to claim 5, wherein the original authenticator interacts with the service authenticator to identify the user terminal and the target base station, and generates a reference for the target terminal for the target terminal. The weight key step further includes:

The original authenticator generates an authentication key and related information of the user terminal for the target base station according to the identifiers of the user terminal and the target base station and the key information stored by the original authenticator;

The method according to claim 5, wherein the original authenticator interacts with the service authenticator to identify the user terminal and the target base station, and generates an authentication key of the user terminal for the target base station. The steps further include:

The method of claim 1, wherein the step of obtaining the authentication key by the target base station and performing the verification step on the ranging request further includes:

The method according to claim 1, wherein the target base station acquires an authentication key, and in the step of verifying the ranging request, if the service authenticator to which the target base station belongs is saved The key information of the user terminal is used by the target base station to directly verify the ranging request by using the authentication key information.

The method according to claim 11, wherein the step of obtaining the authentication key by the target base station and performing the checking step on the ranging request further includes:

The target base station sends an authentication key request to the service authenticator, where the authentication key request is in the package Containing user terminal information;

The service authenticator generates an authentication key and related information of the user terminal for the target base station according to the user terminal identifier and the target base station identifier.

The method of claim 1, wherein the step of acquiring the authentication key by the target base station further includes:

The target base station sends an authentication key request to the original authenticator, where the authentication key request includes user terminal information;

The original authenticator generates an authentication key for the target base station and transmits the authentication key to the target base station.

The method according to claim 8, 9, 11 or 13, wherein the authentication key related information comprises an authentication key identifier, an activation period of the authentication key, and key information.

15. The method of claim 1 further comprising the steps of:

16. The method of claim 1 further comprising the steps of:

17. The method of claim 1 further comprising the steps of:

An encryption key is generated by the authentication key.

18. A radio access network, comprising: a user terminal, an original base station for accessing the user terminal, and an original authenticator storing key information of the user terminal, and the target base station and the connected target base station after the user terminal moves Service authenticator, and authentication server;

The user terminal is configured with:

The target base station is configured with:

a verification unit, configured to verify the ranging request.

19. The wireless access network of claim 18, wherein The user terminal is further configured to:

A synchronization unit, configured to synchronize with the target base station.

20. The wireless access network of claim 18, wherein

The authentication key obtaining unit further sets:

21. The wireless access network of claim 20, wherein

The service authenticator also sets:

An authentication key request request sending unit, configured to send an authentication key request request to the original authenticator, where the identifier of the user terminal and the target base station is included;

The original authenticator also sets:

22. The wireless access network of claim 18, wherein

The target base station is further configured to:

The original authenticator also sets:

23. The wireless access network of claim 18, wherein

The target base station is further configured to:

a ranging request response generating unit, configured to construct a ranging request response and an additional message authentication code; The ranging request response sending unit is configured to send the ranging request response to the user terminal.