WO2009065347A1

WO2009065347A1 - Security communication method, system and apparatus for home base-station

Info

Publication number: WO2009065347A1
Application number: PCT/CN2008/073065
Authority: WO
Inventors: Jing Chen
Original assignee: Huawei Technologies Co., Ltd.
Priority date: 2007-11-16
Filing date: 2008-11-14
Publication date: 2009-05-28
Also published as: CN101437223B; CN101437223A

Abstract

A security communication method for a home base-station is provided. The method includes steps as following: the base-station implements mutual authentication with a security gateway; in order to protect the security communication between the home base-station and the public land mobile network PLMN network, the home base-station establishes a security tunnel to the security gateway. Based on the preferred embodiments of the invention, the home base-station implements mutual authentication with the security gateways of the PLMN network and establishes a security tunnel, thereby a mechanism is provided, which is used for providing security protection for a communication between the base-station and an OAM domain and a Service domain of the PLMN, and the security communication between the base-station and the PLMN network is ensured.

Description

Method, system and device for safe communication of home base station The present application claims to be submitted to the Chinese Patent Office on November 16, 2007, the application number is 200710187239.4, and the invention name is "a method, system and device for accessing a home base station" Priority of Chinese Patent Application, the entire contents of which is incorporated herein by reference. Technical field

The present invention relates to the field of network communication technologies, and in particular, to a method, system and apparatus for secure communication of a home base station. Background technique

In the current mobile communication network, the arrangement of the network nodes is generally planned by the operator in advance, and the network arrangement is completed according to the planned content. In the network, all users in the same location area share the resources of the cell. After the high-speed or high-bandwidth service is accessed, the access of other users may be affected.

With the development of the Internet and the wide application of various wireless services, users have demanded high speed, convenience, and low cost for wireless networks. On the other hand, from the perspective of operators, it is necessary to make full use of the resources of existing networks, expand capacity, reduce costs, and better serve users.

The introduction of HB (Home Base-station, Home Base Station) fully satisfies the above requirements and the development needs of the network. The home base station is a home micro base station, and the mobile user can arrange such a base station in a hotspot coverage area such as a home or an office, and access the mobile communication network through the Internet to obtain a wireless communication service. The introduction of the home base station solves the bottleneck problem of the hollow port resource of the wireless data service, so that the user can enjoy the high-speed, high-bandwidth network service. On the other hand, the home base station accesses through the Internet, which saves the transmission cost of the mobile operator and increases the capacity of the mobile network. Moreover, the home base station is mainly used in hot spots such as home personal use, office space, and blind spot coverage in remote areas, which improves the coverage of the mobile network and optimizes the quality of the network. The home base station needs to communicate with the OAM (Operation Administration Maintenance) domain and the Service (Service) domain of the PLMN (Public Land Mobile Network) network. The home base station communicates with the two domains through an untrusted network such as the Internet, and cannot secure communication between the home base station and the PLMN network. Therefore, a mechanism is needed to provide security for communication between the two domains of the home base station and the PLMN. .

In the process of implementing the present invention, the inventors have found that the prior art has at least the following problems: no mechanism for providing security protection for communication between the home base station and the OMN domain and the service domain of the PLMN, and the communication between the home base station and the PLMN network cannot be guaranteed. Safety. Summary of the invention

Embodiments of the present invention provide a method, system, and apparatus for secure communication of a home base station, so as to secure communication between a home base station and a PLMN network.

To achieve the above objective, an embodiment of the present invention provides a method for secure communication of a home base station, including the following steps:: a home base station and a security gateway perform mutual authentication; and the home base station establishes a security tunnel with the security gateway to protect the The communication security between the home base station and the public land mobile network PLMN is described.

In another aspect, the embodiment of the present invention further provides a home base station, including: an authentication module, configured to perform mutual authentication with a security gateway; and an establishing module, connected to the authentication module, configured to establish after the authentication module is authenticated A secure tunnel to protect the communication between the home base station and the PLMN.

In another aspect, an embodiment of the present invention further provides a communication system, including: a security gateway and the foregoing home base station.

Compared with the prior art, the embodiment of the present invention has the following advantages: By establishing a secure tunnel between the home base station and the security gateway of the PLMN, security protection is provided for communication between the home base station and the PLMN network. DRAWINGS 1 is a flowchart of a method for secure communication of a home base station according to an embodiment of the present invention; FIG. 2 is a flowchart of Embodiment 1 of a method for secure communication of a home base station according to the present invention; FIG. 4 is a flowchart of Embodiment 4 of a method for secure communication of a home base station according to the present invention; FIG. 5 is a structural diagram of a system for secure communication of a home base station according to an embodiment of the present invention. detailed description

Embodiments of the present invention provide a method for secure communication of a home base station, which secures communication between a home base station and a PLMN network by using a secure tunnel established between the home base station and the PLMN network. The secure tunnel established between the home base station and the PLMN may be one or more. These secure tunnels may be established on one security gateway or on multiple security gateways. These secure tunnels can be the same type of secure tunnel or different types of secure tunnels.

As shown in FIG. 1 , it is a flowchart of a method for secure communication of a home base station according to an embodiment of the present invention, which specifically includes the following steps:

Step S101: The home base station performs mutual authentication with the security gateway. The mutual authentication between the home base station and the security gateway can be completed between the home base station and the security gateway by using an EAP (Extensible Authentication Protocol)-based method, a pre-shared key-based manner, or a certificate-based manner.

Step S102: The home base station establishes a secure tunnel with the security gateway to protect communication security between the home base station and the public land mobile network PLMN. One or more secure tunnels can be established between the home base station and the PLMN. The secure tunnel may be an IPsec (Internet Protocol security) security tunnel or a TLS (Transport Layer Security) secure tunnel. When the security gateway of the OAM domain of the PLMN network and the security gateway of the Service domain are different security gateways, the home base station can establish a security tunnel with the security gateway of the OAM domain and the security gateway of the service domain respectively to protect the home base station and The communication between the OAM domain and the Service domain is secure. When the security gateway of the OAM domain of the PLMN network and the security gateway of the Service domain are the same In the case of the security gateway, the home base station can establish a secure tunnel with the security gateway to simultaneously protect the communication security between the home base station and the OAM domain and the service domain. Alternatively, the home base station and the security gateway establish two secure tunnels respectively to protect the home. Communication security between the base station and the OAM domain and communication between the home base station and the Service domain.

After the home base station establishes a secure tunnel with the security gateway, the home base station performs mutual authentication again with the PLMN network on the established security tunnel.

In the method for secure communication of the home base station, the home base station performs mutual authentication with the security gateway of the PLMN network, and establishes a security tunnel, thereby providing a security protection for communication between the OAM domain and the Service domain of the home base station and the PLMN. The mechanism ensures the communication security of the home base station and the PLMN network.

As shown in FIG. 2, it is a flowchart of Embodiment 1 of a method for secure communication of a home base station according to the present invention. The scenario described in Embodiment 1 of the method for secure communication of a home base station of the present invention is: a security gateway SGo of an OAM domain of a home base station and a PLMN network. A security tunnel is established between the security gateway (Security Gateway) and the security gateway SGs of the Service domain of the PLMN network, and these secure tunnels are used to protect communication between the home base station and the PLMN network. In this embodiment, an IPsec tunnel is used as an example. However, an IPsec tunnel must be established between the home base station and the SGo/SGs. The tunnel between the home base station and the SGo may be different from the tunnel between the home base station and the SGs. For example, a TLS tunnel is established between the home base station and the SGo, and an IPsec tunnel is established between the home base station and the SGs. This embodiment specifically includes the following steps:

Step S201: The HB obtains the IP address of the security gateway SGo of the OAM domain. Step S202: The security gateway of the HB and OAM domain performs IKE-SA-INIT exchange. HB sends its supported security association information (Sail), DH exchange value (KEi), and nonce (random number) (Ni) to SGo.

Step S203: SGo selects a security association of an IKE (Internet Key Exchange) SA (Security Association), and sends the selection result to the HB. The DH exchange value (KEr) and nonce (Nr ) are also sent to HB together. After this step is over, SGo and HB negotiate to complete the IKE SA.

In step S204, HB and SGo start negotiation of IPsec security association. In safety In the process of association negotiation, HB and SGo use EAP (Extensible Authentication Protocol) AKA (Authentication and Key Agreement) / SIM (Subscriber Identity Modular) to perform mutual authentication. HB sends the identity of the HB, which is the ID (Identifier) of HB. The identity of the HB is based on the IMSI (International Mobile Subscriber Identification) in the USIM (Universal Mobile Telecommunications System Subscriber Identification Module) inserted in the HB. Number, International Mobile Subscriber Identity) derived NAI (Network Access Identifier) format identity, certificate request (request for SG certificate), intranet IP address request CP (Configuration Payload, configuration load), HB-supported security association information (SAi2) and policy selectors (TSi, TSr). The internal network IP address of the OAM domain that the CP uses to request the SG to allocate to the HB is an optional parameter. This message does not carry the AUTH (Authentication) field to indicate that SGo needs to perform EAP authentication.

Step S205, SGo sends the identity of HB to AAA (Authentication)

Authorization Accounting, authentication, 4 authorized, billing).

Step S206, the AAA server interacts with the storage server storing the HB related information to obtain the authentication vector of the HB. The HB profile (contract information) may also be sent to the AAA server.

Step S207, the AAA server sends the EAPAKA/SIM Challenge to the SGo. Step S208, SGo sends the EAP AKA/SIM Challenge to the HB. The identity ID of the SGo, the certificate of the SG, and the AUTH payload calculated by the SG using the certificate are also sent to the mess.

Step S209, the HB generates a corresponding EAP response message and sends it to the SGo.

Step S210, the SGo forwards the EAP response message to the AAA server.

Step S211: The AAA server verifies the EAP response message. After the verification is successful, an EHB success message is sent. And send the corresponding key material to SGo.

Step S212: The SGo sends information such as the identity of the HB to the AAA server, and the AAA server performs an authorization check according to the profile of the HB. Step S213, the SGo forwards the EAP success message to the HB. After this step is over, SGo and HB share the key material key material, completing the interactive authentication between SG and HB.

Step S214, the HB sends an IKE message, where the AUTH payload is carried. The AUTH payload is calculated using a shared key.

Step S215: The SGo sends an IKE message carrying the AUTH payload (calculated using the shared key), the selected IPsec SA (Sar2), and the selected policy selectors (TSi and TSr). If the HB requests the intranet IP address, the SG responds to the CP payload, where the CP payload carries the intranet IP address of the HB.

Step S216: SGo interacts with the HB to delete the old IKE SA shared between the SGo and the HB. Subsequently, if more secure tunnels need to be established between HB and SGo, the CREATE CHILD SA exchange between HB and SGo is used to establish more IPsec security tunnels to protect information with different security requirements.

Step S217, the security mechanism of the application layer may be performed between the devices of the HB and OAM domains.

Step S218: The HB communicates with the EMS (Element Management System) to obtain configuration data and other information from the EMS. HB obtains its IP address in the Service domain and the address of the security gateway of the Service domain.

Step S219, the HB and the security gateway SGs of the service domain perform IKE exchange. HB sends its supported security association information (SAil), DH exchange value (KEi) and nonce (Ni) to the SGs.

Step S220: The SGs selects the security association of the IKE SA, and sends the selection result to the HB. The DH exchange value (KEr) and nonce (Nr) are also sent to the HB together. After this step is completed, the SGs and the HB negotiate to complete the IKE SA.

In step S221, HB starts the negotiation of the second phase of IKE. HB sends its identity to the SGs. This identity has a special identity format. SGs can address the AAA server located in the OAM domain according to the special format of this identity, and can obtain the same key as HB according to this special identity. This identity format can be RAND@HBServiceDomainAUTH.operator.com. HB use in the OAM domain The CK (Cryptographic Key) / IK (Integrality Key) generated by the certificate calculates the key K = ( CK||IK, IP of SGs, ... ), and then uses the secret Key K calculates AUTH.

Step S222, the SGs address the corresponding AAA server according to the special format of the ID, and request the key K from the AAA server. The AAA server uses the same method as ΗΒ to calculate the key K = ( CK | | IK, IP of SGs, ... ) „ and sends the key K to the SGs. Among them, the SGs may need to calculate the SGs when the K is calculated. The IP address tells AAA.

Step S223: The SGs use the key K to verify the correctness of the AUTH and complete the negotiation of the IPsec SA. The AUTH in the reply message is also calculated using the key K. If more secure tunnels are needed to protect different information, such as different security protection for signaling and data, then SGs can exchange CREATE CHILD SA with HB to establish more IPsec secure tunnels.

In this embodiment, the security association between the home base station and the SGo is established by using the EAP-AKA method for authentication, but the establishment of the security association between the home base station and the SGo can also be established in other manners, such as EAP. - SIM mode, pre-shared key based approach, certificate based approach, etc.

The scenario described in the second embodiment of the method for secure communication of the home base station of the present invention is as follows: a secure tunnel is established between the home base station and the security gateway SGo of the OAM domain of the PLMN network and the security gateway SGs of the service domain of the PLMN network, and the secure tunnel is utilized. To protect communication between the home base station and the PLMN network. The following takes the example of establishing an IPsec tunnel as an example to introduce the second embodiment of the present invention.

Steps 1 to 17 of the second embodiment are the same as steps S201 to S217 of the first embodiment. Step S218, the home base station and the security gateway SGs of the service domain re-execute the steps described in steps S201 to S216 to establish a home base station and an SGs. Inter-IPsec tunnel. If more secure tunnels are needed between the home base station and the security gateway of the Service domain to protect different information, such as different security protection for signaling and data, the SGs can exchange CREATE CHILD SA with the AP to establish more More IPsec secure tunnels.

In the embodiment of the present invention, the security association between the home base station and the SGo/SGs is established. EAP-AKA is used for authentication, but the establishment of security association between the home base station and the SGo/SGs can also be established in other ways, such as EAP-SIM, pre-shared key based, based on The way the certificate is etc. The manner of establishing a security association between the home base station and the SGo may be different from the manner in which the home base station and the SGs establish a security association.

As shown in FIG. 3, which is a flowchart of Embodiment 3 of a method for secure communication of a home base station according to the present invention, a scenario described in Embodiment 3 of the method for secure communication of a home base station of the present invention is: a security gateway of an OAM domain of a PLMN network and a PLMN network. The security gateway of the service domain is the same security gateway SG. The home base station and the security gateway establish a secure tunnel and use these secure tunnels to secure communication between the home base station and the PLMN network. Specifically, it includes the following steps:

Step S301: The HB acquires an IP address of the SG.

Step S302, HB and SG perform IKE-SA-INIT exchange. HB sends its supported security association information (SAil), DH exchange value (KEi), and nonce (Ni) to the SG.

Step S303: The SG selects a security association of the IKE SA, and sends the selection result to the HB. The DH exchange value (KEr) and nonce (Nr ) are also sent to HB together. After this step is completed, the SG and the HB negotiate to complete the IKE SA.

Step S304, the HB and the SG start the negotiation of the IPsec security association. In the negotiation process of security association, HB and SG use EAP AKA/SIM for mutual authentication. HB sends the identity of the HB, ie ID of HB, derived from the IMSI inserted in the USIM card in the HB, the identity of the NAI format, the certificate request (CERT REQUEST, the certificate used to request the SG), the intranet IP address request (CP, The intranet IP address for requesting the SG to allocate the OAM domain to the HB, optionally), the security association information (SAi2) supported by the HB, and the policy selector (TSi, TSr). This message does not carry the AUTH field to indicate that the SG needs to perform EAP authentication.

Step S305, the SG sends the identity of the HB to the AAA server.

Step S306, the AAA server interacts with the storage server storing the HB related information to obtain the authentication vector of the HB. The profile of the HB may also be sent to the AAA server.

Step S307, the AAA server sends an EAP AKA/SIM Challenge to the SG. Step S308, the SG sends the EAP AKA/SIM Challenge to the HB. The identity ID of the SG, the certificate of the SG, and the AUTH payload calculated by the SG using the certificate are also sent to the HB together.

Step S309, the HB generates a corresponding EAP response message and sends the message to the SG.

Step S310, the SG forwards the EAP response message to the AAA server.

Step S311: The AAA server verifies the EAP response message. After the verification is successful, an EAP success message is sent. And send the corresponding key material to the SG.

Step S312, the SG sends information such as the identity of the HB to the AAA server, and the AAA server performs an authorization check according to the profile of the HB.

Step S313, the SG forwards the EAP success message to the HB. After this step, SG and HB share the key material key material and complete the interaction authentication between SG and HB.

Step S314, the HB sends an IKE message, where the AUTH payload is carried. The AUTH payload is calculated using a shared key.

Step S315, the SG sends an IKE message, where the AUTH payload (calculated using the shared key), the selected IPsec SA (Sar2), and the selected policy selectors (TSi and TSr) are carried. If the HB requests the intranet IP address, the SG responds to the CP payload, where the CP payload carries the intranet IP address of the HB.

Step S316, the SG and the HB interact to delete the old IKE SA shared between the SG and the HB. Subsequently, if HB and SG need more security associations to protect different types of communication between HB and OAM, HB and SG can establish multiple IPsec secure tunnels through CREATE CHILD SA exchange.

Step S317, the HB communicates with the EMS, and obtains configuration data and the like from the EMS. The HB obtains the IP address of the HB in the service domain. If the IP address of the HB in the service domain and the OAM domain is the same, the HB does not need to obtain the IP address again.

Step S318, the HB communicates with the Service domain. At this time, HB may need to establish a new IPsec security association for the Service domain. The CREATE CHILD SA exchange is performed between the HB and the SG, and the HB sends an IKE message requesting to generate an IPsec SA. The HB can also carry the CP payload request in this message to obtain the IP address of the HB in the Service domain. If the IP address of the HB in the Service domain and the OAM domain is the same, the HB does not need to obtain the IP address again.

Step S319, the SG completes the negotiation of the IPsec SA, and sends a corresponding IKE message to notify the IPsec SA selected by the SG. HB may need to establish multiple IPsec associations between security gateways to protect different types of communication. In this case, multiple IPsec associations can be established between HB and SG through CREATE CHILD SA exchange.

In this embodiment, the security association between the home base station and the SG is established by using the EAP-AKA method for authentication, but the establishment of the security association between the home base station and the SGo can also be established in other manners, such as EAP. - SIM mode, pre-shared key based approach, certificate based approach, etc.

As shown in FIG. 4, it is a flowchart of Embodiment 4 of a method for secure communication of a home base station according to the present invention. The scenario described in Embodiment 4 of the method for secure communication of a home base station of the present invention is: a security gateway of an OAM domain of a PLMN network and a PLMN network. The security gateway of the service domain is the same security gateway SG. The home base station and the security gateway establish a secure tunnel and use these secure tunnels to secure communication between the home base station and the PLMN network. Specifically, it includes the following steps:

Step S401, the HB and the security gateway establish a secure tunnel. Between the HB and the security gateway, the IKEv2 carries the EAP to perform mutual authentication. After the mutual authentication, an IPsec tunnel is established between the HB and the security gateway.

Step S402: Bind the established IPsec secure tunnel to the IP address of the HB. When negotiating a security association, HB requests two IP addresses using the CP payload in the IKEv2 protocol: the IP address of the HB in the OAM domain and the IP address of the HB in the Service domain. The IPsec secure tunnel established between the HB and the security gateway is bound to the two IP addresses; or,

When negotiating a security association, HB uses the CP payload in the IKEv2 protocol to request the IP address of the HB in the OAM domain. The IPsec secure tunnel established between the HB and the security gateway is bound to the IP address of the HB in the OAM domain. Then HB requests the IP address of the HB in the service domain, and binds the IPsec secure tunnel established between the HB and the security gateway to the IP address of the HB in the service domain; or

HB uses the same IP address in the OAM domain and the Service domain, so that HB only needs To use the CP payload in IKEv2 to request the same IP address, and bind the IPsec secure tunnel established between the HB and the security gateway to the IP address. The above is the process of performing security association negotiation between the HB and the security gateway, that is, during the establishment of the IPsec security tunnel, the HB obtains the IP address of the HB in the OAM domain and the service domain, and may also be after the IPsec security tunnel is established. Obtain the IP address of the HB in the OAM domain and the service domain, and then bind the IP address to the established IPsec secure tunnel.

Step S403, the communication between the HB and the OAM domain and the communication between the HB and the Service domain are protected by the established IPsec secure tunnel.

Most of the solutions described in the first embodiment to the fourth embodiment use the EAP-AKA method as the method for mutual authentication of the HB and the security gateway when establishing a secure tunnel. In this case, the HB and PLMN networks complete the mutual authentication of the HB and PLMN networks in the process of establishing a secure tunnel. However, in some cases, the HB and PLMN networks may need to be further authenticated, that is, HB first authenticates with the PLMN network, establishes a security tunnel, and then the HB and PLMN networks perform mutual authentication again. In this scenario, the method between Embodiment 1 and Embodiment 4 can be used between the AP and the security gateway to complete the between the HB and the security gateway based on the EAP-based manner, the pre-shared key-based manner, and the certificate-based manner. Interactive authentication and complete the establishment of a secure tunnel. The HB then performs interactive authentication with the PLMN network on the established secure tunnel.

As shown in FIG. 5, a structural diagram of a system for secure communication of a home base station according to an embodiment of the present invention includes a security gateway 1, and further includes: a home base station 2, configured to perform mutual authentication with the security gateway 1, and establish a security tunnel to protect the home. The communication between the base station 2 and the PLMN is secure.

The home base station 2 includes: an authentication module 21, configured to perform mutual authentication with the security gateway 1;

The establishing module 22 is connected to the authentication module 21, and is configured to establish a secure tunnel after the authentication module 21 is authenticated to protect the communication security between the home base station 2 and the PLMN.

The establishing module 22 includes: an OAM domain establishing submodule 221, configured to establish a security tunnel by using a security association negotiation with the security gateway of the OAM domain to protect the communication security between the home base station 2 and the OAM domain.

The establishing module 22 further includes: a service domain establishing submodule 222, configured to be in the OAM After the domain establishment sub-module 221 establishes a security tunnel with the security gateway of the OAM domain, the security information shared by the security gateway of the service domain is established according to the secret information shared by the security gateway of the home base station 2 and the OAM domain; or, the security gateway of the service domain is secure. Association negotiation establishes a security tunnel to protect the communication security between the home base station 2 and the service domain.

The home base station 2 further includes: an IP address obtaining module 23, connected to the establishing module 22, configured to acquire one of the OAM domain and the IP address of the service domain of the home base station 2 after the establishing module 22 establishes an IPsec secure tunnel. Two kinds;

The binding module 24 is connected to the IP address obtaining module 23, and is configured to bind the IPsec secure tunnel to the IP address obtained by the IP address obtaining module 23 to protect the communication security between the home base station and the OAM domain and the service domain.

The binding module 24 binds the IPsec secure tunnel to the IP address obtained by the IP address obtaining module 23, and specifically: the IP address of the home base station 2 and the service domain acquired by the IPsec secure tunnel and the IP address obtaining module 23 in the OAM domain and the service domain. The IPsec secure tunnel is bound to the IP address of the OAM domain of the home base station 2 acquired by the IP address obtaining module 23, and the home base station 2 acquired by the IPsec secure tunnel and the IP address obtaining module 23 is in the service domain. The IP address is bound.

The establishing module 22 further includes: a tunneling new sub-module 223, configured to: after the binding module 24 binds the IPsec secure tunnel to the IP address of the OAM domain of the home base station 2, according to the home base station acquired by the IP address obtaining module 23 2 The security association between the IP address of the service domain and the security gateway 1 establishes another IPsec tunnel to protect the communication security between the home base station 2 and the service domain.

In the system for secure communication of the home base station, the home base station 2 performs mutual authentication with the security gateway 1 of the PLMN network, and establishes a secure tunnel, thereby providing a security for communication between the OAM domain and the Service domain of the home base station 2 and the PLMN. The protection mechanism ensures the communication security of the home base station 2 and the PLMN network.

Through the description of the above embodiments, those skilled in the art can clearly understand all or part of the steps of the method embodiments of the present invention, which may be implemented by hardware or by means of software plus a necessary general hardware platform. Based on such understanding, the technical solution of the present invention can be embodied in the form of a software product, and the software product can be saved. Stored in a non-volatile storage medium (which may be a CD-ROM, a USB flash drive, a mobile hard disk, etc.), including a number of instructions for causing a computer device (which may be a personal computer, a server, a network device, etc.) to execute the present The methods described in the various embodiments are invented.

In conclusion, the above description is only a preferred embodiment of the present invention and is not intended to limit the scope of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and scope of the present invention are intended to be included within the scope of the present invention.

Claims

Rights request

A method for secure communication of a home base station, comprising: performing mutual authentication between a home base station and a security gateway;

The home base station establishes a secure tunnel with the security gateway to protect communication security between the home base station and the public land mobile network PLMN network.

2. The method for secure communication of a home base station according to claim 1, wherein the security gateway comprises: a security gateway running an OAM domain,

The establishing a security tunnel between the home base station and the security gateway includes: the home base station and the security gateway of the OAM domain perform security association negotiation to establish a security tunnel.

The method for secure communication of the home base station according to claim 2, wherein after the home base station performs security association negotiation with the security gateway of the OAM domain to establish a security tunnel, the method further includes: the home base station and the The OAM domain shared key.

The method for secure communication of a home base station according to claim 3, wherein the security gateway further comprises: a security gateway of the service domain,

The establishing a secure tunnel between the home base station and the security gateway further includes: the home base station and the security gateway of the service domain establish a secure tunnel according to the shared key.

The method for secure communication of the home base station according to claim 4, wherein before the home base station and the security gateway of the service domain establish a security tunnel according to the shared key, the method further includes:

The home base station transmits the identifier of the shared key to a security gateway of the service domain.

The method for secure communication of a home base station according to claim 1, wherein the security gateway comprises: a security gateway of a service domain,

The establishing a secure tunnel between the home base station and the security gateway includes: the home base station and the security gateway of the service domain perform security association negotiation to establish a secure tunnel.

The method for secure communication of a home base station according to any one of claims 1 to 6, wherein the secure tunnel is: an Internet Protocol Secure IPsec Tunnel or a Secure Transport Layer TLS Tunnel.

The method for secure communication of a home base station according to claim 1, wherein when the secure tunnel is an IPsec secure tunnel,

The method further includes:

The home base station acquires an IP address of the home base station in the OAM domain and the service domain; the home base station and the security gateway bind the IPsec secure tunnel to an IP address of the OAM domain and the service domain.

The method further includes:

The home base station acquires an IP address of the home base station in an OAM domain; the home base station and the security gateway bind the IPsec secure tunnel to an IP address of the OAM domain.

The method for secure communication of the home base station according to claim 9, wherein after the home base station and the security gateway bind the IPsec secure tunnel to the IP address of the OAM domain, the method further includes:

Obtaining, by the home base station, an IP address of the home base station in a service domain;

The home base station and the security gateway bind the IPsec secure tunnel to an IP address of the service domain.

The method for secure communication of the home base station according to claim 10, wherein after the home base station acquires the IP address of the home base station in the service domain, the method further includes: the home base station and the security gateway according to The IP address of the service domain performs security association negotiation to establish another IPsec tunnel.

If the IP address of the home base station is the same as the IP address of the OAM domain, the home base station and the security gateway establish another IPsec tunnel according to the security association negotiation of the IP address of the OAM domain.

13. The method of secure communication of a home base station according to claim 1, wherein: After the home base station establishes a security tunnel with the security gateway, the method further includes: the home base station performing mutual authentication with the PLMN network on the secure tunnel.

14. A home base station, comprising:

An authentication module, configured to perform mutual authentication with the security gateway;

The establishing module is connected to the authentication module, and is configured to establish a security tunnel after the authentication module is authenticated to protect communication between the home base station and the PLMN.

The home base station according to claim 14, wherein the establishing module comprises: an OAM domain establishing submodule, configured to establish a security tunnel by performing security association negotiation with the security gateway of the OAM domain.

The home base station according to claim 15, wherein the establishing module further comprises: a service domain establishing submodule, configured to: after the OAM domain establishing submodule establishes a security tunnel with the security gateway of the OAM domain, And establishing a security tunnel with the security gateway of the service domain according to the secret information shared by the home base station and the security gateway of the OAM domain; or establishing a security tunnel by performing security association negotiation with the security gateway of the service domain.

The home base station according to claim 14, further comprising:

An IP address obtaining module, configured to connect to the establishing module, to obtain one of an IP address of the OAM domain and the service domain of the home base station after the establishing module establishes an IPsec secure tunnel or after establishing an IPsec secure tunnel Two kinds;

The binding module is connected to the IP address obtaining module, and is configured to bind the IPsec secure tunnel to an IP address obtained by the IP address obtaining module.

The home base station according to claim 17, wherein, when the binding module binds the IPsec secure tunnel to an IP address obtained by the IP address obtaining module, the binding module is specifically configured to: :

Binding the IPsec secure tunnel to the IP address of the OAM domain and the service domain of the home base station obtained by the IP address obtaining module; or

Binding the IPsec secure tunnel with the IP address of the home base station acquired by the IP address obtaining module in the OAM domain, and then the IPsec secure tunnel and the home base station acquired by the IP address obtaining module are The IP address of the service domain is bound.

The home base station according to claim 18, wherein the establishing module further comprises: a tunnel new sub-module, configured to: in the binding module, the IPsec secure tunnel and the home base station in an OAM domain After the IP address is bound, another IPsec tunnel is established by performing security association negotiation with the security gateway by the IP address of the home base station obtained by the IP address obtaining module.

20. A communication system, comprising:

A security gateway and a home base station according to any one of claims 14 to 19.