CN100442923C - A Periodic Update Method for Transmitting Encryption Key Pair - Google Patents
A Periodic Update Method for Transmitting Encryption Key Pair Download PDFInfo
- Publication number
- CN100442923C CN100442923C CNB2005100816260A CN200510081626A CN100442923C CN 100442923 C CN100442923 C CN 100442923C CN B2005100816260 A CNB2005100816260 A CN B2005100816260A CN 200510081626 A CN200510081626 A CN 200510081626A CN 100442923 C CN100442923 C CN 100442923C
- Authority
- CN
- China
- Prior art keywords
- tek
- time
- key
- life cycle
- update
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Expired - Fee Related
Links
Images
Landscapes
- Mobile Radio Communication Systems (AREA)
Abstract
本发明涉及移动通信技术,特别涉及一种用于空口加密的传输加密密钥对的周期性更新方法,以解决现有技术中更新传输加密密钥时成功率低、浪费空口资源的问题。一种传输加密密钥对的周期性更新方法,每一个TEK的生命周期为两个更新周期,BS在每一个更新周期结束时生成一个新的TEK,用以补充其中生命周期结束的TEK,并在每次收到MS/SS在TEK Grace Time内发送的密钥请求消息时,将当前两个TEK通过密钥请求响应消息发送给MS/SS;所述TEK Grace Time的起始时间设定在先生成的TEK生命周期结束前两个空口时延之内。
The invention relates to mobile communication technology, in particular to a method for periodically updating a transmission encryption key pair used for air interface encryption, so as to solve the problems of low success rate and waste of air interface resources in the prior art when updating transmission encryption keys. A periodic update method for transmitting encryption key pairs. The life cycle of each TEK is two update cycles. The BS generates a new TEK at the end of each update cycle to supplement the TEK whose life cycle is over, and When receiving the key request message sent by the MS/SS within the TEK Grace Time each time, the current two TEKs are sent to the MS/SS through the key request response message; the starting time of the TEK Grace Time is set at Within two air interface delays before the life cycle of the generated TEK ends.
Description
技术领域 technical field
本发明涉及移动通信技术,特别涉及一种用于空口加密的传输加密密钥对的周期性更新方法。The invention relates to mobile communication technology, in particular to a method for periodically updating a transmission encryption key pair used for air interface encryption.
背景技术 Background technique
在通信系统中,安全性一直是评价一个通信系统优劣的重要指标。随着密码学和密码分析学的发展,为通信系统的安全提供了更多可用的先进技术,同时也对系统的安全提出了更多的挑战。特别是在无线移动通信系统中,由于无线移动通信系统的开放和移动性,攻击者可以很容易的在空口对用户的通信进行监听,因此需要对空口数据进行加密和认证。而且在移动过程中,对密钥的分发和管理也提出了更多的限制和要求,使安全性问题显得尤为重要。In communication systems, security has always been an important indicator to evaluate the quality of a communication system. With the development of cryptography and cryptanalysis, more available advanced technologies have been provided for the security of communication systems, and more challenges have been posed to the security of the system. Especially in the wireless mobile communication system, due to the openness and mobility of the wireless mobile communication system, an attacker can easily monitor the user's communication on the air interface, so the air interface data needs to be encrypted and authenticated. Moreover, in the process of moving, more restrictions and requirements are put forward on the distribution and management of keys, which makes the security issue particularly important.
802.16d/e系列协议定义了无线宽带固定和移动接入空口部分的标准,为了保证空口数据的安全,协议定义了一个安全子层(Privacy Sublayer),用于实现对用户的认证、密钥分发管理、以及后续数据的加密和认证。认证过程中,BS(Base Station,基站)和MS/SS(Mobile Station,移动台)(以下简称MS)之间通过PKM(Privacy Key Management,安全密钥管理)协议产生、分发并管理密钥,认证的结果就是在MS和BS之间拥有了一个用于派生其它密钥资源的基本密钥AK。通信双方根据一个安全的算法从AK中派生出KEK(KeyEncryption Key,密钥加密密钥)。AK或KEK都不直接用于数据加密,用于数据加密的密钥TEK Traffic Encryption Key,传输加密密钥)由BS随机产生,并使用KEK加密后分发给MS。为了进一步增强安全性,AK和TEK被设定在一定的生命周期内有效。在AK的生命周期终止前的一个保护时间里,MS必须完成和BS之间的重认证(Re-authentication)以产生新的AK;在TEK生命周期终止前的一个保护时间里,MS必须通过消息交互向BS请求新的TEK。此外,在802.16e中,当MS漫游到一个新的目标BS时,还要进行网络重入(network re-entry)过程,根据相应的安全策略,通过重认证或后端网络(Backhaul)获得密钥资源。The 802.16d/e series protocol defines the standard of wireless broadband fixed and mobile access air interface. In order to ensure the security of air interface data, the protocol defines a security sublayer (Privacy Sublayer) for user authentication and key distribution. management, and encryption and authentication of subsequent data. During the authentication process, BS (Base Station, base station) and MS/SS (Mobile Station, mobile station) (hereinafter referred to as MS) generate, distribute and manage keys through the PKM (Privacy Key Management, security key management) protocol, As a result of the authentication, there is a basic key AK used to derive other key resources between MS and BS. Both parties in communication derive KEK (KeyEncryption Key, key encryption key) from AK according to a secure algorithm. Neither AK nor KEK is directly used for data encryption. The key used for data encryption (TEK Traffic Encryption Key, transmission encryption key) is randomly generated by BS and distributed to MS after being encrypted with KEK. In order to further enhance security, AK and TEK are set to be valid within a certain life cycle. During a protection time before the life cycle of AK expires, MS must complete the re-authentication (Re-authentication) with BS to generate a new AK; within a protection time before the life cycle of TEK ends, MS must pass the message Interactively request a new TEK from the BS. In addition, in 802.16e, when the MS roams to a new target BS, the network re-entry (network re-entry) process must be carried out. key resource.
如图1所示,为了在TEK更新过程中保证业务传输的连续性,MS和BS同步地维护着多个SA(Security Association,安全连接)信息,安全连接信息中包含了SAID(用于标识一个安全连接)、对应的加密算法参数及TEK密钥信息等。在BS侧为每个SA定期产生新的TEK,以保证在每个时刻为一个SA都维护着两个可用的TEK,每一个TEK的实际使用时间如图1中阴影线段所示,每个TEK的生命周期长度相同,但都存在着半个生命周期的重叠,例如图1中的TEK0和TEK1之间的重叠、TEK1和TEK2之间的重叠、TEK2TEK3之间的重叠等。MS在接入完成并通过认证后,需要向BS请求对其授权的安全连接信息。这个过程可能是在认证的消息交互过程中完成,如802.16d中的RSA认证方式中BS通过认证响应消息Auth Reply向MS发送SA信息;也可能是在认证完成后,通过一个特定的消息交互过程完成,如在802.16e/D8的PKMV2中,通过一个SA-TEK三次握手消息交互过程完成SA信息的分发。此外,BS还可能通过主动发送消息的方式向MS发送SA信息,如SAAdd消息。MS在获得BS授权的SA信息后,MS或BS在建立业务连接时根据需要为连接指定与一个SA的映射关系,连接建立成功后,所有在该连接上传输的数据都将使用对应的SA中指定的加密算法和密钥进行加密。为了进一步增强安全性,MS必须在适当的时刻为当前维护的SA开始请求新的密钥资源。当前802.16d/e协议在MS上为每个SA定义了一个TEK状态机,在该状态机中定义了一个TEK Grace Time,它表示在TEK生命周期结束前的一个时间间隔域,在这个时间域的开始点如图1所示的x,y上,MS必须开始发起Key Request以请求新的密钥资源,BS收到请求消息后用Key Reply消息进行响应,该消息中包含了使用KEK加密的当前时刻两个可用的TEK,以及各自的密钥序列号和剩余生命周期长度。MS收到Key Reply后,根据密钥序列号判断并立即使用新的TEK对上行数据进行加密。在BS上,始终使用两个可用TEK中较旧的TEK对下行数据进行加密,具体过程如图1所示。As shown in Figure 1, in order to ensure the continuity of service transmission during the TEK update process, MS and BS maintain multiple SA (Security Association, secure connection) information synchronously, and the security connection information includes SAID (used to identify a secure connection), corresponding encryption algorithm parameters and TEK key information, etc. On the BS side, new TEKs are periodically generated for each SA to ensure that two available TEKs are maintained for one SA at each moment. The actual usage time of each TEK is shown in the hatched segment in Figure 1. Each TEK The length of the life cycle is the same, but there is an overlap of half the life cycle, such as the overlap between TEK0 and TEK1 in Figure 1, the overlap between TEK1 and TEK2, and the overlap between TEK2 and TEK3. After the MS completes the access and passes the authentication, it needs to request the BS for its authorized security connection information. This process may be completed during the authentication message interaction process, such as in the RSA authentication mode in 802.16d, the BS sends the SA information to the MS through the authentication response message Auth Reply; it may also be through a specific message interaction process after the authentication is completed. Complete, such as in PKMV2 of 802.16e/D8, the distribution of SA information is completed through an SA-TEK three-way handshake message interaction process. In addition, the BS may also send SA information to the MS by actively sending a message, such as an SAAdd message. After the MS obtains the SA information authorized by the BS, the MS or BS specifies a mapping relationship with an SA for the connection as needed when establishing a service connection. After the connection is successfully established, all data transmitted on the connection will use the corresponding SA. Specify the encryption algorithm and key to encrypt. In order to further enhance security, the MS must start requesting new key resources for the currently maintained SA at an appropriate moment. The current 802.16d/e protocol defines a TEK state machine for each SA on the MS, and a TEK Grace Time is defined in the state machine, which represents a time interval field before the end of the TEK life cycle. In this time field The starting point of x and y shown in Figure 1, the MS must initiate a Key Request to request a new key resource, and the BS responds with a Key Reply message after receiving the request message, which contains the KEK-encrypted Two TEKs available at the current moment, along with their respective key serial numbers and remaining lifetime lengths. After receiving the Key Reply, the MS judges according to the key serial number and immediately uses the new TEK to encrypt the uplink data. On the BS, always use the older TEK among the two available TEKs to encrypt the downlink data, the specific process is shown in Figure 1.
BS向MS发送的Key Reply消息中包含了使用KEK加密的TEK,TEK的序列号以及剩余生命周期长度,根据分析,BS构造并发送该消息的时刻和MS收到该消息并开始使用新的密钥的时刻之间相差一个空口的时延。也就是在图中的a、b两个时间点相差一个空口时延,设为Tdelay。一般情况下,这个时延为毫秒级。但是目前协议中定义的TEK Grace Time推荐为5分钟~3.5天(详见协议10.2),并且其结束时间点与TEK的失效时间相同。因此,如果在x时间点上开始发送Key Request消息,BS在绝大多数情况下收到该消息的时间是在时间点a之前,在这个时间点之前,BS还没有产生新的密钥,这样,BS就会把当前时刻两个可用的密钥,例如:TEK0和TEK1再次通过Key Reply消息发送给MS。MS收到Key Reply消息后发现没有包含更新的密钥信息,就会再次发起密钥请求Key Request,虽然最后距离TEK0失效前很短的一个时刻发送的Key Request消息可能在时间点a后达到BS,从而获得新的密钥TEK2。但是,在绝大多数情况下MS发送的Key Request消息都在时间点a前达到BS,从而极大地浪费了空口资源,而且从某种程度上来说,协议中为保证密钥更新成功完成提供的保护时间TEK Grace Time只在旧的TEK失效前很短的时间间隔内有效。如果在这个很短的保护时间内MS发送的Key Request消息发生了丢失,就会导致MS无法得到新的密钥,从而导致业务数据传输的不连续性。The Key Reply message sent by the BS to the MS contains the TEK encrypted with the KEK, the serial number of the TEK, and the remaining life cycle length. According to the analysis, the moment when the BS constructs and sends the message and the MS receives the message and starts to use the new key There is an air interface delay between key moments. That is, there is an air interface delay difference between the two time points a and b in the figure, which is set as Tdelay. Generally, this delay is on the order of milliseconds. However, the TEK Grace Time defined in the current agreement is recommended to be 5 minutes to 3.5 days (see Agreement 10.2 for details), and its end time point is the same as the expiration time of TEK. Therefore, if the Key Request message is sent at time point x, the BS receives the message before time point a in most cases, and before this time point, BS has not generated a new key, so , the BS will send the two available keys at the current moment, for example: TEK0 and TEK1, to the MS again through the Key Reply message. After receiving the Key Reply message, the MS finds that the updated key information is not included, so it will initiate a Key Request again, although the Key Request message sent at a short time before TEK0 expires may reach the BS after time point a , so as to obtain a new key TEK2. However, in most cases, the Key Request message sent by the MS reaches the BS before the time point a, which greatly wastes the air interface resources, and to some extent, the protocol provided in the protocol to ensure the successful completion of the key update The protection time TEK Grace Time is only valid for a short time interval before the old TEK expires. If the Key Request message sent by the MS is lost within this very short protection time, the MS will not be able to obtain a new key, resulting in discontinuity of service data transmission.
发明内容 Contents of the invention
本发明公开一种传输加密密钥对的周期性更新方法,以解决现有技术中更新传输加密密钥时成功率低、浪费空口资源的问题。The invention discloses a method for periodically updating a transmission encryption key pair to solve the problems in the prior art that the success rate is low and air interface resources are wasted when updating the transmission encryption key.
一种传输加密密钥对的周期性更新方法,根据802.16d/e协议每一个TEK的生命周期为两个更新周期,BS在每一个更新周期结束时生成一个新的TEK,用以补充其中生命周期结束的TEK;所述更新方法包括如下步骤:A periodic update method for transmitting encryption key pairs. According to the 802.16d/e protocol, the life cycle of each TEK is two update cycles, and the BS generates a new TEK at the end of each update cycle to supplement its life cycle. The TEK at the end of the cycle; the update method includes the following steps:
移动台MS/SS根据从BS获得的密钥响应消息Key Reply中的当前两个TEK剩余生命周期长度,确定先生成的TEK的失效时间;The mobile station MS/SS determines the expiration time of the previously generated TEK according to the remaining life cycle lengths of the current two TEKs in the key response message Key Reply obtained from the BS;
所述MS/SS设定TEK保护时间TEK Grace Time的起始时间大于等于所述失效时间减去两个空口时延的差值并小于等于所述失效时间;The MS/SS sets the starting time of the TEK protection time TEK Grace Time to be greater than or equal to the failure time minus the difference between the two air interface delays and less than or equal to the failure time;
所述MS/SS在TEK Grace Time的起始时间开始发送密钥请求消息。The MS/SS starts sending key request messages at the start time of TEK Grace Time.
在所述MS/SS设定TEK保护时间TEK Grace Time的起始时间之前,还包括:Before the MS/SS sets the start time of the TEK protection time TEK Grace Time, it also includes:
所述MS/SS利用获取的BS侧当前保存的两个TEK更新本地保存的两个TEK,并判断所述更新前后的两个TEK是否对应相同,如果是则向BS再次发送密钥请求消息,否则将TEK Grace Time清零。The MS/SS uses the acquired two TEKs currently stored on the BS side to update the two TEKs stored locally, and judges whether the two TEKs before and after the update correspond to the same, and if so, sends the key request message to the BS again, Otherwise, clear TEK Grace Time to zero.
所述TEK Grace Time为5分钟~3.5天。The TEK Grace Time is 5 minutes to 3.5 days.
所述空口时延通过测量统计或计算估计得到。The air interface delay is estimated through measurement statistics or calculation.
一种传输加密密钥对的周期性更新方法,根据802.16d/e协议每一个传输加密密钥TEK的生命周期为两个更新周期,基站BS在每一个更新周期结束时生成一个新的TEK,用以补充其中生命周期结束的TEK;所述更新方法包括如下步骤:A method for periodically updating a transmission encryption key pair. According to the 802.16d/e protocol, the life cycle of each transmission encryption key TEK is two update periods, and the base station BS generates a new TEK at the end of each update period. It is used to supplement the TEK whose life cycle is over; the update method includes the following steps:
移动台MS/SS根据从BS获得的密钥响应消息Key Reply中的当前两个TEK剩余使用时间,确定先生成的TEK的失效时间;所述TEK剩余使用时间为每一个TEK的剩余生命周期长度加上一个延长时间,该延长时间大于等于TEK Grace Time减去两个空口延时的差值并小于或等于TEK Grace Time;The mobile station MS/SS determines the expiration time of the first generated TEK according to the remaining usage time of the current two TEKs in the key response message Key Reply obtained from the BS; the remaining usage time of the TEK is the remaining life cycle length of each TEK Add an extension time, the extension time is greater than or equal to TEK Grace Time minus the difference between the two air interface delays and less than or equal to TEK Grace Time;
所述MS/SS设定TEK保护时间TEK Grace Time的起始时间为所述失效时间减去TEK Grace Time;The MS/SS sets the starting time of the TEK protection time TEK Grace Time as the failure time minus the TEK Grace Time;
所述MS/SS在TEK Grace Time的起始时间开始发送密钥请求消息。The MS/SS starts sending key request messages at the start time of TEK Grace Time.
所述TEK Grace Time为协议规定的5分钟~3.5天。The TEK Grace Time is 5 minutes to 3.5 days as stipulated in the agreement.
所述空口时延通过测量统计或计算估计得到。The air interface delay is estimated through measurement statistics or calculation.
本发明技术方案带来的有益效果:通过修改MS侧开始发送密钥更新请求消息的时间,提高了了BS在产生了新的密钥后收到该请求消息的概率,因此提高了一次消息交互就可以成功更新密钥的概率,减少了空口资源的浪费。Beneficial effects brought by the technical solution of the present invention: by modifying the time at which the MS side starts to send the key update request message, the probability that the BS receives the request message after generating a new key is improved, thus improving a message interaction The probability that the key can be successfully updated can reduce the waste of air interface resources.
附图说明 Description of drawings
图1为现有协议中的TEK更新流程时序图;Figure 1 is a sequence diagram of the TEK update process in the existing protocol;
图2为本发明所述实施例一的TEK更新流程时序图;FIG. 2 is a sequence diagram of the TEK update process in
图3为本发明所述实施例二的TEK更新流程时序图。FIG. 3 is a sequence diagram of a TEK update process in
具体实施方式 Detailed ways
目前802.16d/e协议中关于TEK Grace Time的定义中,将TEK Grace Time的结束时间定义在TEK的失效时间上,相应的起始时间则为TEK的失效时间减去TEK Grace Time的长度,这就造成了现有技术中存在的在更新密钥之前多次无用交互Key Request和Key Reply,从而浪费空口资源的问题。In the definition of TEK Grace Time in the current 802.16d/e protocol, the end time of TEK Grace Time is defined on the expiration time of TEK, and the corresponding start time is the expiration time of TEK minus the length of TEK Grace Time. This has resulted in the problem of wasting air interface resources in the prior art by repeatedly interacting Key Request and Key Reply uselessly before updating the key.
本发明提供的技术方案解决了现有技术中存在问题,保证了MS在一个合适的时间间隔内发送的密钥请求消息能够在BS产生了新的密钥后被收到,从而成功地完成密钥更新,保证了在密钥更新过程中业务数据传输的连续性。The technical solution provided by the present invention solves the problems existing in the prior art, and ensures that the key request message sent by the MS within an appropriate time interval can be received after the BS generates a new key, thereby successfully completing the key request message. Key update ensures the continuity of business data transmission during the key update process.
为了实现本发明的目的,需要修改MS发起密钥更新请求的策略,使得MS在一个合适的时间点上开始发送密钥更新请求消息,并保证在绝大多数情况下BS在产生了新的密钥后收到该消息。这样,在信道环境较好的情况下,MS和BS之间只需要一消息交互就能成功完成密钥的更新。同时,由于保证了在绝大多数情况下MS发送的密钥请求消息在BS产生了新的密钥后到达BS。所以即使当前信道环境较差,频繁出现消息丢失的情况,只要保护时间定义适合,还是能够在经过多次消息交互后成功完成密钥的更新。依据上述构思,本方法提供两个具体实施方式。In order to realize the purpose of the present invention, it is necessary to modify the strategy of MS initiating a key update request, so that the MS starts to send the key update request message at an appropriate time point, and ensure that in most cases the BS generates a new key The message is received after the key. In this way, when the channel environment is good, only one message exchange is needed between the MS and the BS to successfully complete the key update. At the same time, it is guaranteed that in most cases the key request message sent by the MS reaches the BS after the BS generates a new key. Therefore, even if the current channel environment is poor and messages are lost frequently, as long as the protection time definition is appropriate, the key update can still be successfully completed after multiple message exchanges. According to the above idea, this method provides two specific implementation manners.
实施例一:Embodiment one:
为了达到上述发明目的,需要修改目前802.16d/e协议中关于TEK GraceTime的定义。将TEK Grace Time的起始时间定义为MS侧旧的TEK生命周期结束之前至多两个空口时延之内的某一个时刻。MS在这个时间间隔TEK GraceTime内发送Key Request消息时,可以保证在BS侧生成新的密钥之后收到该消息,从而使返回的响应消息中携带新的密钥,使MS成功的完成传输密钥的更新。如图2所示,图2中的实施方法是将发送Key Request消息的起始点设定在TEK生命周期结束时,具体实现包括如下两个步骤:In order to achieve the purpose of the above invention, it is necessary to modify the definition of TEK GraceTime in the current 802.16d/e protocol. The start time of TEK Grace Time is defined as a certain moment within at most two air interface delays before the end of the old TEK life cycle on the MS side. When the MS sends the Key Request message within this time interval TEK GraceTime, it can ensure that the message is received after the new key is generated on the BS side, so that the returned response message carries the new key, so that the MS can successfully complete the transmission key request. key update. As shown in Figure 2, the implementation method in Figure 2 is to set the starting point of sending the Key Request message at the end of the TEK life cycle. The specific implementation includes the following two steps:
1、BS分别确定当前两个TEK的剩余生命周期长度并设置在Key Reply消息中发送给MS/SS;1. The BS respectively determines the remaining life cycle lengths of the current two TEKs and sends them to the MS/SS in the Key Reply message;
2、MS从Key Reply消息中获取每一个TEK的剩余生命周期长度并计算先生成的TEK的结束时间,例如:图2所示的MS/SS侧的TEK0、TEK1、或TEK2的结束时间,然后设定TEK Grace Time的起始时间为结束时间减去至少两个空口时延。2. The MS obtains the remaining life cycle length of each TEK from the Key Reply message and calculates the end time of the generated TEK, for example: the end time of TEK0, TEK1, or TEK2 on the MS/SS side shown in Figure 2, and then Set the start time of TEK Grace Time to the end time minus at least two air interface delays.
实施例二:Embodiment two:
为了达到上述发明目的,也可以不修改当前协议中关于TEK Grace Time的定义,只需要BS在使用Key Reply对MS的密钥请求进行响应时,将当前可用的两个TEK的剩余生命周期加上一个延长时间,一般来说,要求这个延长时间大于等于TEK Grace Time减去两个空口延时长度并小于或等于TEKGrace Time。这样,如图3所示,MS上TEK失效的时间将滞后一个延长时间。通过这种方式,MS上在TEK Grace Time时间间隔内发起的Key Request消息,能够保证在绝大多数情况下在BS产生了新的密钥后被收到。具体实现包括如下两个步骤:In order to achieve the purpose of the above invention, the definition of TEK Grace Time in the current protocol may not be modified. It is only necessary for the BS to add the remaining lifetimes of the two currently available TEKs to An extension time, generally speaking, the extension time is required to be greater than or equal to TEK Grace Time minus two air interface delay lengths and less than or equal to TEK Grace Time. In this way, as shown in FIG. 3 , the TEK failure time on the MS will be delayed by an extended time. In this way, the Key Request message initiated by the MS within the TEK Grace Time interval can be guaranteed to be received after the BS generates a new key in most cases. The specific implementation includes the following two steps:
1、BS分别确定当前两个TEK的剩余使用时间并设置在Key Reply消息中发送给MS,TEK的剩余使用时间为每一个TEK的剩余生命周期长度加上一个延长时间,该延长时间大于等于TEK Grace Time减去两个空口延时长度并小于或等于TEK Grace Time;1. The BS determines the remaining usage time of the current two TEKs and sends them to the MS in the Key Reply message. The remaining usage time of the TEK is the remaining life cycle length of each TEK plus an extension time, which is greater than or equal to the TEK Grace Time minus two air interface delay lengths is less than or equal to TEK Grace Time;
2、MS从Key Reply消息中获取每一个TEK的剩余使用时间并计算先生成的TEK的失效时间,然后设定所述TEK Grace Time的起始时间为所述失效时间减去TEK Grace Time。2. The MS obtains the remaining usage time of each TEK from the Key Reply message and calculates the expiration time of the generated TEK, and then sets the start time of the TEK Grace Time as the expiration time minus the TEK Grace Time.
实际上,将TEK的剩余使用时间设定每一个TEK的剩余生命周期长度加上一个延长时间的方法和实施例一相同,都是将TEK Grace Time的起始时间向后推,以避开在BS侧生成新的密钥之后收到MS侧发送的消息Key Request消息,减少了消息开销。In fact, the method of setting the remaining usage time of TEKs to the remaining life cycle length of each TEK plus an extension time is the same as that in
而且,如图1所示,由于BS和MS之间交互Key Request消息和Key Reply消息的时机以及空口时延的影响,虽然序号较前的TEK在MS侧的失效时间比BS侧晚,但是由于空口时延和调度的影响,MS可能在TEK失效后才收到BS发送的用相应TEK加密的数据包,这时,MS侧无法正确解密BS用该较前的TEK加密发送的数据。本实施例二可以一定程度改善这一问题,原因在于:当BS侧将TEK的剩余生命周期延长后,使MS侧保留序号较前的TEK的时间相对延长,由BS用序号较前的TEK加密发送的数据在到达MS侧时,即使信道环境或者调度的原因导致了数据传输的较大时延,MS侧仍然能够保证使用相应的旧TEK正确解密数据,提高了数据传输的可靠性。Moreover, as shown in Figure 1, due to the timing of exchanging Key Request messages and Key Reply messages between the BS and the MS and the influence of air interface delay, although the TEK with the earlier sequence number expires later on the MS side than on the BS side, due to Due to the impact of air interface delay and scheduling, the MS may receive the data packet encrypted with the corresponding TEK sent by the BS after the TEK expires. At this time, the MS side cannot correctly decrypt the data encrypted by the BS with the earlier TEK. This second embodiment can improve this problem to a certain extent. The reason is that when the BS side extends the remaining life cycle of the TEK, the time for the MS side to retain the TEK with an earlier serial number is relatively extended, and the BS uses the TEK with an earlier serial number to encrypt. When the sent data arrives at the MS side, even if the channel environment or scheduling causes a large delay in data transmission, the MS side can still ensure that the corresponding old TEK is used to decrypt the data correctly, which improves the reliability of data transmission.
本发明中,空口时延通过测量统计或计算估计得到。In the present invention, the air interface delay is obtained through measurement statistics or calculation estimation.
本发明技术方案带来的有益效果:通过修改MS侧开始发送密钥更新请求消息的时间,提高了BS在产生了新的密钥后收到该请求消息的概率,因此提高了一次消息交互就可以成功更新密钥的概率,减少了空口资源的浪费。Beneficial effects brought by the technical solution of the present invention: by modifying the time at which the MS side starts to send the key update request message, the probability that the BS receives the request message after generating a new key is improved, thus increasing the time required for a message interaction. The probability that the key can be successfully updated reduces the waste of air interface resources.
显然,本领域的技术人员可以对本发明进行各种改动和变型而不脱离本发明的精神和范围。这样,倘若本发明的这些修改和变型属于本发明权利要求及其等同技术的范围之内,则本发明也意图包含这些改动和变型在内。Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalent technologies, the present invention also intends to include these modifications and variations.
Claims (7)
Priority Applications (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
CNB2005100816260A CN100442923C (en) | 2005-06-29 | 2005-06-29 | A Periodic Update Method for Transmitting Encryption Key Pair |
Applications Claiming Priority (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
CNB2005100816260A CN100442923C (en) | 2005-06-29 | 2005-06-29 | A Periodic Update Method for Transmitting Encryption Key Pair |
Publications (2)
Publication Number | Publication Date |
---|---|
CN1889769A CN1889769A (en) | 2007-01-03 |
CN100442923C true CN100442923C (en) | 2008-12-10 |
Family
ID=37579027
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
CNB2005100816260A Expired - Fee Related CN100442923C (en) | 2005-06-29 | 2005-06-29 | A Periodic Update Method for Transmitting Encryption Key Pair |
Country Status (1)
Country | Link |
---|---|
CN (1) | CN100442923C (en) |
Families Citing this family (6)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN101237444B (en) * | 2007-01-31 | 2013-04-17 | 华为技术有限公司 | Secret key processing method, system and device |
CN100461974C (en) * | 2007-05-09 | 2009-02-11 | 中兴通讯股份有限公司 | Method and apparatus for triggering key updating |
US8392711B2 (en) * | 2009-05-27 | 2013-03-05 | Avaya Inc. | Staged establishment of secure strings of symbols |
CN104917595B (en) * | 2015-06-16 | 2018-04-27 | 四川长虹通信科技有限公司 | Key switching method and system during a kind of coded communication |
CN111489566A (en) * | 2020-05-19 | 2020-08-04 | 王辉 | Encryption and decryption type traffic signal control system and method for self health state monitoring |
CN112291060B (en) * | 2020-08-08 | 2024-07-23 | 北京天润海图科技有限公司 | Secure communication method, transmitting end and receiving end |
Citations (2)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20030078061A1 (en) * | 2001-10-23 | 2003-04-24 | Samsung Electronics Co., Ltd. | Method and apparatus for providing commercial broadcasting service in cellular mobile communication network |
CN1588844A (en) * | 2004-09-30 | 2005-03-02 | 西安西电捷通无线网络通信有限公司 | Method for realizing movable node and basic field managing entity key consultation |
-
2005
- 2005-06-29 CN CNB2005100816260A patent/CN100442923C/en not_active Expired - Fee Related
Patent Citations (2)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20030078061A1 (en) * | 2001-10-23 | 2003-04-24 | Samsung Electronics Co., Ltd. | Method and apparatus for providing commercial broadcasting service in cellular mobile communication network |
CN1588844A (en) * | 2004-09-30 | 2005-03-02 | 西安西电捷通无线网络通信有限公司 | Method for realizing movable node and basic field managing entity key consultation |
Also Published As
Publication number | Publication date |
---|---|
CN1889769A (en) | 2007-01-03 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US10091175B2 (en) | Authenticating a device in a network | |
JP4804454B2 (en) | Key distribution control device, radio base station device, and communication system | |
US8533461B2 (en) | Wireless local area network terminal pre-authentication method and wireless local area network system | |
KR101447726B1 (en) | The generation method and the update method of authorization key for mobile communication | |
CN101232376B (en) | Systems and methods for wireless mobile network authentication | |
US20020120844A1 (en) | Authentication and distribution of keys in mobile IP network | |
US20090088134A1 (en) | Mobile station, radio access network apparatus mobility switching station, mobile communication system, and communication service access method | |
CN102106111A (en) | Method of deriving and updating traffic encryption key | |
CN101309503A (en) | Wireless handover method, base station and terminal | |
US8572384B2 (en) | Method and apparatus for updating an authorization key in a communication system | |
WO2006136090A1 (en) | A method for preventing the replay attack and a method for ensuring the non-repetition of the message sequence number | |
KR101683286B1 (en) | System and method for authenticating sink using mobile network | |
CN100442923C (en) | A Periodic Update Method for Transmitting Encryption Key Pair | |
CN100488281C (en) | Method for acquring authentication cryptographic key context from object base station | |
CN100456884C (en) | Re-authentication method in wireless communication system | |
CN101167380A (en) | Method and apparatus for generating session keys | |
KR20190040443A (en) | Apparatus and method for creating secure session of smart meter | |
CN101742492B (en) | Key processing method and system | |
US9307406B2 (en) | Apparatus and method for authenticating access of a mobile station in a wireless communication system | |
CN108270560B (en) | Key transmission method and device | |
CN101631307B (en) | Empty password refreshing method and system for wireless communication system | |
Taha et al. | Formal analysis of the handover schemes in mobile WiMAX networks | |
US8713317B2 (en) | Method and system for encrypting data in a wireless communication system | |
CN101588576A (en) | Method and a system for protecting terminal privacy in wireless communication system | |
CN101668289A (en) | Method and system for updating air interface secret key in wireless communication system |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
C06 | Publication | ||
PB01 | Publication | ||
C10 | Entry into substantive examination | ||
SE01 | Entry into force of request for substantive examination | ||
C14 | Grant of patent or utility model | ||
GR01 | Patent grant | ||
C17 | Cessation of patent right | ||
CF01 | Termination of patent right due to non-payment of annual fee |
Granted publication date: 20081210 Termination date: 20130629 |