CN101999240B - Communication method, device and communication system between base stations - Google Patents

Abstract

A communication method, device and communication system between base stations is disclosed. The communication method between base stations includes: after the broadcast message of the neighbor base station is detected, the key of the neighbor base station is obtained based on the broadcast message of the neighbor base station; the messages transmitted by the neighbor base station are authenticated using the key of the neighbor base station. By using the above technical solution, the base station can ensure the legality of identity of the opposite party communication base station, so the security of communication between base stations is improved.

Description

Communication method, device and communication system between base stations

technical field

The present invention relates to the technical field of communication, in particular to a communication method, device and communication system between base stations.

Background technique

With the rapid increase in the number of mobile communication users and the continuous improvement of user needs, mobile communication system equipment also presents a diversified development trend. HNB (Home NodeB, Home Base Station) or HeNB (Home Evolved NodeB, Home Evolved Base Station) is a miniaturized base station aimed at application scenarios such as homes, schools, and enterprises. The network system based on HNB or HeNB can effectively improve indoor coverage, increase indoor access rate, reduce delay, and meet various user application requirements. At the same time, it can also reduce the load of macro base stations, so that the capacity of macro base stations is mainly used for outdoor or sports. medium users.

In the prior art, if the H(e)NB wishes to exchange information with other H(e)NBs, the H(e)NB will transmit the exchange information to the core network through the public IP network, and then the core network will forward the information to other H(e)NBs. e) NB or eNB (Evolved NodeB, evolved base station) in the operator's private network. This inter-H(e)NB communication method has a large message transmission delay, which can easily cause problems such as untimely communication messages between H(e)NBs and waste of back-end resources. In addition, H(e)NBs are also characterized by a large number of deployments. If the communication between all H(e)NBs is forwarded through the core network, it will cause a great burden on the core network equipment.

In theory, H(e)NBs can communicate directly through the air interface to reduce delay and reduce the burden on the core network. However, the direct communication between H(e)NBs through the air interface will have security problems: because the H(e)NB cannot confirm the identity of the communication peer, and does not know whether the message sent by the peer is reliable. Therefore, the attacker can communicate with the legitimate H(e)NB by impersonating the H(e)NB, thereby affecting the normal resource configuration, handover and other operations of the legitimate H(e)NB.

Contents of the invention

Embodiments of the present invention provide a communication method, device, and communication system between base stations to improve communication security between H(e)NBs. The technical solution is as follows:

A communication method between base stations, comprising: after detecting a broadcast message of a neighboring base station,

Obtain the identity of the neighbor base station from the broadcast message of the neighbor base station according to the broadcast message of the neighbor base station;

Sending a key request message to the core network, where the key request message carries the identity of the neighboring base station;

receiving a key response message sent by the core network, where the key response message carries the key of the neighboring base station;

The message sent by the neighbor base station is authenticated by using the key of the neighbor base station.

A base station, comprising:

The identifier obtaining subunit is used to obtain the identifier of the neighbor base station from the broadcast message of the neighbor base station after the broadcast message of the neighbor base station is detected;

a key request subunit, configured to send a key request message to the core network, where the key request message carries the identity of the neighboring base station;

A key receiving subunit, configured to receive a key response message sent by the core network, the key response message carrying the key of the neighboring base station;

The message authentication unit is configured to use the key of the neighbor base station to authenticate the message sent by the neighbor base station.

A communication system comprising a core network and at least two base stations;

The second base station is configured to, after detecting the broadcast message of the adjacent first base station, obtain the identity of the neighbor base station from the broadcast message of the first base station; send a key request message to the core network, and the key The request message carries the identifier of the first base station;

The core network is configured to send a key response message to the second base station according to the key request message, where the key response message carries the key of the first base station;

The second base station receives the key response message sent by the core network, and uses the key of the first base station to authenticate the message sent by the first base station.

Applying the technical solution provided by the embodiment of the present invention, before the second H(e)NB communicates with the first H(e)NB, it first obtains the information of the first H(e)NB according to the broadcast message of the first H(e)NB. key. After receiving the message sent by the first H(e)NB, the key is used to authenticate the message to confirm the identity of the sender and the reliability of the source of the message. If an attacker impersonates the first H(e)NB to send a message to the second H(e)NB, the authentication will fail, and the second H(e)NB may refuse to receive the message. Furthermore, each H(e)NB in the network can use the above mechanism to confirm the identity of the communication peer, thereby improving communication security between H(e)NBs.

Description of drawings

Fig. 1 is the method flowchart of embodiment one of the present invention;

Fig. 2 is the method flowchart of the second embodiment of the present invention;

Fig. 3 is the method flowchart of the third embodiment of the present invention;

FIG. 4 is a schematic structural diagram of a base station according to an embodiment of the present invention;

FIG. 5 is another schematic structural diagram of a base station according to an embodiment of the present invention;

FIG. 6 is a schematic structural diagram of a core network of a communication system according to an embodiment of the present invention;

Fig. 7 is another schematic structural diagram of the core network of the communication system according to the embodiment of the present invention.

Detailed ways

First, the communication method between base stations in the embodiment of the present invention is described, including:

After detecting the broadcast message of the neighbor base station, the base station obtains the key of the neighbor base station according to the broadcast message of the neighbor base station; uses the key of the neighbor base station to authenticate the message sent by the neighbor base station .

Wherein, the above-mentioned base station can be HNB or HeNB. Applying the above-mentioned technical solution, before the second H(e)NB communicates with the first H(e)NB, it first obtains the first H(e)NB's key. After receiving the message sent by the first H(e)NB, the key is used to authenticate the message to confirm the identity of the sender. If an attacker impersonates the first H(e)NB to send a message to the second H(e)NB, the authentication will fail, and the second H(e)NB may refuse to receive the message. Furthermore, each H(e)NB in the network can use the above mechanism to confirm the identity of the communication peer, thereby improving communication security between H(e)NBs.

In order to enable those skilled in the art to better understand the technical solutions of the present invention, specific embodiments of the present invention will be further described in detail below in conjunction with the accompanying drawings.

Embodiment one:

FIG. 1 is a flow chart showing the implementation of a secure communication method between base stations provided by an embodiment of the present invention, including the following steps:

S101, the base station 2 obtains the identity of the base station 1.

A certain base station listens to the broadcast messages of neighboring base stations through the air interface, and can obtain various information of neighboring base stations, such as carrier configuration information, cell load status, and so on. Wherein, the base station may listen when it is just started, or periodically.

In this embodiment, it is assumed that base station 1 is a neighbor base station of base station 2, and base station 2 can obtain the unique identifier of base station 1, such as base station ID, Cell ID, etc., by listening to the broadcast message of base station 1.

S102, the base station 2 sends a key request message to the core network.

When base station 2 listens to the broadcast message from base station 1, it means that base station 1 is within the distance of direct communication with base station 2. To ensure the security of subsequent calls, base station 2 sends a key request message to the core network, requesting A key for authenticating the message sent by base station 1 is obtained. Wherein, the key request message carries the identifier of the base station 1 .

S103, the core network verifies the identity of the base station 1.

Each base station needs to perform two-way authentication with the core network before accessing the core network. Therefore, for a base station with a legal identity, its relevant authentication information will be stored in the core network.

After the core network receives the key request message, it verifies the identity of base station 1 according to the identity of base station 1 carried in it, that is, checks whether it has saved relevant authentication information of base station 1, and if so, considers that the identity of base station 1 is If legal, further query the key of base station 1.

Preferably, after the core network receives the key request message, it can first verify the identity of the sender of the message (i.e. base station 2) to confirm whether base station 2 has the authority to obtain the key of base station 1, so as to further improve security .

S104, the core network sends a key response message to the base station 2.

If the verification in S103 passes, the core network will send a key response message to base station 2, and carry the key of base station 1 in the message. If the authentication fails, the key will not be carried in the response message.

S105, the base station 2 uses the key of the base station 1 to authenticate the message sent by the base station 1.

Base station 2 receives the key response message sent by the core network. If the response message does not carry the key, it means that base station 1 does not have a legal identity, and base station 2 will refuse to receive the message sent by base station 1.

If the key of the base station 1 is carried in the response message, it means that the identity of the base station 1 is legal and can communicate with it. Base station 2 stores the identity of base station 1 and the obtained key correspondingly. If it receives a message sent by base station 1, it uses the key of base station 1 to authenticate the message to confirm the reliability of the source of the message. The message sent by each base station is a signed message processed by its own key. If an attacker pretends to be base station 1 to send a message to base station 2, since the attacker does not have the key of base station 1, the message sent will fail to pass the authentication of base station 2.

Those skilled in the art can understand that the above method flow is applicable to base station 1 and base station 2 respectively, that is, for base station 1, after listening to the broadcast message of base station 2, the same method can be used to obtain the information of base station 2. key, and use the key of base station 2 to authenticate the message sent by base station 2. In practical applications, each base station will maintain a network neighbor list, the base station can obtain the key of each neighbor base station in the list from the core network, and store the obtained key and the network neighbor list correspondingly, when the base station When the base stations communicate with each other, the corresponding keys are used to authenticate the messages, so as to ensure the security of the communication between the base stations.

It should be noted that, in this embodiment, each base station actively obtains keys of other base stations from the core network. Actively provide the key to the base station. For example, if the key of a certain base station changes, the core network can send a message to other base stations, instructing them to reacquire the updated key; The associated base station sends the updated key.

In this embodiment, the base station obtains the key of the communication peer by sending a key request to the core network, and uses the key to authenticate the message sent by the peer. It is equivalent to the core network to ensure the legitimacy of the identities of the base stations of both communication parties, and the base station itself to ensure the reliability of the source of subsequent received messages. On the other hand, for the core network, after receiving the key request message, it only needs to check whether it has saved relevant authentication information of the base station corresponding to the identifier, and does not need to occupy a lot of resources. Moreover, the subsequent message exchange between the base stations does not require the participation of the core network, so that the communication delay between the base stations can be reduced, and the burden on the core network can be reduced at the same time.

Embodiment two:

FIG. 2 is a flow chart for implementing another secure communication between base stations provided by an embodiment of the present invention, including the following steps:

S201, base station 2 obtains the broadcast certificate of base station 1.

In this embodiment, it is still assumed that the base station 1 is a neighbor base station of the base station 2, and the base station 2 can obtain the broadcast certificate of the base station 1 by listening to the broadcast message of the base station 1. The broadcast certificate carries the key of the base station 1, and the broadcast certificate is signed by the base station 1 with a third-party signature key.

Wherein, the above-mentioned third-party signature key is provided by a certification authority (such as a core network), and the certification authority only provides a third-party signature key to a base station with a legal identity. The third-party signature key may be pre-configured in the base station, or may be acquired by the base station from the certification authority in real time, or issued by the certification authority to the base station in real time. Further, the third-party signature key may be static or dynamically changing. It can be understood that the dynamically changing third-party signature key can further improve security. In this case, the base station needs to obtain it from the certification authority in real time, or the certification authority sends it to the base station in real time.

S202, base station 2 authenticates the broadcast certificate of base station 1 by using the third-party signature key.

After base station 2 obtains the broadcast certificate of base station 1, it uses the third-party signature key to authenticate the broadcast certificate. Since the certification authority only provides the third-party signature key to the base station with a legal identity, the authentication of the broadcast certificate of the base station 1 is equivalent to verifying whether the base station 1 has a legal identity. If the authentication passes, the key of the base station 1 carried in the broadcast certificate is saved.

S203, the base station 2 uses the key of the base station 1 to authenticate the message sent by the base station 1.

This step is similar to that described in S105, and will not be repeated here.

Similar to Embodiment 1, the above method flow is also applicable to base station 1 and base station 2 respectively. In practical applications, each legitimate base station will use a third-party signature key to sign its own broadcast certificate and obtain the broadcast certificate of each neighboring base station. If the authentication of the broadcast certificate passes, the corresponding key will be obtained. key, and stored corresponding to the network neighbor list, when the base stations communicate with each other, use the corresponding key to authenticate the message, so as to ensure the security of the communication between the base stations.

In this embodiment, each base station authenticates the broadcast certificates of other base stations by using the third-party signature key, which is equivalent to ensuring the legitimacy of the identity of the communication peer base station by the base station itself. Compared with Embodiment 1, the burden of the core network can be further reduced.

Embodiment three:

The above two embodiments describe how to ensure the legitimacy of the identities of the communication parties and the reliability of communication messages during the base station communication process. On the basis of the above solutions, this embodiment further provides a communication method between base stations, so as to improve communication confidentiality. The flow diagram of the method can be seen in Figure 3. The following assumes that both base station 1 and base station 2 are base stations with legal identities, and both have obtained the key of the other party (set the key of base station 1 as key1 and the key of base station 2 as key2 ).

S301. Base station 1 encrypts a message to be sent to base station 2 using key2.

Applying the scheme of Embodiment 1 or Embodiment 2, base station 1 has stored the key key2 of base station 2, and for the message to be sent to base station 2, base station 1 can first use key2 to perform encryption processing to obtain the ciphertext message.

S302. Base station 1 sends the encrypted message to base station 2.

The base station 1 sends the ciphertext message to the base station 2. Based on the first or second embodiment, it can be seen that when the base station 1 sends the message, it will use its own key key1 to sign the ciphertext message again.

S303, base station 2 receives the message, and uses key2 to decrypt the message.

After base station 2 receives the ciphertext message sent by base station 1, it first uses key1 to authenticate the message, and after confirming the reliability of the source of the message, it uses key2 (or the private key corresponding to key2) to authenticate the ciphertext message. decrypt.

The foregoing method flow is applicable to the base station 1 and the base station 2 respectively. Moreover, those skilled in the art can understand that base station 1 or base station 2 can also pre-determine a communication-specific key, use the other party's key to encrypt and provide it to the other party, and subsequent base station 1 and base station 2 will use the communication-specific key to conduct Confidential Communications.

Compared with Embodiment 1 or Embodiment 2, this embodiment further improves the confidentiality of communication on the basis of ensuring the legality of the identities of both parties in communication and the reliability of communication messages, and prevents the content of communication from being obtained by a third party, and, This process does not require the participation of the core network.

By applying the technical solutions provided by the embodiments of the present invention, the security of direct communication between H(e)NBs can be guaranteed. Direct communication between H(e)NBs can not only reduce the delay and reduce the burden on the core network, but also assist the self-configuration and self-optimization of H(e)NBs, which will also bring benefits to interference coordination and fast switching . For example, when the H(e)NB starts up, it can perceive the configuration of neighbors by obtaining surrounding information, for example, by reading the broadcast messages of neighbors, it can obtain the configuration information of surrounding cells, such as the number of carriers used, carrier usage, current cell The newly started H(e)NB completes its own parameter setting according to the monitored information of neighboring cells; during the operation of H(e)NB, it can also monitor the information of surrounding cells in real time , so as to perform resource scheduling and reconfiguration of working parameters to achieve the purpose of avoiding mutual interference.

Several specific embodiments of the present invention have been introduced above. It should be noted that the technical solution of the present invention is proposed for the application environment of HNB or HeNB, but all or part of the solution can also be applied in other similar communication environments to improve communication. Safety performance, these also should be included in the scope of protection of the present invention.

Those of ordinary skill in the art can understand that all or part of the steps for realizing the above-mentioned method embodiments can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer-readable storage medium. When the program is executed, the Comprise the steps of above-mentioned method embodiment; And aforementioned storage medium comprises: ROM (Read-Only Memory, read-only storage memory), RAM (Random AccessMemory, random storage memory), magnetic disk or optical disc etc. various can store program The medium of the code.

Embodiment four:

Corresponding to the above method embodiment, the embodiment of the present invention also provides a base station, as shown in FIG. 4, including:

The key obtaining unit 410 is configured to obtain the key of the neighbor base station according to the broadcast message of the neighbor base station after detecting the broadcast message of the neighbor base station;

The message authentication unit 420 is configured to use the key of the neighbor base station to authenticate the message sent by the neighbor base station.

The base station provided by the embodiment of the present invention uses the key of the neighbor base station to authenticate the message sent by the neighbor base station, so as to ensure the legality of the message sender's identity.

Further, the key obtaining unit 410 may include:

an identifier obtaining subunit, configured to obtain the identifier of the neighbor base station from the broadcast message of the neighbor base station;

a key request subunit, configured to send a key request message to the core network, where the key request message carries the identity of the neighboring base station;

The key receiving subunit is configured to receive a key response message sent by the core network, where the key response message carries the key of the neighboring base station.

The above-mentioned base station obtains the key of the communication peer by sending a key request to the core network, and uses the key to authenticate the message sent by the peer. It is equivalent to the core network to ensure the legitimacy of the identities of the base stations of both communication parties, and the base station itself to ensure the reliability of the source of subsequent received messages. Applying the above-mentioned base station, for the core network, after receiving the key request message, it only needs to check whether it has stored the relevant authentication information of the base station corresponding to the identifier, and does not need to occupy a lot of resources. Moreover, the subsequent message exchange between the base stations does not require the participation of the core network, so that the communication delay between the base stations can be reduced, and the burden on the core network can be reduced at the same time.

The key obtaining unit 410 may also include:

The broadcast certificate obtaining subunit is configured to obtain the broadcast certificate of the neighbor base station from the broadcast message of the neighbor base station, and the broadcast certificate carries the key of the neighbor base station;

The broadcast certificate authentication subunit is configured to use a third-party signature key to authenticate the broadcast certificate of the neighbor base station, and if the authentication passes, save the key of the neighbor base station; wherein the third-party signature key The key is provided by the certification authority.

Applying the above-mentioned base stations, each base station authenticates the broadcast certificates of other base stations by using the third-party signature key, which is equivalent to the base station itself ensuring the legitimacy of the identity of the communication peer base station, thereby further reducing the burden on the core network.

FIG. 5 is a schematic structural diagram of another base station provided by an embodiment of the present invention. Compared with FIG. 4, the base station further adds a message decryption unit 430, which is used to send the message in the neighboring base station as a ciphertext message , use its own key to decrypt the ciphertext message.

Applying the above base station can further improve the confidentiality of communication on the basis of ensuring the legitimacy of the identities of both parties in communication and the reliability of communication messages, and prevent the content of communication from being obtained by a third party. Moreover, the process does not require the participation of the core network.

Embodiment five:

The embodiment of the present invention also provides a communication system, including: a core network and at least two base stations;

The second base station is configured to, after detecting the broadcast message of the adjacent first base station, obtain the identity of the neighbor base station from the broadcast message of the first base station; send a key request message to the core network, and the The key request message carries the identifier of the first base station;

The core network is configured to send a key response message to the second base station according to the key request message, where the key response message carries the key of the first base station;

The second base station receives the key response message sent by the core network, and uses the key of the first base station to authenticate the message sent by the first base station.

Referring to Fig. 6, the core network may include:

The first verification unit 610 is configured to verify the identity of the first base station according to the identity of the first base station after receiving the key request message sent by the second base station;

The key sending unit 620 is configured to send a key response message to the second base station after the first verification unit passes the verification, where the key response message carries the key of the first base station.

Referring to FIG. 7, the core network may further include a second verification unit 630, configured to verify the identity of the second base station after receiving the key request message sent by the second base station;

Then the first verification unit 620 verifies the identity of the first base station according to the identity of the first base station after the second verification unit 630 passes the verification.

In the communication system provided by this embodiment, the core network ensures the legitimacy of the identities of the base stations of both communication parties, and the base station itself ensures the reliability of the source of subsequent received messages. For the core network, after receiving the key request message, it only needs to check whether it has saved relevant authentication information of the base station corresponding to the identifier, and does not need to occupy a lot of resources. Moreover, the subsequent message exchange between the base stations does not require the participation of the core network, so that the communication delay between the base stations can be reduced, and the burden of the core network can be reduced at the same time.

As for the device and system embodiments, since they basically correspond to the method embodiments, the description is relatively simple, and for related parts, please refer to the part of the description of the method embodiments. The device and system embodiments described above are only illustrative, and the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, It can be located in one place, or it can be distributed to multiple network elements. Part or all of the modules can be selected according to actual needs to achieve the purpose of the solution of this embodiment. It can be understood and implemented by those skilled in the art without creative effort.

The foregoing is only a specific embodiment of the present invention. It should be pointed out that for those of ordinary skill in the art, some improvements and modifications can also be made without departing from the principle of the present invention. It should be regarded as the protection scope of the present invention.

Claims (11)

1. an inter base station communication method is characterized in that, after detecting the broadcast of neighbor base stations, the method comprises:

According to the broadcast of described neighbor base stations, from the broadcast of described neighbor base stations, obtain the sign of described neighbor base stations;

Send secret key request message, the sign of carrying described neighbor base stations in the described secret key request message to core net;

Receive the key response message that core net sends, carry the key of described neighbor base stations in the described key response message;

Use the key of described neighbor base stations, the message that described neighbor base stations sends is carried out authentication.

2. method according to claim 1 is characterized in that,

After core net is received described secret key request message, verify according to the sign of described neighbor base stations the identity of described neighbor base stations if the verification passes, then to send described key response message.

3. method according to claim 1 is characterized in that, the method also comprises:

From the broadcast of described neighbor base stations, obtain the broadcasting certificate of described neighbor base stations, carry the key of described neighbor base stations in the described broadcasting certificate;

Use third party's signature key that the broadcasting certificate of described neighbor base stations is carried out authentication, if authentication is passed through, then preserve the key of described neighbor base stations; Wherein, described third party's signature key is provided by certification authority.

4. method according to claim 3 is characterized in that, described third party's signature perhaps is to obtain from core net is instant for pre-configured.

5. according to claim 1 to 4 each described methods, it is characterized in that the message that described neighbor base stations sends is cipher-text message, then described method also comprises:

Use the key of self that described cipher-text message is decrypted.

6. a base station is characterized in that, comprising:

Identifier obtains subelement, is used for being used for the broadcast from described neighbor base stations after detecting the broadcast of neighbor base stations, obtains the sign of described neighbor base stations;

The key request subelement is used for sending secret key request message, the sign of carrying described neighbor base stations in the described secret key request message to core net;

The key reception subelement is used for receiving the key response message that core net sends, and carries the key of described neighbor base stations in the described key response message;

The message authentication unit for the key that uses described neighbor base stations, carries out authentication to the message that described neighbor base stations sends.

7. base station according to claim 6 is characterized in that, described key obtains the unit, comprising:

The broadcasting certificate obtains subelement, is used for the broadcast from described neighbor base stations, obtains the broadcasting certificate of described neighbor base stations, carries the key of described neighbor base stations in the described broadcasting certificate;

Broadcasting certificate authentication subelement is used for using third party's signature key that the broadcasting certificate of described neighbor base stations is carried out authentication, if authentication is passed through, then preserves the key of described neighbor base stations; Wherein, described third party's signature key is provided by certification authority.

8. each described base station is characterized in that according to claim 6-7, and described base station also comprises:

The decrypt messages unit is used for using the key of self that described cipher-text message is decrypted when the message that described neighbor base stations sends is cipher-text message.

9. a communication system is characterized in that, comprises core net and at least two base stations;

The second base station is used for after the broadcast that detects the first adjacent base station, from the broadcast of described the first base station, obtains the sign of neighbor base stations; Send secret key request message to core net, carry the sign of described the first base station in the described secret key request message;

Described core net is used for according to described secret key request message, sends key response message to described the second base station, carries the key of described the first base station in the described key response message;

Described the second base station receives the key response message that core net sends, and uses the key of described the first base station, and the message that described the first base station sends is carried out authentication.

10. communication system according to claim 9 is characterized in that, described core net comprises:

The first authentication unit is used for according to the sign of described the first base station, verifying the identity of described the first base station after receiving the secret key request message that described the second base station sends;

The key transmitting element is used for sending key response message to described the second base station after described the first authentication unit checking is passed through, and carries the key of described the first base station in the described key response message.

11. communication system according to claim 10 is characterized in that, described core net also comprises the second authentication unit, is used for verifying the identity of described the second base station after receiving the secret key request message that described the second base station sends; Described the first authentication unit after described the second authentication unit checking is passed through, according to the sign of described the first base station, is verified the identity of described the first base station.

Images