CN109922080A - The method and device securely communicated between user equipment - Google Patents
The method and device securely communicated between user equipment Download PDFInfo
- Publication number
- CN109922080A CN109922080A CN201910256482.XA CN201910256482A CN109922080A CN 109922080 A CN109922080 A CN 109922080A CN 201910256482 A CN201910256482 A CN 201910256482A CN 109922080 A CN109922080 A CN 109922080A
- Authority
- CN
- China
- Prior art keywords
- key
- communication
- user equipment
- user device
- certificate
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
- H04L63/061—Network architectures or network communication protocols for network security for supporting key management in a packet data network for key exchange, e.g. in peer-to-peer networks
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
- H04L63/0823—Network architectures or network communication protocols for network security for authentication of entities using certificates
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
- H04W12/041—Key generation or derivation
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
- H04W12/043—Key management, e.g. using generic bootstrapping architecture [GBA] using a trusted network node as an anchor
- H04W12/0431—Key distribution or pre-distribution; Key agreement
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
- H04W12/043—Key management, e.g. using generic bootstrapping architecture [GBA] using a trusted network node as an anchor
- H04W12/0433—Key management protocols
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/06—Authentication
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/06—Authentication
- H04W12/069—Authentication using certificates or pre-shared keys
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L2463/00—Additional details relating to network architectures or network communication protocols for network security covered by H04L63/00
- H04L2463/061—Additional details relating to network architectures or network communication protocols for network security covered by H04L63/00 applying further key derivation, e.g. deriving traffic keys from a pair-wise master key
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W76/00—Connection management
- H04W76/10—Connection setup
- H04W76/14—Direct-mode setup
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computer Hardware Design (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Mobile Radio Communication Systems (AREA)
Abstract
The embodiment of the present invention provides the method and device securely communicated between a kind of user equipment, to improve the safety communicated between UE.In the present invention, certificate is respectively configured in the first user equipment and second user equipment, and is based on certificate, is carried out two-way authentication and arranging key, is obtained the first key generated after certificate verification;Secret key deduction is carried out according to the first key, obtains encryption key and complete secrecy key;Safeguard protection is carried out using the encryption key and the complete communication data protected described in key pair between the first user equipment and the second user equipment.By means of the invention it is possible to carry out safeguard protection to whole communication datas in communicating between user equipment, and then the communication between user equipment provides safety assurance.
Description
Technical field
The present invention relates to a kind of method securely communicated between field of communication technology more particularly to user equipment and dresses
It sets.
Background technique
ProSe (Proximity Service, short distance business) is 3GPP (3rd Generation Partnership
Project, the 3rd generation affiliate) latest definition the UE based on LTE (Long Term Evolution, long term evolution) technology
The technology communicated between (User Equipment, user equipment).
When being communicated under ProSe scene between UE, it can be communicated between UE by network assistance, it can also be direct
Communicated between UE, no matter which kind of communication scenes, when directly being communicated between UE, require to carry out two-way authentication to confirm pair
Identity reality is held, and generates the safety of keys for securing communications data.
In general, when carrying out two-way authentication in current techniques between UE, it is two-way between two entities for having ip protocol layer
Certification, verification process are completed at IP layers and generate key, and the key generated in verification process can protect IP layers and with upper layer communication
The safety of data, but there may also be control plane and user Mian Deng lower layer under ProSe communication scenes, when being communicated between UE
Communication data can not protect the safety of underlay communication data, the safety communicated between UE in the key that IP layers generate
It is lower.
Summary of the invention
The embodiment of the present invention provides the method and device securely communicated between a kind of user equipment, to improve between UE
The safety of communication.
In a first aspect, providing a kind of method securely communicated between user equipment, comprising:
Certificate is respectively configured in first user equipment and second user equipment;
First user equipment and the second user equipment are based on the certificate, carry out two-way authentication and negotiate close
Key obtains the first key generated after certificate verification;
First user equipment and the second user equipment carry out secret key deduction according to the first key, obtain
Encryption key and complete secrecy key;
Using the first user equipment described in the encryption key and complete guarantor's key pair and the second user equipment it
Between communication data carry out safeguard protection.
With reference to first aspect, in the first possible implementation, certificate is configured, comprising:
Certificate is locally configured, or passes through network to certification authority certificate of registry;
The certificate includes: the certificate of the affiliated home public land mobile network network HPLMN of current user equipment, and with work as
The root certificate of the affiliated home public land mobile network network HPLMN of each target UE that preceding user equipment is authenticated.
With reference to first aspect, the possible implementation of the first of first aspect, in the second possible implementation, base
In the certificate, two-way authentication and arranging key are carried out, obtains the first key generated after certificate verification, comprising:
It is based on the Internet Key Exchange IKE at IP layers according to the certificate, two-way authentication is carried out, it is close to negotiate IP layers of generation
Key, as the first key.
With reference to first aspect, the possible implementation of the first of first aspect, in the third possible implementation, base
In the certificate, two-way authentication and arranging key are carried out, obtains the first key generated after certificate verification, comprising:
Certificate is carried and is sent in wireless transmission signaling to correspondent user device, and carries out the certification of certificate;
After certificate verification passes through, itself is deduced to the communication key generated as the first key, or acquisition pair
For the communication key that end user device is sent as the first key, the input parameter that the communication key is deduced includes group mark
ID and/or random number, the mark of described group of mark ID affiliated communication set when being communicated between user equipment.
The third possible implementation with reference to first aspect in the fourth possible implementation carries certificate
Before being sent in wireless transmission signaling to correspondent user device, further includes:
The graceful DH of diffie-hellman is carried out with correspondent user device to exchange, and negotiates shared key;
It is encrypted using mark of the shared key to the certificate or the certificate.
With reference to first aspect, in a fifth possible implementation, described to be pushed away according to first key progress key
It drills, obtains encryption key and complete secrecy key, comprising:
According to the IP address of the IP address and/or correspondent user device of the first key and current user equipment, into
Row secret key deduction obtains encryption key and complete secrecy key.
Second aspect provides a kind of method securely communicated between user equipment, comprising:
The correspondent user device communicated with current user equipment is authenticated;
After certification passes through, the first random number is generated, identifies ID and the first generating random number communication key according to group,
Described group of mark ID is the mark of affiliated communication set when current user equipment is communicated with correspondent user device;
According to the communication key, adding when carrying out unicast communication between current user equipment and correspondent user device is deduced
Key and/or complete secrecy key, and the encryption key and/or complete secrecy key are utilized, to current user equipment and peer user
Communication data when carrying out unicast communication between equipment carries out safeguard protection.
In conjunction with second aspect, in the first possible implementation, using the encryption key and/or complete secrecy key,
Before carrying out safeguard protection to communication data when carrying out unicast communication between current user equipment and correspondent user device, the party
Method further include:
Using the public key of correspondent user device, first random number is encrypted;
Encrypted first random number is sent to the correspondent user device, and receives the correspondent user device
Send the second random number, second random number be the correspondent user device to encrypted first random nnrber decryption after, and
Utilize the public key of current user equipment, the random number of re-encrypted;
Determine that second random number is identical as first random number.
In conjunction with second aspect, in the second possible implementation, using the encryption key and/or complete secrecy key,
Before carrying out safeguard protection to communication data when carrying out unicast communication between current user equipment and correspondent user device, the party
Method further include:
Using shared key, first random number is encrypted;
Encrypted first random number is sent to the correspondent user device, receives the correspondent user device hair
Send the second random number, second random number is the correspondent user device to after encrypted first random nnrber decryption and utilizing
Shared key, the random number of re-encrypted;
Determine that second random number is identical as first random number.
It can the side of being able to achieve in conjunction with the first possible implementation or second of second aspect of second aspect, second aspect
Formula, in the third possible implementation, after group mark ID and the first generating random number communication key, the party
Method further include:
Using shared key or the public key of correspondent user device, the communication key is encrypted;
Encrypted communication key is sent to the correspondent user device, indicates the correspondent user device according to encryption
Communication key afterwards deduces encryption key and/or complete secrecy key when carrying out unicast communication between current user equipment, and benefit
With the encryption key and/or complete secrecy key of deduction, to communication data when carrying out unicast communication between current user equipment into
Row safeguard protection.
It can the side of being able to achieve in conjunction with the first possible implementation or second of second aspect of second aspect, second aspect
Formula, in the fourth possible implementation, using the encryption key and/or complete secrecy key, to current user equipment with it is right
Before communication data when carrying out unicast communication between end user device carries out safeguard protection, this method further include:
Using shared key or the public key of correspondent user device, the encryption key and/or complete secrecy key are encrypted;
Encrypted encryption key and/or complete secrecy key are sent to the correspondent user device, indicate that the opposite end is used
The encrypted encryption key and/or complete secrecy key is decrypted in family equipment, and using decryption after encryption key and/or
The complete communication data protected between key pair and current user equipment when carrying out unicast communication carries out safeguard protection.
The third aspect provides a kind of method securely communicated between user equipment, comprising:
The correspondent user device communicated with current user equipment is authenticated;
After certification passes through, random sequence is generated, multicast key is obtained according to the random sequence;
According to the multicast key, adding when carrying out cast communication between current user equipment and correspondent user device is determined
Key and/or complete secrecy key, and set using the encryption key and/or complete guarantor's key pair current user equipment with peer user
Communication data when carrying out cast communication between standby carries out safeguard protection.
In conjunction with the third aspect, in the first possible implementation, current user equipment and correspondent user device are determined
Between carry out cast communication when encryption key and/or complete secrecy key after, this method further include:
Using shared key or the public key of correspondent user device, the encryption key and/or complete secrecy key are encrypted;
Encrypted encryption key and/or complete secrecy key are sent to the correspondent user device, and indicate the opposite end
User equipment decrypts encrypted encryption key and/or complete secrecy key, and uses the encryption key after decryption and/or complete secrecy
Communication data when key pair carries out cast communication with current user equipment carries out safeguard protection.
Fourth aspect provides a kind of method securely communicated between user equipment, comprising:
The correspondent user device communicated with current user equipment is authenticated;
After certification passes through, the communication key that the correspondent user device is sent is obtained, the communication key is described right
End user device according to group mark ID and/or the key of the first generating random number, described group of mark ID be current user equipment with
The mark of affiliated communication set when correspondent user device is communicated;
Encryption key and/or complete secrecy key are deduced according to the communication key, utilizes the encryption key and/or complete secrecy
Key carries out safeguard protection to communication data when carrying out unicast communication between current user equipment and correspondent user device.
5th aspect, provides a kind of secure communication device, including configuration unit, authentication unit, Key generating unit sum number
According to protection location, wherein
Certificate is respectively configured to the first user equipment and second user equipment in the configuration unit, and by the certificate of configuration
It is transmitted to the authentication unit;
The authentication unit, receives the certificate of the configuration unit transmission, and is based on the certificate, to first user
Equipment and the second user equipment carry out two-way authentication and arranging key, obtain the first key generated after certificate verification, and
The first key of the generation is sent to the Key generating unit;
The Key generating unit receives the first key that authentication unit is sent, and close according to first key progress
Key is deduced, and obtains encryption key and complete secrecy key, obtained encryption key and complete secrecy key are sent out to the data protection unit
It send;
The data protection unit, the encryption key sent using Key generating unit and complete guarantor's key pair institute
The communication data stated between the first user equipment and the second user equipment carries out safeguard protection.
In conjunction with the 5th aspect, in the first possible implementation, the configuration unit is specifically used for:
Certificate is locally configured, or passes through network to certification authority certificate of registry;
The certificate includes: the certificate of the affiliated home public land mobile network network HPLMN of current user equipment, and with work as
The root certificate of the affiliated home public land mobile network network HPLMN of each target UE that preceding user equipment is authenticated.
In conjunction with the first possible implementation of the 5th aspect or the 5th aspect, in second of possible implementation
In, the authentication unit is specifically used for:
It is based on the Internet Key Exchange IKE at IP layers according to the certificate, two-way authentication is carried out, it is close to negotiate IP layers of generation
Key, as the first key.
In conjunction with the first possible implementation of the 5th aspect or the 5th aspect, in the third possible implementation
In, the authentication unit is specifically used for:
Certificate is carried and is sent in wireless transmission signaling to correspondent user device, and carries out the certification of certificate;
After certificate verification passes through, itself is deduced to the communication key generated as the first key, or acquisition pair
For the communication key that end user device is sent as the first key, the input parameter that the communication key is deduced includes group mark
ID and/or random number, the mark of described group of mark ID affiliated communication set when being communicated between user equipment.
In conjunction with the third possible implementation of the 5th aspect, in the fourth possible implementation, the certification is single
Member is also used to:
Certificate is carried before being sent in wireless transmission signaling to correspondent user device, carries out enlightening with correspondent user device
Phenanthrene-Herman DH exchange, negotiates shared key;
It is encrypted using mark of the shared key to the certificate or the certificate.
In conjunction with the 5th aspect, in a fifth possible implementation, the Key generating unit is specifically used for:
According to the IP address of the IP address and/or correspondent user device of the first key and current user equipment, into
Row secret key deduction obtains encryption key and complete secrecy key.
6th aspect, provides a kind of communication device, including authentication unit, Key generating unit and data protection unit,
In,
The authentication unit, for being authenticated to the correspondent user device communicated with current user equipment, when recognizing
After card passes through, Xiang Suoshu Key generating unit sends the information that certification passes through;
The Key generating unit generates first when receiving the information that the certification that the authentication unit is sent passes through
Random number, according to group mark an ID and the first generating random number communication key, described group of mark ID be current user equipment with
The mark of affiliated communication set when correspondent user device is communicated;And according to the communication key, deduce current user equipment with
The encryption key and/or complete secrecy key when unicast communication are carried out between correspondent user device, will deduce obtained encryption key and/
Or complete secrecy key is sent to the data protection unit;
The data protection unit, the encryption key deduced using the Key generating unit and/or complete guarantor
Key carries out safeguard protection to communication data when carrying out unicast communication between current user equipment and correspondent user device.
In conjunction with the 6th aspect, in the first possible implementation, the data protection unit is also used to:
The encryption key and/or complete secrecy key are being utilized, is being carried out between current user equipment and correspondent user device
Before communication data when unicast communication carries out safeguard protection, using the public key of correspondent user device, to first random number
It is encrypted;
Encrypted first random number is sent to the correspondent user device, and receives the correspondent user device
Send the second random number, second random number be the correspondent user device to encrypted first random nnrber decryption after, and
Utilize the public key of current user equipment, the random number of re-encrypted;
Determine that second random number is identical as first random number.
In conjunction with the 6th aspect, in the second possible implementation, the data protection unit is also used to:
The encryption key and/or complete secrecy key are being utilized, is being carried out between current user equipment and correspondent user device
Before communication data when unicast communication carries out safeguard protection, using shared key, first random number is encrypted;
Encrypted first random number is sent to the correspondent user device, receives the correspondent user device hair
Send the second random number, second random number is the correspondent user device to after encrypted first random nnrber decryption and utilizing
Shared key, the random number of re-encrypted;
Determine that second random number is identical as first random number.
Second in conjunction with the 6th aspect, the first possible implementation of the 6th aspect or the 6th aspect can the side of being able to achieve
Formula, in the third possible implementation, the Key generating unit are also used to: according to group mark ID and described first with
After machine number generates communication key, using shared key or the public key of correspondent user device, the communication key is encrypted;
Encrypted communication key is sent to the correspondent user device, indicates the correspondent user device according to encrypted communication
Key deduces encryption key and/or complete secrecy key when carrying out unicast communication between current user equipment;
The data protection unit, is also used to, the encryption key deduced using correspondent user device and/or complete secrecy
Key carries out safeguard protection to communication data when carrying out unicast communication between current user equipment.
Second in conjunction with the 6th aspect, the first possible implementation of the 6th aspect or the 6th aspect can the side of being able to achieve
Formula, in the fourth possible implementation, the data protection unit are also used to:
The encryption key and/or complete secrecy key are being utilized, is being carried out between current user equipment and correspondent user device
Before communication data when unicast communication carries out safeguard protection, using shared key or the public key of correspondent user device, to described
Encryption key and/or complete secrecy key are encrypted;
Encrypted encryption key and/or complete secrecy key are sent to the correspondent user device, indicate that the opposite end is used
The encrypted encryption key and/or complete secrecy key is decrypted in family equipment, and using decryption after encryption key and/or
The complete communication data protected between key pair and current user equipment when carrying out unicast communication carries out safeguard protection.
7th aspect, provides a kind of communication device, including authentication unit, Key generating unit and data protection unit,
In,
The authentication unit, for being authenticated to the correspondent user device communicated with current user equipment, when recognizing
After card passes through, Xiang Suoshu Key generating unit sends the information that certification passes through;
The Key generating unit, for generating when receiving the information that the certification that the authentication unit is sent passes through
Random sequence obtains multicast key according to the random sequence;According to the multicast key, current user equipment and opposite end are determined
The encryption key and/or complete secrecy key when cast communication are carried out between user equipment, will deduce obtained encryption key and/or complete
Secrecy key is sent to the data protection unit;
The data protection unit, the encryption key deduced using the Key generating unit and/or complete guarantor
Communication data when carrying out cast communication between key pair current user equipment and correspondent user device carries out safeguard protection.
In conjunction with the 7th aspect, in the first possible implementation, the data protection unit is also used to:
Determine encryption key when carrying out cast communication between current user equipment and correspondent user device and/or complete secrecy
After key, using shared key or the public key of correspondent user device, the encryption key and/or complete secrecy key are encrypted;
Encrypted encryption key and/or complete secrecy key are sent to the correspondent user device, and indicate the opposite end
User equipment decrypts encrypted encryption key and/or complete secrecy key, and uses the encryption key after decryption and/or complete secrecy
Communication data when key pair carries out cast communication with current user equipment carries out safeguard protection.
Eighth aspect provides a kind of communication device, comprising: authentication unit, Key generating unit and data protection unit,
In,
The authentication unit, for being authenticated to the correspondent user device communicated with current user equipment, when recognizing
After card passes through, Xiang Suoshu Key generating unit sends the information that certification passes through;
The Key generating unit, after receiving the information that the certification that the authentication unit is sent passes through, described in acquisition
The communication key that correspondent user device is sent is deduced encryption key and/or complete secrecy key according to the communication key, will be deduced
The encryption key and/or complete secrecy key arrived is sent to the data protection unit, and the communication key is that the peer user is set
For according to the key of group mark ID and/or the first generating random number, described group of mark ID is current user equipment and peer user
The mark of affiliated communication set when equipment is communicated;
The data protection unit, the encryption key deduced using the Key generating unit and/or complete guarantor
Key carries out safeguard protection to communication data when carrying out unicast communication between current user equipment and correspondent user device.
The method and device securely communicated between user equipment provided in an embodiment of the present invention is carried out double based on certificate
To certification and arranging key, secret key deduction is carried out according to the first key generated after certificate verification, obtains encryption key and complete guarantor
Key, and safeguard protection is carried out using encryption key and complete guarantor's key pair communication data, it can lead to between user equipment
Whole communication datas in letter carry out safeguard protection, and then the communication between user equipment provides safety assurance.
Detailed description of the invention
Fig. 1 is authentication method flow diagram provided in an embodiment of the present invention;
Fig. 2 is the schematic diagram provided in an embodiment of the present invention based on IKE certification;
Fig. 3 is another schematic diagram provided in an embodiment of the present invention based on IKE certification;
Fig. 4 works for ProSe UE and utilizes multicast or broadcast communication schematic diagram in public safety field;
Fig. 5 A- Fig. 5 B is that schematic diagram is authenticated between UE and GO in the embodiment of the present invention;
Fig. 6 A- Fig. 6 B is that another schematic diagram is authenticated between UE and GO in the embodiment of the present invention;
Fig. 7 is communication apparatus structure schematic diagram provided in an embodiment of the present invention;
Fig. 8 is another communication apparatus structure schematic diagram provided in an embodiment of the present invention;
Fig. 9 is that communication controler provided in an embodiment of the present invention constitutes schematic diagram.
Specific embodiment
Following will be combined with the drawings in the embodiments of the present invention, and technical solution in the embodiment of the present invention carries out clear, complete
Site preparation description, it is clear that described embodiments are some of the embodiments of the present invention, instead of all the embodiments.Based on this hair
Embodiment in bright, every other implementation obtained by those of ordinary skill in the art without making creative efforts
Example, shall fall within the protection scope of the present invention.
Embodiment one
Between the UE provided as shown in Figure 1 for the embodiment of the present invention one under communication scenes, securely communicated between UE
Journey schematic diagram, comprising:
Certificate is respectively configured in S101: the one UE and the 2nd UE.
In the embodiment of the present invention, when the first UE and the 2nd UE carry out certificate configuration, the mode of being locally configured can be used, can also adopt
With by way of being connected to the network to certification authority certificate of registry.
S102: based on certificate verification and arranging key, the first key generated after certification is obtained.
Based on the certificate configured in S101, progress is two-way to be recognized the first UE and the 2nd UE communicated in the embodiment of the present invention
Card and arranging key, and the first key generated after certification is obtained respectively.
S103: secret key deduction is carried out according to the first key of acquisition, obtains encryption key and complete secrecy key.
S104: safeguard protection is carried out using encryption key obtained in S103 and complete guarantor's key pair communication data.
In the embodiment of the present invention, the two-way authentication between UE is carried out based on certificate, and according to the generated after certificate verification
One key carries out secret key deduction, obtains encryption key and complete secrecy key, utilizes encryption key and complete the first UE of guarantor's key pair and the
Communication data between two UE carries out safeguard protection, and the communication between UE in the communication scenes of direct communication between equipment provides peace
All risk insurance card.
It in the embodiment of the present invention, is illustrated by taking ProSe communication scenes as an example, when UE carries out certificate configuration, E- can be passed through
UTRAN (Evolved Universal Terrestrial Radio Access Network, evolved universal terrestrial wireless access
Net) network connect with certification authority, and the mode of being locally configured, certificate of registry can also be used in certificate of registry.And carry out certificate
When configuration, itself affiliated HPLMN (Home Public Land Mobile Network, home public land mobile network are configured
Network) certificate issued and it is other may carry out HPLMN root certificate belonging to the target UE of certificate verification with current UE, in turn
It realizes in the certificate verification in different security domains between UE.
Further, when ProSe UE is based on certificate progress two-way authentication in the embodiment of the present invention, IKE can be based at IP layers
(Internet Key Exchange, the Internet Key Exchange) carries out two-way authentication, negotiate to generate IP layers of key, as described
First key;Certificate can also be carried in wireless signaling, carries out two-way authentication, after certificate verification passes through, itself is deduced and is given birth to
At communication key as first key, or obtain communication key that correspondent user device is sent as first key, wherein
The input parameter that communication key is deduced includes group mark ID and/or random number, which, which is identified as between user equipment, carries out unicast
The mark of affiliated communication set when communication.
It is detailed that following embodiment of the present invention will combine specific application scenarios to carry out the authentication method that embodiment one is related to
Explanation.
Embodiment two
It is authenticated at IP layers based on IKE between UE in the embodiment of the present invention two, and UE passes through E-UTRAN network and card
The connection of book issuing organization, registers other PLMN root certificates belonging to the certificate and possible target UE of oneself affiliated HPLMN,
Therefore the ProSe communication scenes that the embodiment of the present invention two is suitable for having the network coverage, specific implementation process are as shown in Figure 2, comprising:
S201:UE1 and ProSe function (short distance business function entity), which are established, to be connected to the network and establishes safe pass
Connection.
Specifically, UE1 can preset manufacturer's certificate and ProSe function root before factory in the embodiment of the present invention
Certificate, UE1 access E-UTRAN network, obtain IP network connection, establish network connection with ProSe function and realize and two-way recognize
Card, and establish security association.
S202:UE1 obtains ProSe information, and registers each belonging to the certificate and target UE UE of HPLMN
PLMN root certificate list.
Specifically, UE1 obtains ProSe configuration information, certificate of the registration UE1 in HPLMN from ProSe function.Separately
Outside, ProSe function can be according to the PLMN id that UE1 is requested to ProSe function (or the certificate authority of other PLMN
Mechanism) PLMN belonging to each target UE of request root certificate, after ProSe function obtains response, provided to UE1 each
PLMN root certificate makes UE1 register through certificate belonging to ProSe function entity configuration target UE UE.
S203:UE2 uses method identical with UE1, by the certificate of ProSe function entity configuration HPLMN, with
And the root certificate list of each PLMN root certificate composition belonging to target UE UE.
S204:UE1 and UE2 carries out certificate verification based on IKE at IP layers, establishes security association tunnel Ipsec, and foundation
Ipsec generates IP layers of key Kd.
Specifically, UE1 and UE2 is based on IKE progress certificate verification at IP layers in the embodiment of the present invention, Ipsec, foundation are established
Ipsec generates IP layers of key Kd, obtains IP layers of key Kd as the first key for deducing encryption key and complete secrecy key.
S205a:UE1 carries out secret key deduction according to the IP layer key Kd that Ipsec is generated, and obtains encryption key Kenc and complete guarantor
Key Kint.
S205b:UE2 carries out secret key deduction according to the IP layer key Kd that Ipsec is generated, and obtains encryption key Kenc and complete guarantor
Key Kint.
Specifically, when carrying out encryption key Kenc and complete secrecy key Kint deduction, it can be according to the IP layer key of Ipsec generation
The IP address of the IP address and/or opposite end UE of Kd and current UE carries out secret key deduction, certainly can also be according to such as head IP
The other identifiers information such as information carries out secret key deduction.It, can such as when UE1 progress encryption key Kenc and complete secrecy key Kint deduction
Secret key deduction is carried out according to the IP address of the IP address of Ipsec IP layer the key Kd and UE1 generated and/or UE2.
It should be noted that S205a and S205b implementation procedure is in no particular order, it is also possible to carry out simultaneously, when deducing
To encryption key Kenc and complete secrecy key Kint, encryption key Kenc and complete secrecy key Kint can be sent to IP layers of peace below
Holostrome, the safe floor can be access side, Non-Access Stratum or other layers.
S206: using encryption key Kenc and complete secrecy key Kint obtained in S205a and S205b, to communication data into
Row safeguard protection.
Specifically, starting safeguard protection by activation negotiation algorithm between UE1 and UE2, utilizing S205a and S205b
Obtained in encryption key Kenc and complete secrecy key Kint, between UE1 and UE2 communication data carry out safeguard protection.
When UE1 and UE2 carries out certificate registration in the embodiment of the present invention, the certificate of HPLMN is not only registered, is also registered possible
The root certificate of PLMN belonging to target UE is allowed the UE in different security domains to carry out certificate verification, and is carried out based on IKE
Certificate verification carries out secret key deduction according to the IP layer key generated after certificate verification, obtains encryption key and complete secrecy key, utilizes
Encryption key and complete guarantor's key pair communication data carry out safeguard protection, can mention for the communication between UE in ProSe communication scenes
For safety assurance.
Embodiment three
Certificate verification is carried out based on IKE at IP layers between UE in the embodiment of the present invention three, and UE is by being locally configured mode,
Register the certificate of oneself affiliated HPLMN, and other PLMN root certificates belonging to possible target UE, therefore the embodiment of the present invention three
When middle certificate of registry, access network, therefore the authentication method that the embodiment of the present invention three provides are not needed, suitable for there is the network coverage
With the ProSe communication scenes of no network coverage, it is as shown in Figure 3 to implement process, comprising:
By the way that mode is locally configured, the ProSe of the HPLMN certificate and possible target UE of registering UE1 is answered S301a:UE1
With the root certificate of affiliated PLMN.
S301b:UE2 registers the ProSe application of the HPLMN certificate and possible target UE of UE2 by the way that mode is locally configured
The root certificate of affiliated PLMN.
Specifically, UE1 and UE2 can preset manufacturer's certificate and ProSe before factory in the embodiment of the present invention
Function root certificate.
S302:UE1 and UE2 carries out certificate verification based on IKE at IP layers, establishes security association tunnel Ipsec, and foundation
Ipsec generates IP layers of key Kd.
Specifically, UE1 and UE2 is based on IKE progress certificate verification at IP layers in the embodiment of the present invention, Ipsec, foundation are established
Ipsec generates IP layers of key Kd, obtains IP layers of key Kd as the first key for deducing encryption key and complete secrecy key.
S303a:UE1 carries out secret key deduction according to the IP layer key Kd that Ipsec is generated, and obtains encryption key Kenc and complete guarantor
Key Kint.
S303b:UE2 carries out secret key deduction according to the IP layer key Kd that Ipsec is generated, and obtains encryption key Kenc and complete guarantor
Key Kint.
It should be noted that S303a and S303b implementation procedure is in no particular order, it is also possible to carry out simultaneously, when deducing
To encryption key Kenc and complete secrecy key Kint, encryption key Kenc and complete secrecy key Kint can be sent to IP layers of peace below
Holostrome, the safe floor can be access side, Non-Access Stratum or other layers.
S304: using encryption key Kenc and complete secrecy key Kint obtained in S303a and S303b, to communication data into
Row safeguard protection.
Specifically, starting safeguard protection by activation negotiation algorithm between UE1 and UE2, utilizing S303a and S303b
Obtained in encryption key Kenc and complete secrecy key Kint, between UE1 and UE2 communication data carry out safeguard protection.
When UE1 and UE2 carries out certificate registration in the embodiment of the present invention, the certificate of HPLMN is not only registered, is also registered possible
The root certificate of PLMN belonging to target UE is allowed the UE in different security domains to carry out certificate verification, and is carried out based on IKE
Certificate verification carries out secret key deduction according to the IP layer key generated after certificate verification, obtains encryption key and complete secrecy key, utilizes
Encryption key and complete guarantor's key pair communication data carry out safeguard protection, can mention for the communication between UE in ProSe communication scenes
For safety assurance.
Further, for communication data progress safeguard protection when directly being communicated between UE, the embodiment of the present invention
The process for completing to generate key after UE is authenticated will be described in detail below.
The embodiment of the present invention is still illustrated so that UE work is under ProSe scene as an example, and ProSe UE works in public peace
Full communication field is usually communicated with multicast or broadcast mode between UE and GO (Group Owner, group leader), such as Fig. 4 institute
Show.After completing certification based on certificate or shared key between UE and GO, it is close that GO generates the encryption adapted under unicast communication scene
Key and/or complete secrecy key, and adapt to encryption key and/or complete secrecy key under cast communication scene.
Further, when UE and GO carries out unicast communication, when the communication set that GO institute's pipe belongs to is added in UE, GO can be the communication
Group generates a group and identifies ID, and when UE and GO carries out unicast communication in the embodiment of the present invention, GO completes pair being in communication with
After holding UE to authenticate, the first random number is generated, and lead to according to what group mark ID and the first generating random number GO and opposite end UE shared
Believe key, then according to the communication key, deduces encryption key when it carries out unicast communication between the UE of opposite end and/or complete guarantor
Key.After UE authenticates GO, obtain GO send communication key, and according to the communication key deduce generate encryption key and
Complete secrecy key, the communication key are GO according to group mark ID and/or the key of generating random number.UE and GO carries out cast communication
When, multicast key is obtained, which is that the random sequence generated according to GO generates, and it is logical to first verifying to can be GO
After the UE crossed, the key of generation is also possible to pre-set key, and according to the multicast key of the acquisition, it is determining in group
The encryption key and/or complete secrecy key when cast communication are carried out between all UE.
Further, it after GO is verified the UE being in communication in the embodiment of the present invention, is set using opposite end
Standby public key or the shared key negotiated, encrypt random number, communication key and multicast key, are then sent to UE,
By UE itself deduce generate both communication needed for encryption key and/or complete secrecy key, can also be used opposite equip. public key or
The shared key negotiated, encryption key and/or complete secrecy key to generation, as the encryption key communicated with GO and/
Or complete secrecy key.
The present invention below with reference to specific application scenarios to being authenticated between UE and GO after, generate the process of key into
Row is described in detail.
Example IV
The embodiment of the present invention four is worked with ProSe UE in public safety communication field, and GO sends root key to UE, by UE
Itself is illustrated for deducing encryption key and complete secrecy key, as shown in Figure 5A.
S401:UE and GO carries out certificate registration respectively.
It, can be according to actual network coverage situation, using local when UE and GO carries out certificate registration in the embodiment of the present invention
Configuration mode, or the certificate and possible target UE UE that pass through the affiliated HPLMN of ProSe function entity configuration
The root certificate list of affiliated each PLMN root certificate composition.
Specifically, the mode of being locally configured then can be used or pass through ProSe when UE is located in network coverage
Function entity configuration mode, certificate of registry then can only be by the sides of being locally configured when UE is located at outside network coverage
Formula carries out the registration of certificate.
S402:UE and GO carries out DH (Diffie-Hellman, diffie-hellman are graceful) exchange process, negotiates shared key
Kdh。
Specifically, S402 is optional step in the embodiment of the present invention, it is close using sharing of negotiating if performing S402
Key encrypts the certificate in certification authentication process.
The certificate of oneself is issued GO by S403:UE.
Specifically, the certificate of oneself is carried and is sent in wireless signaling request to GO by UE in the embodiment of the present invention, such as
Certificate can be placed on being directly connected in request of UE.
S404:GO is based on UE certificate and authenticates to UE, and deduces communication key Kgroup | unicast.
Specifically, then generating the first random number nonce, and according to group after GO is verified UE in the embodiment of the present invention
ID (Identity, mark) and nonce value deduce out the communication key Kgroup between UE and GO | unicast, using group ID and
Nonce value deduces communication key Kgroup | and unicast can be according to secret key deduction function Kgroup | unicast=KDF
(group ID, nonce), is deduced.
ID will be organized in the embodiment of the present invention as deduction communication key Kgroup | the input parameter of unicast can guarantee
Enrolled key is different every time by UE, and introduces nonce value as deduction communication key Kgroup | the input parameter of unicast, energy
The group communication key of each UE is different in guarantee group.
Further, in the embodiment of the present invention, after GO is verified UE, random sequence is produced, it is random according to this
Multicast key Kgroup in retrieval group | ubroadcast.
Further, in the embodiment of the present invention can use UE public key encryption nonce, Kgroup | unicast and/or
Kgroup|broadcast。
S405: GO certificate is sent to UE.
Further, if in the embodiment of the present invention in S404 use UE public key encryption nonce, Kgroup | unicast and/
Or Kgroup | broadcast, then by the nonce of encryption, Kgroup | and unicast and/or Kgroup | broadcast is sent to
UE。
S406:UE verifies GO certificate, and nonce, Kgroup are decrypted and obtained with private key | unicast and/or Kgroup |
Broadcast obtains the second random number nonce using GO public key encryption nonce.
Nonce is sent back to GO by S407:UE.
S407 is optional step in the embodiment of the present invention, encrypted random number is sent to opposite equip., it is therefore an objective to be
Make whether opposite equip. is tampered by the encrypted random number verification first key.
S408a:UE is according to communication key Kgroup | and unicast deduces encryption key Kenc and complete secrecy key Kint, is used in combination
The encryption key Kenc and complete secrecy key Kint deduced out protects the communication data between UE and GO.
If specifically, in the embodiment of the present invention in S404 GO using UE public key to communication key Kgroup | unicast into
Going encryption, and by encrypted communication key Kgroup in S405 | unicast is sent to UE, then UE is to encrypted logical
Believing key Kgroup | unicast is decrypted, and utilizes the communication key Kgroup after decryption | and unicast, which is deduced, carries out list with GO
Broadcast the encryption key and/or complete secrecy key when communication, using the encryption key and/or complete secrecy key of deduction, between GO into
Communication data when row unicast communication carries out safeguard protection.
S408b:GO is according to communication key Kgroup | and unicast deduces encryption key Kenc and complete secrecy key Kint, is used in combination
The encryption key Kenc and/or complete secrecy key Kint deduced out protects the communication data between UE and GO.
Further, if performing S407 in the embodiment of the present invention, whether GO verifies the second random number nonce with first
Random number nonce is identical, if the nonce that the GO is received is sent to the nonce of UE before being, shows in the communication process,
Key has not changed as, then using the encryption key and/or complete secrecy key generated in S408b, communicates between GO and UE
Communication data carry out safeguard protection.If the nonce that the GO is received is sent to the nonce of UE before not being, i.e., second is random
Number is inconsistent with the first random number, then the communication key Kgroup sent before showing | and unicast and nonce is to be modified,
Then GO regenerates communication key Kgroup | unicast, and execute S405 and following steps, that is, use communication key Kgroup |
Unicast deduces encryption key Kenc and complete secrecy key Kint that practical communication uses as root key again, to UE and GO it
Between communication data protected.
Further, after GO also produces encryption key and/or complete secrecy key in the embodiment of the present invention, by the encryption of generation
Key and/or complete secrecy key, are sent to UE after being encrypted using the public key of UE, instruction UE to the encryption key of the encryption and/
Or complete secrecy key is decrypted, using after decryption encryption key and/or complete key pair communication data between the two of protecting carry out
Safeguard protection, as shown in Figure 5 B, in the embodiment of the present invention after GO completes the verifying to UE, according to group mark ID and/or at random
Number generates communication key Kgroup | unicast, according to communication key Kgroup | unicast is deduced and is carried out unicast between UE
Encryption key and/or complete secrecy key when communication add the encryption key of generation and/or complete secrecy key using the public key of UE
It is close, and encrypted encryption key and/or complete secrecy key are sent to UE, encryption key and/or complete secrecy of the UE to the encryption
Key is decrypted, and using after decryption encryption key and/or complete secrecy key its communication data between GO encrypted.
Certificate is carried in wireless signaling request in the embodiment of the present invention, using the public key of opposite equip. to certificate verification
Process and key distribution procedure are encrypted, and when deducing communication key, are joined certificate group ID and nonce as input
It counts, the group communication key of each UE is different in guarantee group, the safety of communication data between different UE and GO, and passes through
Whether the verifying communication key of nonce is tampered, and further ensures the safety of communication data.
Embodiment five
The embodiment of the present invention five carries certificate in wireless signaling, carries out the certification of certificate, after certificate verification passes through, obtains
The communication key for taking opposite equip. to generate carries certificate in being wirelessly transferred signaling in the embodiment of the present invention as first key
Before the certification for carrying out certificate, further includes: carry out DH with opposite equip. and exchange, negotiate shared key;It is total to using what is negotiated
It enjoys cipher key pair certificate to be encrypted, to guarantee the safety of certificate.
The implementation process of the embodiment of the present invention is as shown in Figure 6A, comprising:
S501:UE and GO carries out certificate registration respectively.
It, can be according to actual network coverage situation, using local when UE and GO carries out certificate registration in the embodiment of the present invention
Configuration mode, or the certificate and possible target UE UE that pass through the affiliated HPLMN of ProSe function entity configuration
The root certificate list of affiliated each PLMN root certificate composition.
Specifically, the mode of being locally configured then can be used or pass through ProSe when UE is located in network coverage
Function entity configuration mode, certificate of registry then can only be by the sides of being locally configured when UE is located at outside network coverage
Formula carries out the registration of certificate.
S502:UE and GO carries out DH exchange process, negotiates shared key Kdh.
Specifically, UE and GO carries out DH exchange process in the embodiment of the present invention, shared key Kdh is negotiated, negotiation is utilized
Shared key out encrypts subsequent certification authentication process and key distribution procedure.
The certificate of oneself is issued GO by S503:UE.
Specifically, the certificate of oneself is carried and is sent in wireless signaling request to GO by UE in the embodiment of the present invention, such as
Certificate can be placed on being directly connected in request of UE.
S504:GO completes the certification to UE based on the UE certificate received, and deduces communication key Kgroup | unicast.
Specifically, GO generates random number nonce, and according to a group ID after GO is verified UE in the embodiment of the present invention
(Identity, identity) and nonce value deduce out the communication key Kgroup between UE and GO | unicast.Utilize a group ID
Communication key Kgroup is deduced with nonce value | unicast can be according to secret key deduction function Kgroup | unicast=KDF
(group ID, nonce), is deduced.
ID will be organized in the embodiment of the present invention as deduction communication key Kgroup | the input parameter of unicast can guarantee
Enrolled key is different every time by UE, and introduces nonce value as deduction communication key Kgroup | the input parameter of unicast, energy
The group communication key of each UE is different in guarantee group.
Further, in the embodiment of the present invention, when deducing out communication key Kgroup | after unicast, it can obtain in group
Broadcast key Kgroup | ubroadcast encrypts nonce, Kgroup with the shared key Kdh that deduces out in S502 |
Unicast and/or Kgroup | broadcast executes S505.
S505: by GO certificate, the nonce of encryption, Kgroup | unicast, Kgroup | broadcast is sent to UE.
S506:UE completes the verifying to GO based on GO certificate, obtains nonce, Kgroup | unicast, Kgroup |
Broadcast, and nonce is encrypted using shared key Kdh, obtain the second random number nonce.
Second random number nonce is sent back to GO by S507:UE.
S507 is optional step in the embodiment of the present invention, encrypted random number is sent to GO, in order to pass through GO
Whether encryption nonce is consistent with the first random number nonce value of UE is sent to before it, judges to protect communication data
Key whether be tampered.
S508a:UE is according to communication key Kgroup | and unicast deduces encryption key Kenc and/or complete secrecy key Kint,
And the communication data between UE and GO is protected with the encryption key Kenc and complete secrecy key Kint deduced out.
S508b:GO is according to communication key Kgroup | and unicast deduces encryption key Kenc and/or complete secrecy key Kint,
And the communication data between UE and GO is protected with the encryption key Kenc and complete secrecy key Kint deduced out.
Specifically, GO is according to communication key Kgroup in the embodiment of the present invention | unicast, which is deduced, carries out unicast communication when institute
Need encryption key Kenc and/or complete secrecy key Kint, and use multicast key Kgroup | broadcast deduction cast communication when
Required encryption key Kenc and/or complete secrecy key Kint.
Further, if performing S507 in the embodiment of the present invention, whether GO verifies the second random number nonce with first
Random number nonce is identical, if the second random number nonce that the GO is received is identical as the first random number, shows that second is random
Number nonce is sent to the first random number nonce of UE before being, then shows in the communication process, key has not changed as, then may be used
The encryption key and/or complete secrecy key generated using S508b, as the encryption key and complete secrecy communicated between GO and UE
Key carries out safeguard protection to the communication data communicated GO and UE.If the second random number nonce that the GO is received is not
It being sent to the first random number nonce of UE before, then the communication key Kgroup sent before showing | unicast and nonce are
It is modified, then GO regenerates communication key Kgroup | unicast, and execute S505 and following steps, i.e., it is close using communicating
Key Kgroup | unicast deduces encryption key Kenc and complete secrecy key Kint that practical communication uses as root key again,
Communication data between UE and GO is protected.
Further, after GO also produces encryption key and/or complete secrecy key in the embodiment of the present invention, by the encryption of generation
Key and/or complete secrecy key are sent to UE, encryption key of the instruction UE to the encryption after being encrypted using shared key Kdh
And/or complete secrecy key is decrypted, using after decryption encryption key and/or it is complete protect key pair communication data between the two into
Row safeguard protection, as shown in Figure 6B.
It is close according to group mark ID and/or generating random number communication after GO completes the verifying to UE in the embodiment of the present invention
Key Kgroup | unicast, according to communication key Kgroup | encryption when unicast communication is carried out between unicast, determining and UE
Key and/or complete secrecy key;The encryption key of generation and/or complete secrecy key are added using the shared key Kdh negotiated
Close, and encrypted encryption key and/or complete secrecy key are sent to UE, instruction UE is to the encryption key of the encryption and/or complete
Secrecy key is decrypted, and using after decryption encryption key and/or complete secrecy key its communication data between GO added
It is close.
Likewise, if cast communication is carried out in the embodiment of the present invention between GO and UE, after GO passes through UE certification, then root
Multicast key is obtained according to the random sequence of generation, and UE will be sent to after multicast key encryption, it is close to deduce encryption by UE oneself
Key and/or complete secrecy key, or generated and encryption key and/or complete guarantor needed for UE progress cast communication according to the multicast key
Key, and using the public key of shared key or UE to UE is sent to after encryption key and/or the encryption of complete secrecy key, UE is directly sharp
With after decryption encryption key and/or complete key pair its communication data for being communicated between GO protected carry out safeguard protection, can
Referring again to Fig. 5 A- Fig. 5 B and Fig. 6 A- Fig. 6 B.
Certificate is carried in wireless signaling request in the embodiment of the present invention, certificate is recognized using the shared key negotiated
Card process and key distribution procedure are encrypted, and when deducing communication key, are joined certificate group ID and nonce as input
Number guarantees the safety of communication data between different UE and GO, and pass through so that the group communication key of each UE is different in organizing
Whether the verifying communication key of nonce is tampered, and further ensures the safety of communication data.
Embodiment six
It is securely communicated between the user equipment that the embodiment of the present invention six is provided based on embodiment one to embodiment three
Method provides a kind of communication device, as shown in fig. 7, the communication device includes: configuration unit 601, authentication unit 602, key life
At unit 603 and data protection unit 604, wherein
Certificate is respectively configured to the first user equipment and second user equipment in configuration unit 601, and by the certificate of configuration to
Authentication unit 602 is transmitted;
Authentication unit 602 receives the certificate that configuration unit 601 is transmitted, and is based on certificate, to the first user equipment and second
User equipment carries out two-way authentication and arranging key, obtains the first key generated after certificate verification, and by the first of the generation
Key is sent to Key generating unit 603;
Key generating unit 603 receives the first key that authentication unit 602 is sent, and carries out key according to first key
It deduces, obtains encryption key and complete secrecy key, obtained encryption key and complete secrecy key are sent to data protection unit 604;
Data protection unit 604, the encryption key sent using Key generating unit 603 and the first user of complete guarantor's key pair
Communication data between equipment and second user equipment carries out safeguard protection.
Wherein, in the first possible implementation, configuration unit 601 are specifically used for:
Certificate is locally configured, or passes through network to certification authority certificate of registry;
Certificate includes: the certificate of the affiliated home public land mobile network network HPLMN of current user equipment, and is used with current
The root certificate of the affiliated home public land mobile network network HPLMN of each target UE that family equipment is authenticated.
Wherein, in the second possible implementation, authentication unit 602 are specifically used for:
It is based on the Internet Key Exchange IKE at IP layers according to certificate, carries out two-way authentication, negotiates to generate IP layers of key, make
For first key.
Wherein, in the third possible implementation, authentication unit 602 are specifically used for:
Certificate is carried and is sent in wireless transmission signaling to correspondent user device, and carries out the certification of certificate;
After certificate verification passes through, itself is deduced to the communication key generated as first key, or obtain opposite end and use
The communication key of family equipment transmission is as first key, and the input parameter that communication key is deduced is including group mark ID and/or at random
Number, the mark of group mark ID affiliated communication set when being communicated between user equipment.
Wherein, in the fourth possible implementation, authentication unit 602 are also used to:
Certificate is carried before being sent in wireless transmission signaling to correspondent user device, carries out enlightening with correspondent user device
Phenanthrene-Herman DH exchange, negotiates shared key;
It is encrypted using mark of the shared key to certificate or certificate.
Wherein, in a fifth possible implementation, Key generating unit 603 are specifically used for:
According to the IP address of the IP address and/or correspondent user device of first key and current user equipment, carry out close
Key is deduced, and encryption key and complete secrecy key are obtained.
When user equipment carries out certificate registration in the embodiment of the present invention, the certificate of HPLMN is not only registered, is also registered possible
The root certificate of PLMN belonging to target device allows the user equipment in different security domains to carry out certificate verification, and base
Certificate verification is carried out in IKE, secret key deduction is carried out according to the IP layer key generated after certificate verification, obtains encryption key and complete guarantor
Key carries out safeguard protection using encryption key and complete guarantor's key pair communication data, can be communicated between user equipment
Safety assurance is provided.
Embodiment seven
The method securely communicated between four user equipmenies being related to embodiment five in conjunction with the embodiments, the present invention are implemented
Example provides a kind of communication device, as shown in figure 8, the communication device includes authentication unit 701, Key generating unit 702 and data
Protection location 703, wherein
Authentication unit 701 works as certification for authenticating to the correspondent user device communicated with current user equipment
By rear, the information that certification passes through is sent to Key generating unit 702;
Key generating unit 702, when receive authentication unit 701 transmission certification pass through information when, generation first with
Machine number, according to group mark ID and a first generating random number communication key, group mark ID is that current user equipment is set with peer user
For the mark of communication set affiliated when being communicated;And according to communication key, deduce current user equipment and correspondent user device it
Between encryption key and/or complete secrecy key when carrying out unicast communication, obtained encryption key and/or complete secrecy key will be deduced to number
It is sent according to protection location 703;
Data protection unit 703 deduces obtained encryption key and/or complete secrecy key using Key generating unit 702, right
Communication data when carrying out unicast communication between current user equipment and correspondent user device carries out safeguard protection.
Wherein, in the first possible implementation, data protection unit 703604 are also used to:
Encryption key and/or complete secrecy key are being utilized, to carrying out unicast between current user equipment and correspondent user device
Before communication data when communication carries out safeguard protection, using the public key of correspondent user device, the first random number is encrypted;
Encrypted first random number is sent to correspondent user device, and receives correspondent user device and sends second at random
Number, the second random number be correspondent user device to encrypted first random nnrber decryption after, and using current user equipment public affairs
Key, the random number of re-encrypted;
Determine that the second random number is identical as the first random number.
Wherein, in the second possible implementation, data protection unit 703 are also used to:
Encryption key and/or complete secrecy key are being utilized, to carrying out unicast between current user equipment and correspondent user device
Before communication data when communication carries out safeguard protection, using shared key, the first random number is encrypted;
Encrypted first random number is sent to correspondent user device, correspondent user device is received and sends second at random
Number, the second random number be correspondent user device to after encrypted first random nnrber decryption and utilize shared key, re-encrypted
Random number;
Determine that the second random number is identical as the first random number.
Wherein, in the third possible implementation, Key generating unit 702 are also used to: according to a group mark ID and the
After one generating random number communication key, using shared key or the public key of correspondent user device, communication key is encrypted;
Encrypted communication key is sent to correspondent user device, indicates that correspondent user device according to encrypted communication key, pushes away
Drill the encryption key and/or complete secrecy key when carrying out unicast communication between current user equipment;
Data protection unit 703, is also used to, the encryption key deduced using correspondent user device and/or complete secrecy
Key carries out safeguard protection to communication data when carrying out unicast communication between current user equipment.
Wherein, in the fourth possible implementation, data protection unit 703 are also used to:
Encryption key and/or complete secrecy key are being utilized, to carrying out unicast between current user equipment and correspondent user device
Before communication data when communication carries out safeguard protection, using shared key or the public key of correspondent user device, to encryption key
And/or complete secrecy key is encrypted;
Encrypted encryption key and/or complete secrecy key are sent to correspondent user device, indicate correspondent user device pair
Encrypted encryption key and/or complete secrecy key are decrypted, and using decryption after encryption key and/or complete guarantors key pair and
Communication data when carrying out unicast communication between current user equipment carries out safeguard protection.
On the other hand the embodiment of the present invention also provides a kind of communication device, including authentication unit 701, Key generating unit
702 and data protection unit 703, it can be referring again to Fig. 8, wherein
Authentication unit 701 works as certification for authenticating to the correspondent user device communicated with current user equipment
By rear, the information that certification passes through is sent to Key generating unit 702;
Key generating unit 702, for when receive authentication unit 701 transmission certification pass through information when, generation with
Machine sequence obtains multicast key according to random sequence;According to multicast key, determine current user equipment and correspondent user device it
Between encryption key and/or complete secrecy key when carrying out cast communication, obtained encryption key and/or complete secrecy key will be deduced to number
It is sent according to protection location 703;
Data protection unit 703 deduces obtained encryption key and/or complete guarantor's key pair using Key generating unit 702
Communication data when carrying out cast communication between current user equipment and correspondent user device carries out safeguard protection.
Wherein, in the first possible implementation, data protection unit 703 are also used to:
Determine encryption key when carrying out cast communication between current user equipment and correspondent user device and/or complete secrecy
After key, using shared key or the public key of correspondent user device, encryption key and/or complete secrecy key are encrypted;
Encrypted encryption key and/or complete secrecy key are sent to correspondent user device, and indicate correspondent user device
Encrypted encryption key and/or complete secrecy key are decrypted, and using after decryption encryption key and/or complete guarantor's key pair with work as
Communication data when preceding user equipment carries out cast communication carries out safeguard protection.
The embodiment of the present invention also provides a kind of communication device, comprising: authentication unit 701, Key generating unit 702 and data
Protection location 703, can be referring again to Fig. 8, wherein
Authentication unit 701 works as certification for authenticating to the correspondent user device communicated with current user equipment
By rear, the information that certification passes through is sent to Key generating unit 702;
Key generating unit 702 obtains opposite end and uses after the information that the certification for receiving the transmission of authentication unit 701 passes through
The communication key that family equipment is sent deduces encryption key and/or complete secrecy key according to communication key, and the encryption that deduction is obtained is close
Key and/or complete secrecy key are sent to data protection unit 703, communication key be correspondent user device according to group mark ID and/or
The key of first generating random number, group mark ID are affiliated communication set when current user equipment is communicated with correspondent user device
Mark;
Data protection unit 703 deduces obtained encryption key and/or complete secrecy key using Key generating unit 702, right
Communication data when carrying out unicast communication between current user equipment and correspondent user device carries out safeguard protection.
In the embodiment of the present invention by certificate carry wireless signaling request in, using opposite equip. public key or negotiate
Shared key, certification authentication process and key distribution procedure are encrypted, and when deducing communication key, by certificate group
ID and nonce is as parameter is inputted, and the group communication key of each UE is different in guarantee group, communication data between different UE and GO
Safety, and whether be tampered by the verifying communication key of nonce, further ensure the safety of communication data.
It should be noted that the communication device that the embodiment of the present invention six and embodiment seven provide, can be independent component,
It is also possible to be integrated in other component, such as above-mentioned communication device provided in an embodiment of the present invention can be existing communication network
In user equipment (UE), be also possible to be integrated in the new component in user equipment (UE).
It should be noted that modules/unit function of the communication device in the embodiment of the present invention is realized and is handed over
Mutual mode can be with further reference to the description of related method embodiment.
Embodiment eight
The method and dress securely communicated between the user equipment that the embodiment of the present invention eight is related to based on the above embodiment
It sets, a kind of communication controler is also provided, as shown in figure 9, the communication controler includes transceiver 801, memory 802 and processor
803, wherein
Transceiver 801, for receiving the instruction information of user equipment transmission securely communicated, and by the instruction information
It is sent to processor 803;
Memory 802, for storing application program;
Processor 803, the application program for calling memory 802 to store, performs the following operations:
After the instruction information for receiving user equipment transmission, card is respectively configured to the first user equipment and second user equipment
Book, the certificate based on configuration carry out two-way authentication and arranging key to the first user equipment and second user equipment, obtain certificate
The first key generated after certification;Secret key deduction is carried out according to first key, obtains encryption key and complete secrecy key;Utilize encryption
Key and the complete communication data protected between the first user equipment of key pair and second user equipment carry out safeguard protection.
Further, processor 803 is also used to: certificate is locally configured, or is registered by network to certification authority
Certificate;The certificate of configuration includes: the certificate of the affiliated home public land mobile network network HPLMN of current user equipment, and with work as
The root certificate of the affiliated home public land mobile network network HPLMN of each target UE that preceding user equipment is authenticated.
Further, processor 803 are also used to: being carried out to the correspondent user device communicated with current user equipment
Certification;After certification passes through, the first random number is generated, according to group mark ID and a first generating random number communication key;According to logical
Believe key, deduces encryption key when carrying out unicast communication between current user equipment and correspondent user device and/or complete secrecy
Key, and encryption key and/or complete secrecy key are utilized, when to carrying out unicast communication between current user equipment and correspondent user device
Communication data carry out safeguard protection.
Further, processor 803 are also used to: being carried out to the correspondent user device communicated with current user equipment
Certification;After certification passes through, random sequence is generated, multicast key is obtained according to random sequence;According to multicast key, determine current
The encryption key and/or complete secrecy key when cast communication are carried out between user equipment and correspondent user device, and close using encrypting
Key and/or the complete communication data protected between key pair current user equipment and correspondent user device when carrying out cast communication are pacified
Full guard.
Further, processor 803 are also used to: to the correspondent user device communicated with current user equipment into
Row certification;After certification passes through, obtain correspondent user device send communication key, communication key be correspondent user device according to
The key of group mark ID and/or the first generating random number, group mark ID are that current user equipment is led to correspondent user device
The mark of affiliated communication set when letter;Deduce encryption key and/or complete secrecy key according to communication key, using encryption key and/or
Complete secrecy key carries out safe guarantor to communication data when carrying out unicast communication between current user equipment and correspondent user device
Shield.
Communication controler provided in an embodiment of the present invention, processor is to processing is securely communicated between user equipment when,
Safety certification is carried out based on certificate, and not only registers HPLMN certificate belonging to current user equipment when certificate of registry, is also registered
The root certificate of HPLMN described in target UE can be realized the certification of user equipment between different security domains.
Further, it when processor is to processing is securely communicated in the embodiment of the present invention between user equipment, is generating
When key, communication key and multicast key are generated, communication key guarantees enrolled use every time according to group mark and a generating random number
The communication key that family equipment generates is all different, is further ensured that the safety of communication.
It should be understood by those skilled in the art that, the embodiment of the present invention can provide as method, system or computer program
Product.Therefore, complete hardware embodiment, complete software embodiment or reality combining software and hardware aspects can be used in the present invention
Apply the form of example.Moreover, it wherein includes the computer of computer usable program code that the present invention, which can be used in one or more,
The computer program implemented in usable storage medium (including but not limited to magnetic disk storage, CD-ROM, optical memory etc.) produces
The form of product.
The present invention be referring to according to the method for the embodiment of the present invention, the process of equipment (system) and computer program product
Figure and/or block diagram describe.It should be understood that every one stream in flowchart and/or the block diagram can be realized by computer program instructions
The combination of process and/or box in journey and/or box and flowchart and/or the block diagram.It can provide these computer programs
Instruct the processor of general purpose computer, special purpose computer, Embedded Processor or other programmable data processing devices to produce
A raw machine, so that being generated by the instruction that computer or the processor of other programmable data processing devices execute for real
The device for the function of being specified in present one or more flows of the flowchart and/or one or more blocks of the block diagram.
These computer program instructions, which may also be stored in, is able to guide computer or other programmable data processing devices with spy
Determine in the computer-readable memory that mode works, so that it includes referring to that instruction stored in the computer readable memory, which generates,
Enable the manufacture of device, the command device realize in one box of one or more flows of the flowchart and/or block diagram or
The function of being specified in multiple boxes.
These computer program instructions also can be loaded onto a computer or other programmable data processing device, so that counting
Series of operation steps are executed on calculation machine or other programmable devices to generate computer implemented processing, thus in computer or
The instruction executed on other programmable devices is provided for realizing in one or more flows of the flowchart and/or block diagram one
The step of function of being specified in a box or multiple boxes.
Although preferred embodiments of the present invention have been described, it is created once a person skilled in the art knows basic
Property concept, then additional changes and modifications may be made to these embodiments.So it includes excellent that the following claims are intended to be interpreted as
It selects embodiment and falls into all change and modification of the scope of the invention.
Obviously, those skilled in the art can carry out various modification and variations without departing from this hair to the embodiment of the present invention
The spirit and scope of bright embodiment.In this way, if these modifications and variations of the embodiment of the present invention belong to the claims in the present invention
And its within the scope of equivalent technologies, then the present invention is also intended to include these modifications and variations.
Claims (28)
1. a kind of method securely communicated between user equipment characterized by comprising
Certificate is respectively configured in first user equipment and second user equipment;
First user equipment and the second user equipment are based on the certificate, carry out two-way authentication and arranging key, obtain
Take the first key generated after certificate verification;
First user equipment and the second user equipment carry out secret key deduction according to the first key, are encrypted
Key and complete secrecy key;
Using described in the encryption key and complete guarantor's key pair between the first user equipment and the second user equipment
Communication data carries out safeguard protection.
2. the method as described in claim 1, which is characterized in that configuration certificate, comprising:
Certificate is locally configured, or passes through network to certification authority certificate of registry;
The certificate includes: the certificate of the affiliated home public land mobile network network HPLMN of current user equipment, and is used with current
The root certificate of the affiliated home public land mobile network network HPLMN of each target UE that family equipment is authenticated.
3. method according to claim 1 or 2, which is characterized in that be based on the certificate, carry out two-way authentication and negotiate close
Key obtains the first key generated after certificate verification, comprising:
It is based on the Internet Key Exchange IKE at IP layers according to the certificate, carries out two-way authentication, negotiates to generate IP layers of key, make
For the first key.
4. method according to claim 1 or 2, which is characterized in that be based on the certificate, carry out two-way authentication and negotiate close
Key obtains the first key generated after certificate verification, comprising:
Certificate is carried and is sent in wireless transmission signaling to correspondent user device, and carries out the certification of certificate;
After certificate verification passes through, itself is deduced to the communication key generated as the first key, or obtain opposite end and use
For the communication key that family equipment is sent as the first key, the input parameter that the communication key is deduced includes group mark ID
And/or random number, the mark of described group of mark ID affiliated communication set when being communicated between user equipment.
5. method as claimed in claim 4, which is characterized in that carry certificate and set in wireless transmission signaling to peer user
Before preparation is sent, further includes:
The graceful DH of diffie-hellman is carried out with correspondent user device to exchange, and negotiates shared key;
It is encrypted using mark of the shared key to the certificate or the certificate.
6. the method as described in claim 1, which is characterized in that it is described that secret key deduction is carried out according to the first key, it obtains
Encryption key and complete secrecy key, comprising:
According to the IP address of the IP address and/or correspondent user device of the first key and current user equipment, carry out close
Key is deduced, and encryption key and complete secrecy key are obtained.
7. a kind of method securely communicated between user equipment characterized by comprising
The correspondent user device communicated with current user equipment is authenticated;
After certification passes through, the first random number is generated, it is described according to group mark ID and the first generating random number communication key
Group mark ID is the mark of affiliated communication set when current user equipment is communicated with correspondent user device;
According to the communication key, the encryption deduced when carrying out unicast communication between current user equipment and correspondent user device is close
Key and/or complete secrecy key, and the encryption key and/or complete secrecy key are utilized, to current user equipment and correspondent user device
Between carry out unicast communication when communication data carry out safeguard protection.
8. the method for claim 7, which is characterized in that utilize the encryption key and/or complete secrecy key, use current
Before communication data when carrying out unicast communication between family equipment and correspondent user device carries out safeguard protection, this method is also wrapped
It includes:
Using the public key of correspondent user device, first random number is encrypted;
Encrypted first random number is sent to the correspondent user device, and receives the correspondent user device and sends
Second random number, second random number be the correspondent user device to encrypted first random nnrber decryption after, and utilize
The public key of current user equipment, the random number of re-encrypted;
Determine that second random number is identical as first random number.
9. the method for claim 7, which is characterized in that utilize the encryption key and/or complete secrecy key, use current
Before communication data when carrying out unicast communication between family equipment and correspondent user device carries out safeguard protection, this method is also wrapped
It includes:
Using shared key, first random number is encrypted;
Encrypted first random number is sent to the correspondent user device, the correspondent user device is received and sends the
Two random numbers, second random number are the correspondent user device to after encrypted first random nnrber decryption and using shared
Key, the random number of re-encrypted;
Determine that second random number is identical as first random number.
10. such as the described in any item methods of claim 7-9, which is characterized in that according to group mark ID and first random number
After generating communication key, this method further include:
Using shared key or the public key of correspondent user device, the communication key is encrypted;
Encrypted communication key is sent to the correspondent user device, indicates the correspondent user device according to encrypted
Communication key carries out encryption key and/or complete secrecy key when unicast communication, and utilizes and push away between deduction and current user equipment
The encryption key and/or complete secrecy key drilled pacify communication data when carrying out unicast communication between current user equipment
Full guard.
11. such as the described in any item methods of claim 7-9, which is characterized in that utilize the encryption key and/or complete secrecy
Key, before carrying out safeguard protection to communication data when carrying out unicast communication between current user equipment and correspondent user device,
This method further include:
Using shared key or the public key of correspondent user device, the encryption key and/or complete secrecy key are encrypted;
Encrypted encryption key and/or complete secrecy key are sent to the correspondent user device, indicate that the peer user is set
It is standby that the encrypted encryption key and/or complete secrecy key are decrypted, and use the encryption key after decryption and/or complete guarantor
Communication data when carrying out unicast communication between key pair and current user equipment carries out safeguard protection.
12. a kind of method securely communicated between user equipment characterized by comprising
The correspondent user device communicated with current user equipment is authenticated;
After certification passes through, random sequence is generated, multicast key is obtained according to the random sequence;
According to the multicast key, determine that encryption when carrying out cast communication between current user equipment and correspondent user device is close
Key and/or complete secrecy key, and using the encryption key and/or complete guarantors key pair current user equipment and correspondent user device it
Between carry out cast communication when communication data carry out safeguard protection.
13. method as claimed in claim 12, which is characterized in that determine between current user equipment and correspondent user device into
After encryption key and/or complete secrecy key when row cast communication, this method further include:
Using shared key or the public key of correspondent user device, the encryption key and/or complete secrecy key are encrypted;
Encrypted encryption key and/or complete secrecy key are sent to the correspondent user device, and indicate the peer user
Equipment decrypts encrypted encryption key and/or complete secrecy key, and uses the encryption key after decryption and/or complete guarantor's key pair
Communication data when carrying out cast communication with current user equipment carries out safeguard protection.
14. a kind of method securely communicated between user equipment characterized by comprising
The correspondent user device communicated with current user equipment is authenticated;
After certification passes through, the communication key that the correspondent user device is sent is obtained, the communication key is opposite end use
Family equipment is current user equipment and opposite end according to group mark ID and/or the key of the first generating random number, described group of mark ID
The mark of affiliated communication set when user equipment is communicated;
Encryption key and/or complete secrecy key are deduced according to the communication key, using the encryption key and/or complete secrecy key,
Safeguard protection is carried out to communication data when carrying out unicast communication between current user equipment and correspondent user device.
15. a kind of secure communication device, which is characterized in that protected including configuration unit, authentication unit, Key generating unit and data
Protect unit, wherein
Certificate is respectively configured to the first user equipment and second user equipment in the configuration unit, and by the certificate of configuration to institute
State authentication unit transmission;
The authentication unit, receives the certificate of the configuration unit transmission, and is based on the certificate, to first user equipment
Two-way authentication and arranging key are carried out with the second user equipment, obtains the first key generated after certificate verification, and should
The first key of generation is sent to the Key generating unit;
The Key generating unit receives the first key that authentication unit is sent, and carries out key according to the first key and push away
It drills, obtains encryption key and complete secrecy key, obtained encryption key and complete secrecy key are sent to the data protection unit;
The data protection unit, the described in the encryption key sent using Key generating unit and complete guarantor's key pair
Communication data between one user equipment and the second user equipment carries out safeguard protection.
16. device as claimed in claim 15, which is characterized in that the configuration unit is specifically used for:
Certificate is locally configured, or passes through network to certification authority certificate of registry;
The certificate includes: the certificate of the affiliated home public land mobile network network HPLMN of current user equipment, and is used with current
The root certificate of the affiliated home public land mobile network network HPLMN of each target UE that family equipment is authenticated.
17. the device as described in claim 15 or 16, which is characterized in that the authentication unit is specifically used for:
It is based on the Internet Key Exchange IKE at IP layers according to the certificate, carries out two-way authentication, negotiates to generate IP layers of key, make
For the first key.
18. the device as described in claim 15 or 16, which is characterized in that the authentication unit is specifically used for:
Certificate is carried and is sent in wireless transmission signaling to correspondent user device, and carries out the certification of certificate;
After certificate verification passes through, itself is deduced to the communication key generated as the first key, or obtain opposite end and use
For the communication key that family equipment is sent as the first key, the input parameter that the communication key is deduced includes group mark ID
And/or random number, the mark of described group of mark ID affiliated communication set when being communicated between user equipment.
19. device as claimed in claim 18, which is characterized in that the authentication unit is also used to:
Certificate is carried before being sent in wireless transmission signaling to correspondent user device, carries out diffie-with correspondent user device
Herman DH exchange, negotiates shared key;
It is encrypted using mark of the shared key to the certificate or the certificate.
20. device as claimed in claim 15, which is characterized in that the Key generating unit is specifically used for:
According to the IP address of the IP address and/or correspondent user device of the first key and current user equipment, carry out close
Key is deduced, and encryption key and complete secrecy key are obtained.
21. a kind of communication device, which is characterized in that including authentication unit, Key generating unit and data protection unit, wherein
The authentication unit, for being authenticated to the correspondent user device communicated with current user equipment, when certification is logical
Later, Xiang Suoshu Key generating unit sends the information that certification passes through;
It is random to generate first when receiving the information that the certification that the authentication unit is sent passes through for the Key generating unit
Number, according to group mark ID and the first generating random number communication key, described group of mark ID is current user equipment and opposite end
The mark of affiliated communication set when user equipment is communicated;And according to the communication key, current user equipment and opposite end are deduced
The encryption key and/or complete secrecy key when unicast communication are carried out between user equipment, will deduce obtained encryption key and/or complete
Secrecy key is sent to the data protection unit;
The data protection unit, the encryption key deduced using the Key generating unit and/or complete secrecy key,
Safeguard protection is carried out to communication data when carrying out unicast communication between current user equipment and correspondent user device.
22. device as claimed in claim 21, which is characterized in that the data protection unit is also used to:
The encryption key and/or complete secrecy key are being utilized, to carrying out unicast between current user equipment and correspondent user device
Before communication data when communication carries out safeguard protection, using the public key of correspondent user device, first random number is carried out
Encryption;
Encrypted first random number is sent to the correspondent user device, and receives the correspondent user device and sends
Second random number, second random number be the correspondent user device to encrypted first random nnrber decryption after, and utilize
The public key of current user equipment, the random number of re-encrypted;
Determine that second random number is identical as first random number.
23. device as claimed in claim 21, which is characterized in that the data protection unit is also used to:
The encryption key and/or complete secrecy key are being utilized, to carrying out unicast between current user equipment and correspondent user device
Before communication data when communication carries out safeguard protection, using shared key, first random number is encrypted;
Encrypted first random number is sent to the correspondent user device, the correspondent user device is received and sends the
Two random numbers, second random number are the correspondent user device to after encrypted first random nnrber decryption and using shared
Key, the random number of re-encrypted;
Determine that second random number is identical as first random number.
24. such as the described in any item devices of claim 21-23, which is characterized in that the Key generating unit is also used to: root
After group mark ID and the first generating random number communication key, using shared key or the public key of correspondent user device,
The communication key is encrypted;Encrypted communication key is sent to the correspondent user device, indicates the opposite end
User equipment deduces encryption key when carrying out unicast communication between current user equipment according to encrypted communication key
And/or complete secrecy key;
The data protection unit, is also used to, the encryption key and/or complete secrecy key deduced using correspondent user device,
Safeguard protection is carried out to communication data when carrying out unicast communication between current user equipment.
25. such as the described in any item devices of claim 21-23, which is characterized in that the data protection unit is also used to:
The encryption key and/or complete secrecy key are being utilized, to carrying out unicast between current user equipment and correspondent user device
Before communication data when communication carries out safeguard protection, using shared key or the public key of correspondent user device, to the encryption
Key and/or complete secrecy key are encrypted;
Encrypted encryption key and/or complete secrecy key are sent to the correspondent user device, indicate that the peer user is set
It is standby that the encrypted encryption key and/or complete secrecy key are decrypted, and use the encryption key after decryption and/or complete guarantor
Communication data when carrying out unicast communication between key pair and current user equipment carries out safeguard protection.
26. a kind of communication device, which is characterized in that including authentication unit, Key generating unit and data protection unit, wherein
The authentication unit, for being authenticated to the correspondent user device communicated with current user equipment, when certification is logical
Later, Xiang Suoshu Key generating unit sends the information that certification passes through;
The Key generating unit, it is random for generating when receiving the information that the certification that the authentication unit is sent passes through
Sequence obtains multicast key according to the random sequence;According to the multicast key, current user equipment and peer user are determined
The encryption key and/or complete secrecy key when cast communication are carried out between equipment, will deduce obtained encryption key and/or complete secrecy
Key is sent to the data protection unit;
The data protection unit, the encryption key deduced using the Key generating unit and/or complete secrecy key
Safeguard protection is carried out to communication data when carrying out cast communication between current user equipment and correspondent user device.
27. device as claimed in claim 25, which is characterized in that the data protection unit is also used to:
Determine between current user equipment and correspondent user device carry out cast communication when encryption key and/or complete secrecy key it
Afterwards, using shared key or the public key of correspondent user device, the encryption key and/or complete secrecy key are encrypted;
Encrypted encryption key and/or complete secrecy key are sent to the correspondent user device, and indicate the peer user
Equipment decrypts encrypted encryption key and/or complete secrecy key, and uses the encryption key after decryption and/or complete guarantor's key pair
Communication data when carrying out cast communication with current user equipment carries out safeguard protection.
28. a kind of communication device characterized by comprising authentication unit, Key generating unit and data protection unit, wherein
The authentication unit, for being authenticated to the correspondent user device communicated with current user equipment, when certification is logical
Later, Xiang Suoshu Key generating unit sends the information that certification passes through;
The Key generating unit obtains the opposite end after receiving the information that the certification that the authentication unit is sent passes through
The communication key that user equipment is sent deduces encryption key and/or complete secrecy key according to the communication key, deduction is obtained
Encryption key and/or complete secrecy key are sent to the data protection unit, and the communication key is the correspondent user device root
According to group mark ID and/or the key of the first generating random number, described group of mark ID is current user equipment and correspondent user device
The mark of affiliated communication set when being communicated;
The data protection unit, the encryption key deduced using the Key generating unit and/or complete secrecy key,
Safeguard protection is carried out to communication data when carrying out unicast communication between current user equipment and correspondent user device.
Priority Applications (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
CN201910256482.XA CN109922080A (en) | 2013-10-23 | 2013-10-23 | The method and device securely communicated between user equipment |
Applications Claiming Priority (3)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
PCT/CN2013/085821 WO2015058378A1 (en) | 2013-10-23 | 2013-10-23 | Method and device for secure communication between user equipment |
CN201380003389.9A CN104769982B (en) | 2013-10-23 | 2013-10-23 | The method and device securely communicated between user equipment |
CN201910256482.XA CN109922080A (en) | 2013-10-23 | 2013-10-23 | The method and device securely communicated between user equipment |
Related Parent Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
CN201380003389.9A Division CN104769982B (en) | 2013-10-23 | 2013-10-23 | The method and device securely communicated between user equipment |
Publications (1)
Publication Number | Publication Date |
---|---|
CN109922080A true CN109922080A (en) | 2019-06-21 |
Family
ID=52992141
Family Applications (2)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
CN201380003389.9A Active CN104769982B (en) | 2013-10-23 | 2013-10-23 | The method and device securely communicated between user equipment |
CN201910256482.XA Pending CN109922080A (en) | 2013-10-23 | 2013-10-23 | The method and device securely communicated between user equipment |
Family Applications Before (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
CN201380003389.9A Active CN104769982B (en) | 2013-10-23 | 2013-10-23 | The method and device securely communicated between user equipment |
Country Status (2)
Country | Link |
---|---|
CN (2) | CN104769982B (en) |
WO (1) | WO2015058378A1 (en) |
Cited By (4)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN110505059A (en) * | 2019-08-23 | 2019-11-26 | 深圳成谷科技有限公司 | A kind of direct key generation method and device for PC5 interface point to point link |
CN111010412A (en) * | 2020-03-11 | 2020-04-14 | 北京信安世纪科技股份有限公司 | Communication method, communication apparatus, roadside device, and storage medium |
TWI779711B (en) * | 2020-10-26 | 2022-10-01 | 美商戴爾產品有限公司 | Distributed secure communication system, information handling system and method for providing distributed secure communications |
CN115885496A (en) * | 2020-08-28 | 2023-03-31 | 华为技术有限公司 | Communication method and related device |
Families Citing this family (7)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN104769982B (en) * | 2013-10-23 | 2019-05-03 | 华为技术有限公司 | The method and device securely communicated between user equipment |
CN110896683A (en) * | 2017-06-01 | 2020-03-20 | 华为国际有限公司 | Data protection method, device and system |
CN109120649B (en) * | 2018-11-02 | 2020-11-06 | 美的集团股份有限公司 | Key agreement method, cloud server, device, storage medium and system |
US11234125B2 (en) * | 2019-08-09 | 2022-01-25 | Rosemount Inc. | Two-factor authentication for wireless field devices |
CN112449323B (en) * | 2019-08-14 | 2022-04-05 | 华为技术有限公司 | Communication method, device and system |
CN113132323B (en) * | 2019-12-31 | 2022-11-18 | 华为技术有限公司 | Communication method and device |
WO2023078666A1 (en) * | 2021-11-08 | 2023-05-11 | Telefonaktiebolaget Lm Ericsson (Publ) | Authentication for a proximity-based service in a wireless communication network |
Citations (4)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN101005359A (en) * | 2006-01-18 | 2007-07-25 | 华为技术有限公司 | Method and device for realizing safety communication between terminal devices |
CN101286843A (en) * | 2008-06-03 | 2008-10-15 | 江西省电力信息通讯有限公司 | Single-point login method under point-to-point model |
CN101640886A (en) * | 2008-07-29 | 2010-02-03 | 上海华为技术有限公司 | Authentication method, re-authentication method and communication device |
CN104769982A (en) * | 2013-10-23 | 2015-07-08 | 华为技术有限公司 | Method and device for secure communication between user equipment |
Family Cites Families (8)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN101056456A (en) * | 2006-04-10 | 2007-10-17 | 华为技术有限公司 | Method and secure system for authenticating the radio evolution network |
CN102325321B (en) * | 2006-06-23 | 2014-12-17 | 华为技术有限公司 | Secret key obtaining method in evolution wireless communication network and user equipment |
CN100558035C (en) * | 2006-08-03 | 2009-11-04 | 西安电子科技大学 | A kind of mutual authentication method and system |
CN101237444B (en) * | 2007-01-31 | 2013-04-17 | 华为技术有限公司 | Secret key processing method, system and device |
CA2621147C (en) * | 2008-02-15 | 2013-10-08 | Connotech Experts-Conseils Inc. | Method of bootstrapping an authenticated data session configuration |
CN101594616B (en) * | 2009-07-08 | 2012-05-23 | 华为终端有限公司 | Authentication method, server, user equipment and communication system |
US20130110920A1 (en) * | 2011-10-27 | 2013-05-02 | Alcatel-Lucent Usa Inc. | Network-assisted peer-to-peer secure communication establishment |
CN103167492B (en) * | 2011-12-15 | 2016-03-30 | 华为技术有限公司 | Generate method and the equipment thereof of access layer secret key in a communications system |
-
2013
- 2013-10-23 CN CN201380003389.9A patent/CN104769982B/en active Active
- 2013-10-23 CN CN201910256482.XA patent/CN109922080A/en active Pending
- 2013-10-23 WO PCT/CN2013/085821 patent/WO2015058378A1/en active Application Filing
Patent Citations (4)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN101005359A (en) * | 2006-01-18 | 2007-07-25 | 华为技术有限公司 | Method and device for realizing safety communication between terminal devices |
CN101286843A (en) * | 2008-06-03 | 2008-10-15 | 江西省电力信息通讯有限公司 | Single-point login method under point-to-point model |
CN101640886A (en) * | 2008-07-29 | 2010-02-03 | 上海华为技术有限公司 | Authentication method, re-authentication method and communication device |
CN104769982A (en) * | 2013-10-23 | 2015-07-08 | 华为技术有限公司 | Method and device for secure communication between user equipment |
Non-Patent Citations (1)
Title |
---|
INTEL,ET AL: "Solution for ProSe one-to-many communications", 《3GPP SA WG2 MEETING #S2-97 S2-131994》 * |
Cited By (6)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN110505059A (en) * | 2019-08-23 | 2019-11-26 | 深圳成谷科技有限公司 | A kind of direct key generation method and device for PC5 interface point to point link |
CN111010412A (en) * | 2020-03-11 | 2020-04-14 | 北京信安世纪科技股份有限公司 | Communication method, communication apparatus, roadside device, and storage medium |
CN115885496A (en) * | 2020-08-28 | 2023-03-31 | 华为技术有限公司 | Communication method and related device |
CN115885496B (en) * | 2020-08-28 | 2023-10-20 | 华为技术有限公司 | Communication method and related device |
TWI779711B (en) * | 2020-10-26 | 2022-10-01 | 美商戴爾產品有限公司 | Distributed secure communication system, information handling system and method for providing distributed secure communications |
US11683172B2 (en) | 2020-10-26 | 2023-06-20 | Dell Products L.P. | Distributed secure communication system |
Also Published As
Publication number | Publication date |
---|---|
WO2015058378A1 (en) | 2015-04-30 |
CN104769982A (en) | 2015-07-08 |
CN104769982B (en) | 2019-05-03 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
CN104769982B (en) | The method and device securely communicated between user equipment | |
CN104980928B (en) | It is a kind of for establishing the method, equipment and system of secure connection | |
EP2639997B1 (en) | Method and system for secure access of a first computer to a second computer | |
WO2017114123A1 (en) | Key configuration method and key management center, and network element | |
CN103458400B (en) | A kind of key management method in voice encryption communication system | |
CN103533539B (en) | Virtual SIM card parameter management method and device | |
CN109923830A (en) | System and method for configuring wireless network access device | |
CN107317789A (en) | Key distribution, authentication method, apparatus and system | |
CN107800539A (en) | Authentication method, authentication device and Verification System | |
CN109548017A (en) | A kind of cipher key interaction method and device | |
CN103415008A (en) | Encryption communication method and encryption communication system | |
WO2016161583A1 (en) | Gprs system key enhancement method, sgsn device, ue, hlr/hss and gprs system | |
CN106031120B (en) | Key management | |
CN106134231A (en) | Key generation method, equipment and system | |
CN108964897B (en) | Identity authentication system and method based on group communication | |
CN106714152A (en) | Secret key distribution and reception methods, first secret key management center, and first network element | |
CN109905348A (en) | End to end authentication and cryptographic key negotiation method, apparatus and system | |
CN102932790A (en) | Mobile-communication-network-based security authentication method of Internet of Things | |
CN109309910A (en) | Communication data transmission method, system, equipment and computer readable storage medium | |
CN105025472A (en) | Method and system for encrypting, hiding and discovering of WIFI access point | |
CN108880799A (en) | Multiple identity authorization system and method based on group key pond | |
Prabhakara Rao et al. | Extended group-based verification approach for secure M2M communications | |
CN105848140A (en) | Safe end-to-end establishment method capable of achieving communication supervision in 5G network | |
CN107451647B (en) | Built-in safety mechanism's special SIM card of barracks | |
CN106209756A (en) | Password update method, subscriber equipment, subscriber location servers and territory router |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
PB01 | Publication | ||
PB01 | Publication | ||
SE01 | Entry into force of request for substantive examination | ||
SE01 | Entry into force of request for substantive examination | ||
WD01 | Invention patent application deemed withdrawn after publication |
Application publication date: 20190621 |
|
WD01 | Invention patent application deemed withdrawn after publication |