CN1997212A

CN1997212A - Method for location update in the wireless communication network

Info

Publication number: CN1997212A
Application number: CNA2006100004900A
Authority: CN
Inventors: 单长虹; 林志斌
Original assignee: Huawei Technologies Co Ltd
Current assignee: Huawei Technologies Co Ltd
Priority date: 2006-01-05
Filing date: 2006-01-05
Publication date: 2007-07-11

Abstract

This invention relates to one wireless communication network position updating method, witch comprises the following steps: firstly, sending position update require information by base station to PC; the said message comprises require AK message indication information; PC receives position updating message and sends the message to base station according to indication information control right.

Description

Realize the position method for updating in the cordless communication network

Technical field

The present invention relates to wireless communication technology field, relate in particular to and realize the position method for updating in a kind of cordless communication network.

Background technology

In cordless communication network; according to 802.16 agreements as can be known; portable terminal is wanted and base station communication; must set up identical AK (authorization key) context; described AK context comprises: AK; AKID (authorization key sign); AKSequence Number (authorization key sequence number); AKLifetime (authorization key life cycle); PMK Sequence Number (antithesis master key sequence number); HMAC/CMAC_KEY_U (uplink message integrity protection key); (uplink message prevents the Replay Attack packet number to HMAC/CMAC_PN_U; be called for short PN_U); HMAC/CMAC_KEY_D (downlinlc message integrity protection key); HMAC/CMAC_PN_D (downlinlc message prevents the Replay Attack packet number, is called for short PM_D); KEK (key-encrypting key); EIK (integrality encryption key).

In the AK context, HMAC/CMAC_KEY_U and HMAC/CMAC_KEY_D are calculated according to AK, terminal MAC (medium access control) address, BSID (Base Station Identification) by the base station, and being respectively applied for provides integrity protection to uplink downlink message.PN_U and PN_D are two 32 digit counters, and when the AK context was set up, the value of these two counters all was 0, and every afterwards use HMAC/CMAC_KEY_U provides integrity protection one time to upstream message, and portable terminal just increases by 1 with the value of PN_U; Every use HMAC/CMAC_KEY_D provides integrity protection one time to downstream message, and the base station just increases by 1 with the value of PN_D.If the numerical space of PN_U or PN_D exhausts (be in these two values any arrive in 2^32-1), or AK expires life cycle in the AK context, mean that all this AK finishes life cycle, should apply for new AK before this.

In cordless communication network, described AK is contextual to set up process as shown in Figure 1, specifically comprises following treatment step:

Step 11: communication link has been set up in terminal and base station;

Step 12: terminal and AAA (authentication, authentication, charging) server is set up shared MSK (master session key) by EAP (Extensible Authentication Protocol) authentication mode in both sides;

Step 13:AAA server passes to authentication device in the ASN of terminal place with MSK;

Step 14: terminal and authentication device carry out following processing respectively after obtaining MSK separately:

Terminal produces PMK from MSK, produces AK from PMK, generates whole AK contexts then;

Authentication device produces PMK from MSK, produces part AK context from PMK, comprising: AK, AK sign, AK sequence number, AK life cycle, PMK sequence number, EIK; Value for HMAC/CMAC_PN_U and HMAC/CMAC_PN_D can be changed to zero or empty at this.

Step 15: authentication device sends to the base station to the part A K context that has produced;

Step 16: the base station produces remainder AK context according to AK, comprising: HMAC/CMAC_KEY_U, HMAC/CMAC_PN_U, HMAC/CMAC_KEY_D, HMAC/CMAC_PN_D, KEK; The value of HMAC/CMAC_PN_U and HMAC/CMAC_PN_D is zero when initial.

Step 17: the idle message in the AK contextual protection subsequent communications that terminal and base station usefulness are set up and the transmission of traffic encryption key.

In cordless communication network, when the terminal under the idle pulley during, at first need to initiate the position and upgrade to PC/LR to position updating request that the base station sends, upgrade and do the message validity checking again after finishing.Corresponding concrete processing procedure may further comprise the steps as shown in Figure 2:

Step 21: the PA of mobile terminal MS on the base station sends RNG-REQ (parameter adjustment request) message, and can indicate in the message is the parameter adjustment of carrying out position updating process.

When step 22:PA received this position updating request, directly the paging relaying Paging Relay on the gateway at portable terminal place sent position updating request.

Step 23: described Paging Relay sends position updating request to PC/LR.

Step 24:PC distributes new PGID (paging group sign) for this portable terminal, and replys the position to it and upgrade response message.

Step 25:Paging Relay upgrades response message with this position and is transmitted to PA;

At this moment, if there is not safe context information on the PA, i.e. AK contextual information then should be to the safe context information of this portable terminal of anchoring authentication device request, obtain corresponding AK contextual information after, execution in step 26.

Step 26:PA judges RNG-REQ message with the safe context information of this portable terminal, if message is legal, then reply RNG-RSP message, and use the AK context obtain, to this message HMAC/CMAC-Digest (hash message authentication code/cipher-text message authentication code-summary) that makes an abstract, execution in step 27 if it is illegal to judge this message, then abandons this message.

Step 27:PA sends the position to Paging Relay and upgrades acknowledge message.

Step 28:Paging Relay transmits this position to PC/LR and upgrades acknowledge message.

As can be seen, upgrade in the processing procedure in above-mentioned position, corresponding security information request message and position updating process are separate carrying out, and this must increase the redundancy of interacting message and the burden of backbone network.And, even when can buffer memory AK information on the BS, also the position updating request of terminal not being sent is carried out the legitimacy judgement, at this moment, if sending the terminal of position updating request is an assailant, constantly sending under the situation of location request message, if BS does not carry out any judgement, and ceaselessly send position updating request to PC/LR, will cause the network congestion of backbone network.

Therefore, processing procedure is upgraded in above-mentioned position of the prior art, promptly may increase network burden, also makes network have certain potential safety hazard.

Summary of the invention

The purpose of this invention is to provide and realize the position method for updating in a kind of wireless communication network, thereby can in the process of carrying out position renewal processing, can effectively reduce network burden, avoid the interacting message redundancy, to improve network performance.

The objective of the invention is to be achieved through the following technical solutions:

The invention provides and realize the position method for updating in a kind of cordless communication network, comprising:

A, base station send location update request message to paging controller PC, include the contextual indication information of request authorization key AK in the described message;

B, PC receive described location update request message, and according to described indication information control authentication device the AK contextual information are sent to the base station.

Described steps A comprises:

The base station sends location update request message by the paging Tandem Gateway to PC.

Among the present invention, before carrying out described steps A, also comprise:

Paging agent in the base station receives the location update request message that user terminal sends, and judge whether this locality preserves corresponding effective AK information, if corresponding effectively AK information is arranged, then judge the legitimacy of this location update request message according to AK information, if it is legal, then send the position updating request of not carrying the contextual indication information of request AK,, then abandon this location update request message if illegal; If not corresponding effectively AK information, then execution in step A.

Described step B comprises:

After B1, PC received the described location update request message that carries the contextual indication information of request AK, structure AK context request message sent to authentication device;

B2, authentication device generate corresponding AK context and return to PC after receiving described request message, and send it to the base station by PC.

Described step B1 also comprises:

When PC can't determine whether the current base station sign of portable terminal changes or when determining to change, then constructs the AK context request message and send to authentication device, and execution in step B2.

Described step B also comprises:

Authentication device judges whether the current base station sign of portable terminal changes, if, then generate new AK context, otherwise, new AK context do not generated.

Described step B also comprises:

After B3, PC received the described location update request message that carries the contextual indication information of request AK, the authentication device identification information that this locality is preserved sent to the base station;

B4, described base station directly or indirectly obtain the AK contextual information with described authentication device alternately according to the authentication device sign.

Among the present invention, before carrying out described step B3, also comprise:

PC judge its whether can with the authentication device direct communication, if can, execution in step B1 then, otherwise, execution in step B3.

Described method also comprises:

After the base station receive to obtain the AK contextual information of described portable terminal, the legitimacy of the position updating request information that receives is verified, and after checking is legal, continue the position and upgrade and handle, otherwise the position is upgraded processing procedure and finished.

Described continuation position is upgraded to handle and is comprised:

Response message is upgraded to the portable terminal home position in the base station, and by the paging relaying or directly to paging controller transmission position renewal acknowledge message;

Paging controller receives that carrying out information interaction with authentication device after the described message carries out the AK information updating.

Described method also comprises:

Home position upgraded the affirmation response message after described paging relaying or paging control received position renewal acknowledge message.

Described method also comprises:

The base station is after portable terminal sends the parameter adjustment request response, and the base station reports the up-downgoing message packet number information in the up-to-date safe context.

As seen from the above technical solution provided by the invention, among the present invention, the acquisition process of the security information of position updating process and base station is combined execution, processing mode realizes and no longer adopt separately independently, therefore, the present invention can avoid redundancy message mutual, thereby effectively reduces network burden, increases network utilization.

Simultaneously, also because the present invention can be according to the security information of the portable terminal of having preserved on the base station, promptly the AK context carries out the legitimacy judgement to the message of receiving, thereby can further improve the security performance of network.

In addition, after the base station sent RNG-RSP, the base station also reported HMAC/CMAC_PN_U and the HMAC/CMAC_PN_D information in the up-to-date safe context, thereby kept the network side safety context to be consistent, and reduced because its inconsistent re-authentication that causes.

Description of drawings

Fig. 1 sets up the process schematic diagram for AK context of the prior art;

Fig. 2 is that the processing procedure schematic diagram is upgraded in position of the prior art;

Fig. 3 is the specific implementation schematic diagram that processing procedure is upgraded in position provided by the invention.

Embodiment

Core of the present invention is on the base station not during the information of the up-to-date AK of buffer memory or anchoring authentication device, combine obtaining the handling process of security information and the message of position renewal accordingly, thereby simplify the handling process of whole position updating process, alleviate network burden.

Among the present invention, if there is not the information of up-to-date AK of buffer memory or anchoring authentication device on the base station, then the flow process of upgrading with the position of obtaining with security information combines and carries out, and specifically comprises:

(1) if can communicate by letter between PC and the anchoring authentication device, then directly obtains security information, this information is upgraded in the response message in the position passed to MSS then to anchoring authentication device by PC.

(2) if can not direct communication between PC and the anchoring authentication device, then PC can pass to the base station with the identifier of anchoring authentication device, directly or indirectly looks for anchoring authentication device to ask for security information by the base station then.

Among the present invention, if on the base station buffer memory up-to-date AK information, then the legitimacy of the RNG-REQ message that can send portable terminal according to described AK information of base station is directly judged, and no longer needs to PC or the up-to-date AK information of authentication device request.

Among the present invention, if on the base station buffer memory information of up-to-date anchoring authentication device, and the up-to-date AK information of buffer memory not, then anchoring authentication device at first will be found in the base station, and obtain up-to-date AK information from this anchoring authentication device, then RNG-REQ message is carried out validity decision.

In addition, among the present invention, after the base station sent RNG-RSP, the base station also needed to report the up-downgoing message packet number (HMAC/CMAC_PN_U and HMAC/CMAC_PN_D) in the up-to-date safe context, thereby can guarantee the consistency of corresponding packet number.

For the present invention there being further understanding, the specific implementation of handling process being upgraded in position provided by the invention below in conjunction with accompanying drawing is elaborated.

The specific implementation of the method for the invention may further comprise the steps as shown in Figure 3:

Step 31:MSS sends location update request message to PA, and the request position is upgraded, and carries MSID and PCID in described location update request message;

In WiMAX (micro-wave access to global intercommunication) network, specifically can adopt RNG-REQ (parameter adjustment such as power) message as location update request message;

Under idle pulley, if information (being the AK contextual information) that can the buffer memory safe context above the PA, then needing earlier the idle message RNG-REQ that sends from MSS to be carried out legitimacy judges, if judge illegal, just directly abandon this message, process finishes, if legal, then continue follow-up position and upgrade processing procedure, but need not to carry out the processing of obtaining of security information;

If the information that PA can not the buffer memory safe context then directly carry out step 32.

Step 32:PA sends AK context and location update request message to Paging Relay, carry MSID, BSID and PCID in the described message, also will comprise request AK contextual sign simultaneously, this sign is used in reference to be shown in needs in the position updating process to carry out that AK is contextual obtains processing.

Step 33:Paging Relay sends AK context and location update request message to PC/LR, comprises MSID and BSID in the described message, simultaneously, also will comprise the contextual sign of request AK.

Step 34:PC/LR finds the grappling Authenticator of this MSS correspondence, and sends the AK context request to Authenticator, comprises MSID and BSID in the message;

Before execution in step 34, if determine that PC can't directly communicate by letter with grappling Authenticator, then its identification information can be returned to the PA in the base station, initiate to obtain the contextual processing procedure of AK by the PA in the base station to described grappling Authenticator, at this moment, corresponding step obviously need be carried out accommodation among Fig. 3, is can be the explanation that example is carried out with grappling Authenticator direct communication with PC in this step and subsequent treatment;

In addition, before execution in step on the PC 34, can also judge whether the base station of determining portable terminal changes according to the BSID information in the message of receiving, if change, then continue follow-up processing procedure, otherwise, still adopt original AK context to get final product, and need not execution in step 34 to step 36.

Step 35: grappling Authenticator utilizes MSID, BSID and the PMK of MSS buffer memory for this reason, and MSS generates new AK and context thereof for this reason.

Step 36:Authenticator replys message to newly-generated AK and the context (being the AK context) thereof of PC/LR transmission by upgrading, and comprises MSID information in the described answer message.

Step 37:PC/LR is the new PGID of this MSS distribution after receiving described AK contextual information, and the AK that receives and contextual information thereof are merged into the position upgrade in the response message (be position upgrade reply message), send to Paging Relay, at this moment, described position is upgraded in the response message and is comprised: ID, the PCID of BSID, MSID, PGID and grappling Authenticator.

Step 38:Paging Relay upgrades response message with the position that receives and is transmitted to PA.

After step 39:PA receives, be the context of the additional remainder of AK, judge the legitimacy of message afterwards, if message is illegal, then directly abandon, processing procedure is upgraded to this termination in whole position, if message is legal, then continue follow-up position and upgrade processing procedure, promptly execution in step 310.

Step 310:PA uses RNG-RSP message to reply position renewal success message to MSS, and this position is upgraded in success message and comprised the current PGID of this MSS.

Step 311:PA sends the position to Paging Relay and upgrades acknowledge message and session information report, to comprise in the message MSID, BSID, position upgrades successfully indicate and safe context in up-downgoing message packet number (being HMAC/CMAC_PN_U and HMAC/CMAC_PN_D).

Step 312:Paging Relay also sends the position to PA and upgrades the affirmation response message, has received position renewal acknowledge message to represent it;

Step 313:Paging Relay transmits the position to PC/LR and upgrades the report of acknowledge message session information, the expression position upgrades successfully, then PC/LR just can upgrade this MSS the PGID field and the correspondence safe context in up-downgoing message packet number (being HMAC/CMAC_PN_U and HMAC/CMAC_PN_D);

Step 314:PC also sends the position to Paging Relay and upgrades the affirmation response message, has received position renewal acknowledge message to represent it.

Need to prove: when PA directly sent to PC with described position renewal acknowledge message, then PC directly upgraded corresponding position and confirms that response message returns to the PA in the base station; In addition, there is not sequential relationship successively between described step 312 and the step 314, also can be after complete step 314, execution in step 312 again;

The present invention is in the specific implementation process, if select information stores with AK at PC/LR, then follow-up step 315 and step 316 can be omitted, otherwise continue follow-up treatment step:

Step 315:PC/LR sends AK information updating request to anchoring authentication device, to upgrade HMAC/CMAC_PN_U and the HMAC/CMAC_PN_D information on the authentication device.

Step 316: anchoring authentication device receives described request and upgrades the information of AK, and promptly HMAC/CMAC_PN_U and HMAC/CMAC_PN_D information are replied acknowledge message then.

In addition, owing in practical application process of the present invention, multiple possible applied environment can occur, for example, PC/LR and Authenticator (authentication device) are on the same physical NE, and perhaps, the current PC of the ASN at MSS place is exactly its grappling PC, or the like.At this moment, the specific implementation process will be distinguished to some extent with the realization flow that Fig. 3 provides, be specially in specific implementation shown in Figure 3: if PC/LR and Authenticator are on the same physical NE, then step 34,36 and step 315,316 can omit; If the current PC of the ASN at MSS place is exactly its grappling PC, then step 33,37 and step 313 can omit.

In sum, the present invention will obtain the handling process of security information accordingly and the message of position renewal combines, thereby simplify the handling process of whole position updating process, alleviate network burden.

The above; only for the preferable embodiment of the present invention, but protection scope of the present invention is not limited thereto, and anyly is familiar with those skilled in the art in the technical scope that the present invention discloses; the variation that can expect easily or replacement all should be encompassed within protection scope of the present invention.Therefore, protection scope of the present invention should be as the criterion with the protection range of claim.

Claims

1, realize the position method for updating in a kind of cordless communication network, it is characterized in that, comprising:

2, realize the position method for updating in the cordless communication network according to claim 1, it is characterized in that described steps A comprises:

3, realize the position method for updating in the cordless communication network according to claim 1, it is characterized in that, carry out described steps A and also comprise before:

4, realize the position method for updating in the cordless communication network according to claim 1, it is characterized in that described step B comprises:

5, realize the position method for updating in the cordless communication network according to claim 4, it is characterized in that described step B1 also comprises:

6, realize the position method for updating in the cordless communication network according to claim 4, it is characterized in that described step B also comprises:

7, the position method for updating it is characterized in that described step B also comprises according to realizing in each described cordless communication network of claim 1 to 6:

8, realize the position method for updating in the cordless communication network according to claim 7, it is characterized in that, before carrying out described step B3, also comprise:

9, the position method for updating it is characterized in that described method also comprises according to realizing in each described cordless communication network of claim 1 to 6:

10, realize the position method for updating in the cordless communication network according to claim 9, it is characterized in that described continuation position is upgraded to handle and comprised:

11, realize the position method for updating in the cordless communication network according to claim 10, it is characterized in that described method also comprises:

12, the position method for updating it is characterized in that described method also comprises according to realizing in each described cordless communication network of claim 1 to 6: