WO2003007569A1 - Structure de reseau pour crypter un terminal de systeme de communication mobile et procede de realisation de cette structure - Google Patents

Structure de reseau pour crypter un terminal de systeme de communication mobile et procede de realisation de cette structure Download PDF

Info

Publication number
WO2003007569A1
WO2003007569A1 PCT/CN2002/000330 CN0200330W WO03007569A1 WO 2003007569 A1 WO2003007569 A1 WO 2003007569A1 CN 0200330 W CN0200330 W CN 0200330W WO 03007569 A1 WO03007569 A1 WO 03007569A1
Authority
WO
WIPO (PCT)
Prior art keywords
layer
user
information
encryption
application layer
Prior art date
Application number
PCT/CN2002/000330
Other languages
English (en)
French (fr)
Inventor
Zhibin Zheng
Original Assignee
Huawei Technologies Co., Ltd.
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Huawei Technologies Co., Ltd. filed Critical Huawei Technologies Co., Ltd.
Priority to DE60225557T priority Critical patent/DE60225557T2/de
Priority to EP02784821A priority patent/EP1406423B1/en
Publication of WO2003007569A1 publication Critical patent/WO2003007569A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/16—Implementing security features at a particular protocol layer
    • H04L63/168—Implementing security features at a particular protocol layer above the transport layer
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/03—Protecting confidentiality, e.g. by encryption
    • H04W12/033—Protecting confidentiality, e.g. by encryption of the user plane, e.g. user's traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H04L63/0485—Networking architectures for enhanced packet encryption processing, e.g. offloading of IPsec packet processing or efficient security association look-up

Definitions

  • Network structure suitable for terminal encryption of mobile communication system and implementation method thereof is
  • the present invention relates to a network structure for implementing information encryption in a WCDMA mobile communication system and a method for implementing the same. Specifically, the present invention relates to a network structure suitable for terminal encryption in a mobile communication system and a method for implementing the same. Based on the symmetric encryption from the terminal to the access network side, but instead providing the encryption of the information from the terminal, it belongs to the technical field of secure or secure communication devices in the mobile communication system. Background of the invention
  • the encryption functions currently used are implemented in the user terminal equipment (UE: User Equipment) on the user side and the radio network controller (RNC: Radio Network Controller) on the network side, that is, It is the security and confidentiality of the information transmitted over the air in the access part of the system, and does not provide the information encryption and security guarantees transmitted by the core network part.
  • the information encryption of the core network part needs to be considered separately.
  • the third generation mobile communication system standardization organization (3GPP: Third Generation Partnership Project) has not yet defined the information encryption method and standard of the core network part.
  • FIG. 1 is a schematic diagram of a location where data is currently encrypted in a 3GPP network system, which is a data information encryption mode of the network architecture recommended by 3GPP.
  • the data confidentiality DC UE (DC: Data confidentiality) 11 and the data confidentiality (DCRNC) 12 of the wireless network controller 13 respectively represent the symmetric encryption of data performed by the user terminal device 10 on the user side and the wireless network controller 13 on the network side, that is, only the terminal is now provided
  • the encryption function with the base station does not provide the end-to-end encryption function between the terminals.
  • the specific implementation of the encryption system can also be analyzed from a hierarchical perspective. See FIG.
  • the access layer includes the physical layer (PHY) 27, that is, L1, the media access layer (MAC) 26, and the data link layer (RLC) 25. That is, L2, the radio resource management control layer (RRC) 24 is L3; the non-access layer mainly includes an application layer 22, a call control (CC), and a mobile management layer (MM) 23.
  • PHY physical layer
  • MAC media access layer
  • RLC data link layer
  • the non-access layer mainly includes an application layer 22, a call control (CC), and a mobile management layer (MM) 23.
  • U-Plane user plane
  • C-Plane control plane
  • the current encryption function is implemented on the use plane 21 and the control plane 20 at the same time in a vertical direction. In the horizontal direction, it is implemented at the second layer L2 of the network, that is, at the data link layer 25 or the media access layer 26.
  • the specific process of implementing encryption at the data link layer 25 or the media access layer 26 is shown in Figure 3, and the steps are as follows:
  • Step 301 The upper layer information is transmitted to the data link layer, and the data link layer determines whether the mode in which the information is located is a transparent mode or a non-transparent mode.
  • step 302 is performed to encrypt the protocol data units (PDUs) at the data link layer and transmitted to the media access layer, and step 303 is performed. After the media access layer undergoes non-encryption processing, it is transmitted to Physical layer
  • step 304 is performed, and the information is not processed at the data link layer, and is transmitted to the media access layer.
  • Step 305 is performed, and the service data unit is performed at the media access layer.
  • the encrypted information is transmitted to the physical layer, and after processing, it is sent to the receiver;
  • the receiver performs corresponding decryption according to the inverse process of the above processing process.
  • the encryption functions used are limited to the information part of the access link, that is, the user terminal equipment and It is implemented in the wireless network controller on the network side without considering the end-to-end encryption technology.
  • This situation will cause certain security flaws in the mobile communication system, that is, the current security protection scope of user information cannot be extended to the core network part, and user information is completely transparently transmitted in the core network. This information can be easily transmitted. Intercepted or eavesdropped by others. In order to ensure the security of this information, it is required that the core network must consider additional security technologies.
  • the object of the present invention is to provide a network structure suitable for terminal encryption of a mobile communication system, so as to solve the problem of end-to-end communication encryption that cannot be realized at present.
  • Another object of the present invention is to provide a method for implementing terminal encryption in a mobile communication system, that is, to provide an end-to-end encryption method through the above network structure.
  • a network structure suitable for encryption of a mobile communication system terminal is divided into two major planes in the vertical direction: a user plane and a control plane, where the hierarchical structure of the control plane includes: The application layer, call control and mobile management layer as the non-access layer, and the radio resource management control layer, data link layer, media access layer, and physical layer as the access layer;
  • the hierarchical structure of the user plane includes: Application Layer, data link layer, media access layer, physical layer; characterized in that: a security application layer that encrypts user information in the application layer is added below the application layer in the user plane, and the security application layer is only applicable to users End, while the hierarchical structure of the network end remains unchanged.
  • the security application layer has an encryption algorithm and a key for encrypting user information.
  • the implementation method of the present invention applicable to terminal encryption of a mobile communication system is as follows: A method for implementing terminal encryption suitable for a mobile communication system, which is characterized in that it includes the following steps:
  • the user's business information is encrypted by a preset security application layer, and the security application layer provides the encryption algorithm and key encryption security method used;
  • the user service information is decrypted by the security application layer to restore its original information content.
  • the encryption and decryption operation described in step B may further include:
  • the network-side wireless network controller corresponding to the transmitting side uses the wireless network controller data confidentiality (DC RNC ) encryption protection at the media access layer or data link layer to decrypt;
  • DC RNC wireless network controller data confidentiality
  • the user service information and the control plane control information are transmitted through the core network to the network-side radio network controller corresponding to the receiving side.
  • the user service information in the encrypted state is encrypted by using wireless network controller data confidentiality (DC RNC ) encryption protection, and sent to the corresponding receiving side;
  • DC RNC wireless network controller data confidentiality
  • the terminal on the receiving side uses the user terminal data confidentiality (DC UE ) encryption protection to decrypt the control plane control information and the user service information in the encrypted state at the data link layer or the media access layer.
  • DC UE user terminal data confidentiality
  • the present invention is directed to a network layered structure defined by the 3GPP at present, and proposes a network structure suitable for terminal encryption and an implementation method thereof.
  • the technical key point is to add a security application layer to the user plane network hierarchy; This layer is only carried out on the terminal side The division of the secondary structure without changing the original hierarchical structure on the network side, so that the application of the present invention will not affect the basic network structure.
  • the present invention adds a security application layer to the hierarchical structure of the user plane.
  • the network hierarchy structure of the increased security application layer is only applicable to the terminal side, and not applicable to the terminal side.
  • the network side and it has no impact on the implementation of the network encryption function and the control plane encryption function.
  • the present invention provides a basic operation platform for implementing terminal encryption, so that the data always exists in cipher text during the entire transmission process from the source point to the destination point. In this way, the information is transmitted during the transmission. The whole process can be protected, and even when some nodes are damaged, the information will not be leaked, and the secure transmission and application of information can be reliably guaranteed.
  • the invention is particularly suitable for
  • Figure 1 is a schematic diagram of the location where data encryption is currently performed in the 3GPP network system.
  • Figure 2 is a schematic diagram of the current 3GPP network layered structure.
  • Figure 3 is a flowchart of data encryption currently performed by the media access layer and / or data link layer in the 3GPP network system.
  • FIG. 4 is a schematic diagram of a layered network structure that can implement terminal encryption according to the present invention.
  • FIG. 5 is a schematic diagram of a location where the present invention implements terminal encryption and data encryption in a 3GPP network system.
  • FIG. 6 is a schematic diagram showing an implementation process of implementing end-to-end encryption according to the present invention. Mode of Carrying Out the Invention
  • the present invention is a network structure suitable for terminal encryption of a mobile communication system. It is divided into two major planes in the vertical direction: the user plane 41 and the control plane 40, where the hierarchical structure of the control plane 40 includes: an application layer 42 as a non-access layer, a call control and mobile management layer 43, and as The radio resource management control layer 44 of the access layer is L3, the data link layer 45 and the media access layer 46 are L2, and the physical layer 47 is L1.
  • the hierarchical structure of the user plane 41 includes: an application layer 42, a data link layer 45 and the media access layer 46, that is, L2, and the physical layer 47, that is, L1; its characteristics are: a security application layer (SAL) 48 for encrypting the user information of the application layer 42 is added below the application layer 42 of the user plane 41;
  • the security application layer 48 provides an encryption algorithm and a key for encrypting user information; and the security application layer 48 is only applicable to the user side, and the hierarchical structure of the network side remains unchanged.
  • FIG. 5 shows a schematic diagram of a location where the present invention implements terminal encryption and data encryption in a 3GPP network system.
  • the user terminal device 50 provides user information encryption at the same time.
  • UC UE user information encryption function 51 and user data confidentiality (DC UE ) encryption function 52, but the user information encryption function is implemented at the security application layer, and the data encryption function is implemented at the data link layer or the media access layer.
  • Wireless network controller 54 only implements wireless network controller data confidentiality
  • DC RNC (DC RNC ) encryption function 53, which is implemented in the data link layer or the media access layer.
  • the method for implementing encryption of a mobile communication system terminal is as follows: When a user sends information, the method includes the following steps:
  • the user information encryption function is provided to the user at the user terminal device.
  • the sender 60 encrypts the user's service information through the security application layer 601, and the security application layer 601 provides the encryption algorithm and key used. security strategy;
  • the encrypted information is processed by a series of physical layers 603 and then sent to the network side.
  • the wireless network controller 610 of the network side 61 corresponding to the sending side 60 uses the wireless network controller data confidentiality encryption protection DCRNC for decryption at the media access layer / data link layer 612, and thereafter, the control of the control plane controls The information has been completely decrypted, but the user service information of the user plane is still encrypted;
  • the user service information and control plane control information are transmitted through the core network 614 to the wireless network controller 611 corresponding to the network side 61 of the receiving side 62, and the wireless network controller 611 pairs the data link layer / media access layer 613 with
  • the control information of the control plane and the user service information that is still in an encrypted state are encrypted by the wireless network controller data confidentiality encryption protection, that is, DCRNC, and sent to the corresponding receiving side 62;
  • the terminal on the receiving side 62 decrypts the control plane control information and the user service information in the encrypted state at the data link layer / media access layer 622 using the user terminal ’s data confidentiality encryption protection, that is, the DC UE .
  • the control information of the plane is completely decrypted, but the user service information of the user plane is still not decrypted;
  • the user service information is decrypted by the application security layer 621, and the original information content is restored.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Telephonic Communication Services (AREA)
  • Telephone Function (AREA)
  • Computer And Data Communications (AREA)

Description

适用于移动通信系统终端加密的网络结构及其实现方法 技术领域
本发明涉及一种 WCDMA移动通信系统实现信息加密的网络结构 及其实现方法， 确切地说， 涉及一种适用于移动通信系统终端加密的网 络结构及其实现方法， 其信息加密方法不同于传统的基于终端到接入网 侧的对称加密， 而是提供终端到终端的信息加密， 属于移动通信系统中 的保密或安全通信装置的技术领域。 发明背景
在第三代移动通信 WCDMA系统中， 目前采用的加密功能都是在用 户侧的用户终端设备 ( UE: User Equipment )和网络侧的无线网络控制 器（RNC:Radio Network Controller ) 中实现的， 即是在系统的接入部分 空中传输的信息的安全和保密， 而不提供核心网络部分传输的信息加密 和安全保障， 核心网络部分的信息加密需要另行考虑。 目前在第三代移 动通信系统标准化组织（ 3GPP:Third Generation Partnership Project )中尚 未定义核心网络部分的信息加密方法和标准。
参见图 1所示， 图 1是目前在 3GPP网络体系中进行数据加密的位置 示意图， 为 3GPP推荐的网络体系结构的数据信息加密模式， 其中， 用 户终端设备 10的数据机密性 DCUE ( DC: Data confidentiality ) 11以及 无线网络控制器 13的数据机密性（ DCRNC ) 12分别表示在用户端的用户 终端设备 10和网络端的无线网络控制器 13对数据进行的对称加密， 也 就是说， 现在只提供终端与基站之间的加密功能， 而不提供终端之间的 端到端的加密功能。 对应于上述现有的网络体系的加密功能， 该加密体制的具体实施还 可以从层次角度来分析之， 参见图 2所示， 图 2是目前的 3GPP网络的 分层结构示意图， 其水平方向按层次结构划分， 垂直方向则按面结构划 分。 在水平方向上主要分为两大层： 接入层和非接入层， 其中接入层包 含物理层（ PHY ) 27即 L1、媒体访问层（ MAC ) 26和数据链路层（ RLC ) 25即 L2、 无线资源管理控制层（RRC ) 24即 L3; 非接入层主要包含应 用层 22、 呼叫控制（CC )和移动管理层（MM ) 23。 垂直方向上分为两 大面： 用户平面 （U - Plane ) 21和控制平面 （C - Plane ) 20, 其中用户 平面只包括应用层 22、 数据链路层 25、 媒体访问层 26和物理层 27。
目前的加密功能从垂直方向而言， 是同时在用 平面 21和控制平 面 20上实现的。 从水平方向上， 是在网络的第二层 L2实现， 即在数据 链路层 25或者媒体访问层 26实现的。 在数据链路层 25或者媒体访问 层 26实现加密的具体过程如图 3所示， 步骤如下：
1、 步骤 301 , 上层信息传送到数据链路层， 由数据链路层判断该 信息所处的模式是透明模式还是非透明模式；
2、 如果是非透明模式， 则执行步骤 302， 对数据链路层的协议数 据单元（PDUs )进行加密， 传输到媒体访问层， 执行步骤 303, 在媒体 访问层经过非加密处理后， 再传输到物理层；
3、 如果是透明模式， 执行步骤 304， 该信息在数据链路层不作处 理， 传输到媒体访问层， 执行步骤 305， 在媒体访问层对业务数据单元
( SDUs )进行加密， 再传输到物理层；
4、 已加密的信息传输到物理层， 经过处理后， 发送到接收方；
5、 接收方根据上述处理过程的逆过程进行对应解密。
综上所述， 目前的第三代移动通信 WCDMA系统中， 所采用的加密 功能都是局限于接入链路的信息部分， 即是在用户侧的用户终端设备和 网络侧的无线网络控制器中实现的， 没有考虑端对端的加密技术。 这种 状况会导致移动通信系统中存在着一定的安全缺陷， 即目前的用户信息 受到的安全保护范围不能延伸到核心网部分， 用户信息在核心网中是完 全透明传输的， 该信息很容易被他人截获或者窃听。 为了保证该信息的 安全， 就要求核心网必须考虑额外的安全技术。
此外， 目前的协议要求无线网络控制器和用户侧的用户终端设备两 者之间必须拥有标准统一的加密算法， 这样就限制了一些具有特殊算法 要求的专用用户， 使它们的需求不能得到满足。 这也是现有技术的一个 缺陷。 发明内容
本发明的目的是提供一种适用于移动通信系统终端加密的网络结 构， 以解决目前尚不能实现的端对端通信加密的问题。
本发明的另一目的是提供一种适用于移动通信系统终端加密的实现 方法， 也就是藉由上述网络结构而提供一种端对端的加密方法。
本发明的目的是这样实现的： 一种适用于移动通信系统终端加密的 网络结构， 其在垂直方向上分为两大平面： 用户平面和控制平面， 其中， 控制平面的分层结构包括有： 作为非接入层的应用层、 呼叫控制和移动 管理层， 以及作为接入层的无线资源管理控制层、 数据链路层和媒体访 问层、 物理层； 用户平面的分层结构包括有： 应用层、 数据链路层、 媒 体访问层、 物理层； 其特征在于： 在用户平面的应用层之下增加一个对 应用层用户信息进行加密作业的安全应用层， 且该安全应用层只适用于 用户端， 而网络端的分层结构保持不变。
所述的安全应用层具有对用户信息进行加密的加密算法及密钥。 本发明的适用于移动通信系统终端加密的实现方法是这样的： 一种 适用于移动通信系统终端加密的实现方法， 其特征在于， 包括有下列步 骤：
A.在发送侧， 将用户的业务信息通过预先设置的安全应用层进行加 密， 并由该安全应用层提供所采用的加密算法及密钥加密安全方法；
B.将控制信息及已加密的用户业务信息进行数据链路层或媒体访问 层的加解密操作；
C.在接收侧， 用户业务信息经所述的安全应用层进行解密， 恢复其 原始信息内容。
其中， 步驟 B所述的加解密操作可以进一步包括：
B1 )将控制平面的控制信息及已加密的用户业务信息在数据链路层 或者媒体访问层通过用户终端数据机密性（DCUE )加密保护进行加密；
B2 )上述加密信息再经过物理层处理后， 发送到网络侧；
B3 )与发送侧对应的网络侧无线网络控制器在媒体访问层或数据链 路层采用无线网络控制器数据机密性（DCRNC )加密保护进行解密；
B4 )用户业务信息和控制平面的控制信息通过核心网传送到对应于 接收侧的网络侧无线网络控制器， 该无线网络控制器在数据链路层或媒 体访问层对控制平面的控制信息及仍然处于加密状态的用户业务信息 采用无线网络控制器数据机密性（DCRNC )加密保护进行加密， 并发送 到相应的接收侧；
B5 )接收侧的终端在数据链路层或媒体访问层对控制平面的控制信 息和处于加密状态的用户业务信息采用用户终端数据机密性（ DCUE )加 密保护进行解密。
本发明是针对目前 3GPP定义的网络分层结构， 提出的一种适合终 端加密的网络结构及其实现方法， 其技术关键之处是在用户平面的网络 层次结构中， 增加一个安全应用层； 此外， 仅仅是在终端侧进行这种层 次结构的划分， 而在网络侧不改变原来的层次结构， 以便本发明的应用 不至于影响基本网络结构。
从本发明的特点可以看出，其具有以下效果： 本发明是在用户平面 的层次结构中增加了一个安全应用层 , 该增加安全应用层的网络层次结 构只适用于终端侧， 而不适用于网络侧， 且其对网络加密功能以及控制 平面加密功能的实施没有任何影响。 本发明通过在终端侧的用户平面增 加一个安全应用层， 提供了实现终端加密的基本操作平台， 使得数据在 从源点到终点的整个传输过程中始终以密文存在， 这样， 信息在传输的 全部过程中都能够得到保护， 甚至在有些节点遭到损坏时， 也不会使信 息泄露， 能够可靠地保证信息的安全传输和应用。 本发明尤其适用于
3GPP所定义的网络体系安全功能的实现。 附图简要说明
图 1是目前在 3GPP网络体系中进行数据加密的位置示意图。
图 2是目前的 3GPP网络分层结构示意图。
图 3是目前在 3GPP网络体系中媒体访问层和 /或数据链路层进行数 据加密的流程图。
图 4是本发明可以实现终端加密的网络分层结构示意图。
图 5是在 3GPP网络体系中本发明实现终端加密和数据加密的位置 示意图。
图 6是表示本发明实现端对端加密的实施过程的示意图。 实施本发明的方式
下面结合附图对本发明进行详细描述。
参见图 4， 本发明是一种适用于移动通信系统终端加密的网络结构， 其在垂直方向上分为两大平面： 用户平面 41和控制平面 40, 其中控制 平面 40的分层结构包括有： 作为非接入层的应用层 42、 呼叫控制和移 动管理层 43 , 以及作为接入层的无线资源管理控制层 44即 L3、 数据链 路层 45和媒体访问层 46即 L2、 物理层 47即 L1 ; 用户平面 41的分层 结构包括有： 应用层 42、 数据链路层 45和媒体访问层 46即 L2、 物理 层 47即 L1 ; 其特点是： 在用户平面 41的应用层 42之下增设一个对应 用层 42用户信息进行加密操作的安全应用层（SAL ) 48， 由该安全应用 层 48提供对用户信息进行加密的加密算法及密钥； 且该安全应用层 48 只适用于用户端， 而网络端的分层结构保持不变。
图 5展示了本发明在 3GPP网络体系中实现终端加密和数据加密的 位置示意图。 在本发明中， 用户终端设备 50 同时提供用户信息加密
( UCUE )功能 51和用户数据机密性（DCUE )加密功能 52, 但用户信息 加密功能是在安全应用层实现， 而数据加密功能则是在数据链路层或媒 体访问层实现。 无线网络控制器 54只实现无线网络控制器数据机密性
( DCRNC )加密功能 53 , 该功能是在数据链路层或媒体访问层中实现。
参见图 6所示，本发明的适用于移动通信系统终端加密的实现方法 是这样的： 当用户发送信息时， 包括有下列步骤：
( 1 )在用户终端设备向用户提供用户信息加密功能， 在发送侧 60 对用户的业务信息通过安全应用层 601进行加密，并由该安全应用层 601 提供所采用的加密算法及密钥类的安全策略；
( 2 )继而对已加密的用户业务信息及控制平面的控制信息在数据链 路层 /媒体访问层 602通过用户终端数据机密性加密保护即 DCUE进行加 密；
( 3 )上述加密信息再经过一系列物理层 603处理后，发送到网络侧 ( 4 )与发送侧 60对应的网络侧 61的无线网络控制器 610在媒体访 问层 /数据链路层 612采用无线网络控制器数据机密性加密保护即 DCRNC 进行解密， 此后， 其控制平面的控制信息已完全解密， 但用户平面的用 户业务信息仍然处于加密状态；
( 5 )用户业务信息和控制平面的控制信息通过核心网 614传送到对 应接收侧 62的网络侧 61的无线网络控制器 611，该无线网络控制器 611 在数据链路层 /媒体访问层 613 对控制平面的控制信息及仍然处于加密 状态的用户业务信息采用无线网络控制器数据机密性加密保护即 DCRNC 进行加密， 并发送到相应的接收侧 62;
( 6 )接收侧 62的终端在数据链路层 /媒体访问层 622对控制平面的 控制信息和处于加密状态的用户业务信息采用用户终端数据机密性加 密保护即 DCUE进行解密， 此后， 其控制平面的控制信息已完全解密， 但用户平面的用户业务信息仍然未解密；
( 7 )用户业务信息再经应用安全层 621进行解密， 恢复其原始信息 内容。

Claims

权利要求书
1、 一种适用于移动通信系统终端加密的网络结构， 其在垂直方 向上分为两大平面： 用户平面和控制平面， 其中控制平面的分层结构包 括有： 作为非接入层的应用层、 呼叫控制和移动管理层， 以及作为接入 层的无线资源管理控制层、 数据链路层和媒体访问层、 物理层； 用户平 面的分层结构包括有： 应用层、 数据链路层、 媒体访问层、 物理层； 其 特征在于： 在用户平面的应用层之下增加一个对应用层用户信息进行加 密作业的安全应用层， 且该安全应用层只适用于用户端， 而网络端的分 层结构保持不变。
2、 如权利要求 1 所述的适用于移动通信系统终端加密的网络结 构， 其特征在于： 所述的安全应用层具有对用户信息进行加密的加密算 法及密钥。
3、 一种适用于移动通信系统终端加密的实现方法， 其特征在于， 包括有下列步骤：
A.在发送侧， 将用户的业务信息通过预先设置的安全应用层进行加 密， 并由该安全应用层提供所采用的加密算法及密钥加密安全方法；
B.将控制信息及已加密的用户业务信息进行数据链路层或媒体访问 层的加解密操作；
C.在接收侧， 用户业务信息经所述的安全应用层进行解密， 恢复其 原始信息内容。
4、 根据权利要求 3所述的实现方法， 其特征在于， 步骤 B所述 的加解密操作进一步包括：
B1 )将控制平面的控制信息及已加密的用户业务信息在数据链路层 或者媒体访问层通过用户终端数据机密性加密保护进行加密； B2 )上述加密信息再经过物理层处理后， 发送到网络侧;
B3 )
Figure imgf000011_0001
路层采用无线网络控制器数据机密性加密保护进行解密；
B4 )用户业务信息和控制平面的控制信息通过核心网传送到对应于 接收侧的网络侧无线网络控制器， 该无线网络控制器在数据链路层或媒 体访问层对控制平面的控制信息及仍然处于加密状态的用户业务信息 釆用无线网络控制器数据机密性加密保护进行加密， 并发送到相应的接 收侧；
B5 )接收侧的终端在数据链路层或媒体访问层对控制平面的控制信 息和处于加密状态的用户业务信息采用用户终端数据机密性加密保护 进行解密。
PCT/CN2002/000330 2001-07-12 2002-05-14 Structure de reseau pour crypter un terminal de systeme de communication mobile et procede de realisation de cette structure WO2003007569A1 (fr)

Priority Applications (2)

Application Number Priority Date Filing Date Title
DE60225557T DE60225557T2 (de) 2001-07-12 2002-05-14 Netzwerkstruktur zum verschlüsseln eines mobilkommunikationssystemendgeräts und verfahren zu ihrer realisierung
EP02784821A EP1406423B1 (en) 2001-07-12 2002-05-14 Network structure for encrypting of mobile communication system terminal and the method of realizing it

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CNB011202602A CN1138366C (zh) 2001-07-12 2001-07-12 适用于移动通信系统终端加密的网络及其实现方法
CN01120260.2 2001-07-12

Publications (1)

Publication Number Publication Date
WO2003007569A1 true WO2003007569A1 (fr) 2003-01-23

Family

ID=4664021

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2002/000330 WO2003007569A1 (fr) 2001-07-12 2002-05-14 Structure de reseau pour crypter un terminal de systeme de communication mobile et procede de realisation de cette structure

Country Status (5)

Country Link
EP (1) EP1406423B1 (zh)
CN (1) CN1138366C (zh)
AT (1) ATE389289T1 (zh)
DE (1) DE60225557T2 (zh)
WO (1) WO2003007569A1 (zh)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
GB2402583A (en) * 2003-05-19 2004-12-08 Nec Corp Cryptographic initialisation wherein RNC server instructs one communication partner to add an encryption flag to and begin encrypting its communications
JP2009527233A (ja) * 2006-02-24 2009-07-30 セーホーエル．ハンセン アクティーゼルスカブ 発酵乳製品に改良された舌ざわり（ｔｅｘｔｕｒｅ）を提供する乳酸菌
GB2535749B (en) * 2015-02-26 2021-10-20 Eseye Ltd Authentication module

Families Citing this family (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7711948B2 (en) * 2003-09-30 2010-05-04 Cisco Technology, Inc. Method and apparatus of communicating security/encryption information to a physical layer transceiver
KR20080046129A (ko) * 2006-11-21 2008-05-26 이노베이티브 소닉 리미티드 무선통신시스템에서 안전검증 에러를 복구하는 방법 및장치
CN101179595B (zh) * 2007-12-10 2011-05-04 中国科学院计算技术研究所 一种无线通信数据收发设备和系统及数据处理方法
EP2235977B1 (en) * 2008-01-21 2018-02-28 Telefonaktiebolaget LM Ericsson (publ) Abstraction function for mobile handsets
CN101594374B (zh) * 2008-05-29 2013-07-10 上海贝尔股份有限公司 无线通信系统中的新的l2结构及相应的通信方法和系统
US10009287B2 (en) 2013-12-26 2018-06-26 Huawei Technologies Co., Ltd. Hierarchical software-defined network traffic engineering controller

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
DE4408035A1 (de) * 1994-03-10 1995-09-14 Sel Alcatel Ag Kommunikationsrechner
US5657390A (en) * 1995-08-25 1997-08-12 Netscape Communications Corporation Secure socket layer application program apparatus and method
CN1275744A (zh) * 2000-07-20 2000-12-06 成都久力信息技术有限公司 计算机应用层网络安全控管系统及其相关程序方法
WO2001001644A1 (en) * 1999-06-29 2001-01-04 Samsung Electronics Co., Ltd. Apparatus for securing user's information in a mobile communication system connected to the internet and method thereof

Family Cites Families (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN100452700C (zh) * 1998-07-03 2009-01-14 诺基亚公司 用于建立保密连接的存储卡和无线通信设备
KR100319256B1 (ko) * 1999-12-30 2002-01-05 서평원 통신 프로토콜 운용 방법

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
DE4408035A1 (de) * 1994-03-10 1995-09-14 Sel Alcatel Ag Kommunikationsrechner
US5657390A (en) * 1995-08-25 1997-08-12 Netscape Communications Corporation Secure socket layer application program apparatus and method
WO2001001644A1 (en) * 1999-06-29 2001-01-04 Samsung Electronics Co., Ltd. Apparatus for securing user's information in a mobile communication system connected to the internet and method thereof
CN1275744A (zh) * 2000-07-20 2000-12-06 成都久力信息技术有限公司 计算机应用层网络安全控管系统及其相关程序方法

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
GB2402583A (en) * 2003-05-19 2004-12-08 Nec Corp Cryptographic initialisation wherein RNC server instructs one communication partner to add an encryption flag to and begin encrypting its communications
GB2402583B (en) * 2003-05-19 2005-07-27 Nec Corp Cryptographic communication method in communication system
US7400730B2 (en) 2003-05-19 2008-07-15 Nec Corporation Cryptographic communication method in communication system
JP2009527233A (ja) * 2006-02-24 2009-07-30 セーホーエル．ハンセン アクティーゼルスカブ 発酵乳製品に改良された舌ざわり（ｔｅｘｔｕｒｅ）を提供する乳酸菌
GB2535749B (en) * 2015-02-26 2021-10-20 Eseye Ltd Authentication module

Also Published As

Publication number Publication date
EP1406423A1 (en) 2004-04-07
DE60225557T2 (de) 2009-04-02
CN1396731A (zh) 2003-02-12
ATE389289T1 (de) 2008-03-15
EP1406423B1 (en) 2008-03-12
CN1138366C (zh) 2004-02-11
DE60225557D1 (de) 2008-04-24
EP1406423A4 (en) 2006-12-20

Similar Documents

Publication Publication Date Title
KR101507482B1 (ko) Ｌｔｅ 모바일 유닛에서의 비접속 계층(ｎａｓ) 보안을 가능하게 하는 방법 및 장치
US7613920B2 (en) Mechanism to avoid expensive double-encryption in mobile networks
CN101335740B (zh) 发送、接收数据的方法和系统
US7107051B1 (en) Technique to establish wireless session keys suitable for roaming
CA2443688A1 (en) Authentication and encryption method and apparatus for a wireless local access network
EP1943812A1 (en) Method, system and readable medium for setting up secure direct links between wireless network stations using direct link set-up (dls) protocol
US20120272310A1 (en) Systems and methods for secure communication over a wireless network
CN102144371A (zh) 选择性地加密控制信号的方法
KR20080013906A (ko) 키이 물질의 교환
EP1156694A1 (en) Radio communication device and radio communication method
JP2012010254A (ja) 通信装置、通信方法及び通信システム
WO2017092092A1 (zh) 一种端加密传输的密钥管理的方法及装置
WO2003007569A1 (fr) Structure de reseau pour crypter un terminal de systeme de communication mobile et procede de realisation de cette structure
CN108966217B (zh) 一种保密通信方法、移动终端及保密网关
CN102083062B (zh) 业务流加密处理方法及系统
CN105827601A (zh) 移动设备数据加密应用方法及系统
KR20030050881A (ko) 무선랜 시스템에서의 암호키 관리 방법
JPH11203222A (ja) 暗号通信方法
KR100594022B1 (ko) 무선 네트워크 시스템의 무선링크제어 계층에서 데이터암호화방법 및 암호해제방법
CN117201200B (zh) 基于协议栈的数据安全传输方法
JP2004349775A (ja) 秘密保持通信機能を有する携帯端末及びその携帯端末を用いた情報処理システム
KR970056178A (ko) Time Quantum 키 분배방식을 이용한 SP2 LAN 정보보호 프로토콜
JP2004186939A (ja) 暗号処理装置及び方法
CN118200920A (zh) 一种5g增强型安全架构
Hajji et al. Confidentiality in the UMTS radio access network simulation approach under OPNET

Legal Events

Date Code Title Description
AK Designated states

Kind code of ref document: A1

Designated state(s): AE AG AL AM AT AU AZ BA BB BG BR BY BZ CA CH CO CR CU CZ DE DK DM DZ EC EE ES FI GB GD GE GH GM HR HU ID IL IN IS JP KE KG KP KR KZ LC LK LR LS LT LU LV MA MD MG MK MN MW MX MZ NO NZ OM PH PL PT RO RU SD SE SG SI SK SL TJ TM TN TR TT TZ UA UG US UZ VN YU ZA ZM ZW

AL Designated countries for regional patents

Kind code of ref document: A1

Designated state(s): GH GM KE LS MW MZ SD SL SZ TZ UG ZM ZW AM AZ BY KG KZ MD RU TJ TM AT BE CH CY DE DK ES FI FR GB GR IE IT LU MC NL PT SE TR BF BJ CF CG CI CM GA GN GQ GW ML MR NE SN TD TG

121 Ep: the epo has been informed by wipo that ep was designated in this application
WWE Wipo information: entry into national phase

Ref document number: 2002784821

Country of ref document: EP

WWP Wipo information: published in national office

Ref document number: 2002784821

Country of ref document: EP

REG Reference to national code

Ref country code: DE

Ref legal event code: 8642

NENP Non-entry into the national phase

Ref country code: JP

WWW Wipo information: withdrawn in national office

Country of ref document: JP

WWG Wipo information: grant in national office

Ref document number: 2002784821

Country of ref document: EP