WO2007098690A1

WO2007098690A1 - A method and system for implementing packet broadcasting service key synchronization between multiple base stations

Info

Publication number: WO2007098690A1
Application number: PCT/CN2007/000631
Authority: WO
Inventors: Haining Wang; Haitao Du; Zhibin Lin; Changhong Shan
Original assignee: Huawei Technologies Co., Ltd.
Priority date: 2006-03-01
Filing date: 2007-02-28
Publication date: 2007-09-07
Also published as: CN101030849A; CN101030849B

Abstract

A method and system for implementing packet broadcasting service key synchronization between multiple base stations, first, it establishes a synchronous reference time between multiple base stations and a key management center (11), then, synchronizing time information, which used for confirming the time that when start to use a new key, is sent from the key management center to each base station (13), so that, each base station could confirm the start-used time of the new key distributed by the key management center according to the received synchronizing time information (14), and start to use the new key at the confirmed time, so as to make each base station start to use the new key synchronously. This method and its system make the packet broadcasting information received from different base station at a random time is all encrypted by the same packet broadcasting key, thus ensure it implementing macro-diversity technology in a wireless communication system.

Description

TECHNICAL FIELD The present invention relates to the field of wireless communications technologies, and in particular, to a method and system for implementing multicast key synchronization between base stations in a wireless communication network. BACKGROUND OF THE INVENTION At present, most wireless communication networks adopt a cell structure in a network design, and a base station is provided for each cell, and a user of the cell can complete communication with the network side through the base station. Meanwhile, in the wireless communication network, in order to ensure the continuity of user communication, the coverage areas of adjacent cells are usually set to overlap each other.

Due to the mobility of mobile terminals, they often switch between different cells. When the user crosses different cells, if the quality of the communication is to be maintained, the user needs to request a channel from the neighboring cell to implement the handover process. In the process of handover, the mobile station will simultaneously receive the same information transmitted from two or more base stations, and needs to perform diversity combining and decision on the received information, thereby improving the received signal when the mobile station is in handover. Quality, to ensure that data is not lost during handover, this diversity implementation technique is called macro-diversity.

Currently, the implementation of the macro diversity technique is supported in wireless communication networks such as WiMAX (Worldwide Interoperability for Microwave Access). That is, MBS (Multicast Broadcast Service) based on WiMAX network supports multi-base station access mode. In the multi-base station access mode, the base station in one MBS area will use the same CID (connection identifier) and SA (security association) to send the content of the same MBS service flow, so that the terminal that has registered the MBS service can be in the MBS area. The MBS content is received by a plurality of base stations, that is, the terminal also supports the macro diversity technique.

At the same time, in the wireless communication network, in order to ensure the security of the wireless multicast communication, the multicast data transmitted by the air interface is encrypted by using the multicast key. A wireless communication system based on the 802.16e protocol is a sub-example. The encryption of multicast data requires four multicast keys, specifically: MAK (Multicast Broadcast Service Authentication Key), MGKEK (Multicast) Broadcast service group key encryption key), MGTEK (multicast broadcast service group service encryption key), MTK (multicast broadcast service service encryption key). The MAK is transmitted to the terminal by some method defined by the upper layer. MGTEK is encrypted by MGKEK and then transmitted to the terminal. MAK and MGTEK calculate MTK through an algorithm (such as Dotl6KDF algorithm), and MTK is directly used to encrypt and decrypt the multicast data.

In order to prevent the key leakage from threatening the security of multicast communication, the multicast key needs to be periodically replaced. At the same time, in order to ensure the continuity of the session, the base station needs to have the ability to maintain two sets of keys, that is, it is required to obtain a new key from the superior distribution entity before the end of the old key lifetime, so as to ensure that when the old key expires, Replace the new key immediately. Still taking the WiMAX network as an example, a plurality of base stations in an MBS zone during the key update period, the base station that has completed the update will encrypt the multicast data using the new key, and the base station that has not completed the key update will still use the old key. The multicast data is encrypted. Therefore, if the synchronization of the key update is not implemented between the base stations, the keys used in different base stations in the same MBS area at the same time may be different, so that the multicast communication cannot be performed normally.

That is to say, in the MBS area, in order to ensure reliable communication, the multicast keys used by the multiple base stations for synchronously transmitting MBS service flows for encrypting the MBS service flow should be synchronized. However, the synchronization of multicast keys between different base stations cannot be guaranteed at present, and thus the implementation of macro diversity technology in a wireless communication network cannot be guaranteed, thereby reducing the communication performance and reliability of the wireless communication system. SUMMARY OF THE INVENTION Embodiments of the present invention provide a method and system for implementing multicast key synchronization between multiple base stations, so that a group of base stations in a wireless communication network can ensure a multicast key used for service transmission. Synchronization, thereby ensuring the reliability of communication in a wireless communication system.

The embodiment of the invention provides a method for implementing multicast key synchronization between multiple base stations, including:

Establishing a synchronization reference time between the plurality of base stations and the key management center;

The key management center sends to each base station synchronization time information that can be used to determine the activation time of the new key; at each base station, the activation time of the new key distributed by the key management center is determined according to the received synchronization time information, and The new key is enabled at a determined time.

The embodiment of the present invention provides a system for implementing multicast key synchronization between multiple base stations, including a synchronization reference time processing module, a key distribution processing module, and a key enabling processing module, where

The synchronization reference time processing module is respectively disposed on each base station and the key management center, and is used for establishing a reference time for synchronizing each base station with the key management center;

The key distribution processing module is disposed in the key management center, and is configured to generate a new key and corresponding synchronization time information for each base station, and send the information to each base station separately;

The key activation processing module is configured to be configured in the base station, configured to determine an activation time according to the corresponding synchronization time information of the received new key, and enable the new key when the activation time is reached.

An embodiment of the present invention provides a key management center, including a synchronization reference time processing module and a key distribution processing module, where

Synchronous reference time processing module: a reference time for establishing synchronization with each base station;

Key distribution processing module: used to generate a new key and corresponding synchronization time information for each base station, and respectively Send to each base station.

An embodiment of the present invention provides a base station, including a synchronization reference time processing module and a key enable processing module, where

a synchronization reference time processing module: a reference time for establishing synchronization with the key management center; a key enable processing module: configured to determine a new one based on synchronization time information corresponding to the new key received from the key management center The time the key was enabled, and the new key is enabled when the activation time is reached.

It can be seen from the technical solutions provided by the foregoing embodiments of the present invention that the implementation of the implementation of the present invention enables the multicast information received from different base stations at any time to be encrypted by using the same multicast key, so that the merge can be directly determined. These signals effectively support the macro diversity signal receiving mode, that is, the macro diversity technology is guaranteed to be implemented in the wireless communication system, and the reliability of the wireless system communication can be improved. The embodiments of the present invention can be applied to a wireless communication network such as WiMAX, and the implementation scheme of the synchronization of the inter-base station multicast keys in the MBS area provided by the embodiment of the present invention is simple and easy to implement. BRIEF DESCRIPTION OF THE DRAWINGS FIG. 1 is a flow chart 1 of a specific embodiment of a method according to an embodiment of the present invention;

2 is a flowchart of a specific implementation manner of a method according to an embodiment of the present invention

3 is a flowchart of a specific implementation manner of a method according to an embodiment of the present invention.

4 is a flowchart of a specific implementation manner of a method according to an embodiment of the present invention.

FIG. 5 is a flowchart of a specific implementation manner of a method according to an embodiment of the present invention

FIG. 6 is a schematic structural diagram of a specific implementation of a system according to an embodiment of the present invention.

Mode for Carrying Out the Invention An object of the embodiments of the present invention is to provide a scheme for synchronizing multicast keys between base stations in an MBS area, so that multicast information received from different base stations at any time is encrypted by using the same multicast key. .

The technical solution adopted by the embodiment of the present invention is as shown in FIG. 1 , and specifically includes:

Step 11: Establish a synchronization reference time for all base stations in the MBS area to synchronize with the MBS key management center. The purpose of the synchronization reference time is to enable each base station to accurately synchronize and enable the new multicast key according to the instruction of the key management center. In the embodiment of the present invention, the reference time may be a system time synchronized by each base station and a key management center, or an MBS reference time set for the MBS service synchronization. Moreover, in the embodiment of the present invention, strict synchronization is not required between the base station and the key management center, and only a synchronized time reference is needed to ensure synchronization of the new multicast key; for example, the key management center It is possible to achieve strict synchronization without receiving a GPS signal, and it is only necessary to set a reference time corresponding to the absolute GPS time as the synchronization reference time between the base station and the key management center. That is to say, there is no need to implement strict synchronization between the base station and the key management center as between different base stations, but only a relatively synchronous reference time is needed.

Step 12: The MBS key management center sets the synchronization time SyncTime attribute information, that is, the synchronization time information, for the multicast key, and the synchronization time is used as the time for the base station to determine to enable the new multicast key. Synchronization time for different meanings:

(1) The synchronization time may be synchronization time information indicating that the new multicast key is enabled, that is, the value of the synchronization time identifies a reference time for enabling the new multicast key.

Or,

(2) The synchronization time may also be synchronization time information indicating a lifetime end time of the current multicast key, that is, the synchronization time identifies the lifetime end time of the corresponding multicast key, in the currently used group. When the lifetime end time of the broadcast key arrives, it is determined as the time when the base station enables the new multicast key;

Step 13: When the MBS Key Management Center needs to distribute the key, the MBS Key Management Center will include the synchronization time attribute information of the key in the message of the distribution key, thereby sending the key and its synchronization time information together. Base stations in the MBS area;

Step 14: Each base station in the MBS area determines the activation time of the new key according to the synchronization time attribute information received by the base station, and specifically includes the following two processing situations:

(1) When the synchronization time identifies a reference time when the new multicast key is enabled, each base station in the MBS zone enables the reference time according to the reference time recorded in the synchronization time attribute corresponding to the received new multicast key. Multicast key; At this time, each base station in the MBS area can compare the reference time and the value of the synchronization time attribute of the key to determine the exact time when the new key is enabled, that is, when the reference time reaches the synchronization time value, Enable the new key;

(2) When the synchronization time identifies the lifetime end time of the new multicast key, each base station in the MBS zone will determine a new one according to the synchronization time corresponding to the currently used multicast key received by the base station. The activation time of the key; at this time, each base station in the MBS area can determine, according to the synchronization time, that the new multicast key is enabled at the end of the life cycle of the currently used multicast key; that is, the new group The lifetime end time of the broadcast key is used to determine the activation time of the next updated multicast key.

After the foregoing processing, the embodiment of the present invention can ensure that each base station can synchronously enable a new multicast key, so that the multicast keys used between the base stations are synchronized. The specific implementation manners of the embodiments of the present invention are described in detail below with reference to the accompanying drawings. The following is a description of a specific implementation manner of the technical solution provided by the embodiment of the present invention. The premise of the embodiment of the present invention is that all base stations in the MBS area are densely connected with the MBS by using the GPS method. The key management center implements reference time ReferenceTime synchronization. After the base station is synchronized with the MBS key management center, the MBS key management center can perform the initial distribution processing of the multicast key. As shown in FIG. 2, the processing process specifically includes:

Step 21: The MBS Key Management Center acquires the MAK from the upper MAK distribution entity, and manages the MAK according to the MAK lifetime; Step 22: The MBS Key Management Center generates two sets of new and old keys: MGKEK0, MGKEKK MGTEKO, MGTEKK MTK0, MTK1, and Corresponding parameters; and establish MBSGSA (MBS group security association identifier, used to uniquely identify a MBSGSA);

Step 23: The MBS Key Management Center generates respective synchronization time SyncTimes for MGGEK1 and MGTEK1; Step 24: The MBS Key Management Center generates a key distribution message MBS_KEY_DELIVER according to the format specified in Table 1, that is, the message includes synchronization Time information and two sets of old and new keys, and send the message to all base stations in the corresponding MBS area;

The specific format of the MBS_KEY_DELIVER message is as follows: '

{ Message Type = 0x00,

Code=00,

MBSGSA ID,

MBS Zone ID,

MGKEKO - Parameters ,

MG EK 1 -Parameters,

MGTEKO - Parameters,

MGKEK1— Parameters,

MTKO- Parameters,

MTK 1 -Parameters,

MGKEK1 SyncTime,

MGTEK1 SyncTime } Grammar length comment

MBS—KEY_DELIVER_Message—Format ( ) {

0x00 indicates that this message type is multicast secret.

Message Type~0x00 8 bit key distribution message. 0x02 to OxFF are reserved values that define other message types.

Code 2 bit

MBSGSA ID 16 bit

00: GKE, MGTEK, MTK initial points

If (Code =00) {

Hair (2 sets each)

MBS Zone ID

MGKEK-Parameters old MGKEK parameters

MGKEK- Parameters New MGKEK parameters

MGTEK- Parameters Old MGTEK Parameters

MGTEK - P arameters new MGTEK parameters

MTK-Parameters old MTK parameters

MTK- Parameters New MTK parameters

SyncTime new MGKEK synchronization time

SyncTime } New MGTEK synchronization time

Else if (Code=01) { 01: MGKEK update

MGKEK- Parameters New MGKEK parameters

SyncTime } New MGKEK synchronization time

Else if (Code= 10) { 10: MGTEK and MTK updates

MGTEK- Parameters New MGTEK parameters

MTK- Parameters New MTK parameters

SyncTime } New MGTEK synchronization time

Code=ll : MGKEK, MGTEK, MTK

Else {

Also update

MGKEK-Parameters new MGKEK parameters

MGTEK- Parameters New MGTEK parameters

MTK— Parameters New MTK parameters

SyncTime new MGKEK synchronization time

SyncTime } New MGTEK synchronization time It should be noted that the MTK can also be generated on the BS, and the MAK and MGTEK can be transmitted to the BS. The BS generates the MTK. At this time, the MTK parameters will no longer be included in Table 1.

Step 25: After receiving the MBS-KEY-DELIVER message, the base station stores each key and related parameters, and activates the old key with the small serial number: MGKEK0, MGTEK0, MTK0.

Step 26: Since the synchronization time of the new keys MGKEK1 and MGTEK1 is later than the current reference time, the base station starts a reference time timer for each of the two keys, namely: MGKEK_Timer, MGTEKj:imer.

Step 27: When the corresponding timer expires, the old key is deactivated, and the new key is enabled; specifically: When MGGEK_Timer=MGKEKl SyncTime, the base station immediately deactivates the old key MGGEK0, and starts to use the new key. MGKEK1 ; When MGTEK_Timer=MGTEKl SyncTime, the base station immediately deactivates the old keys MGTEK0 and MTK0 and starts to use the new keys MGTEK1 and MTK1. In the embodiment of the present invention, the process of performing the update process of the multicast key for the communication process is performed by taking an update of the MGTEK as an example. As shown in FIG. 3, the corresponding update process specifically includes: Step 31: Currently used Before the end of the old key MGTEKn-1, the MBS key management center generates new keys MGTEKn, MTKn and its parameters, and generates the synchronization time of MGTEKn;

Step 32: The MBS key management center generates a key distribution message MBS_KEY_DELIVER according to the format as specified in Table 1, and sends the message to all base stations in the corresponding MBS area;

The format of the MBS-KEY-DELIVER message is as follows:

{ Message Type = 0x00,

Code= 10,

MBSGSA ID,

MGTEKn- Parameters,

MTKn-Parame ters

MGTEKn SyncTime, }

Step 33: After receiving the MBS_KEY_DELIVER message, the base station stores MGTEKn, MTKn and related parameters, and starts the reference time timer for MGTEKn: MGTEKJTimer.

Step 34: When MGTEKJTimer = MGTEKn SyncTime, the base station immediately deactivates MGTEKn-1 and MTKn-1 and starts using MGTEKn and MTKn. In the embodiment of the present invention, if the base station fails to receive a new key within a predetermined time before the end of the lifetime of a certain key, the key may be actively applied to the key management center.

The following takes a process in which a base station applies for MGGEK as an example, and describes the specific implementation of the corresponding processing. Ming, as shown in Figure 4, specifically includes:

Step 41: The base station generates a multicast key request message MBS_KEY_REQUEST according to the format as specified in Table 2, and sends the message to the MBS key management center;

The format of the MBS-KEY-REQUEST message is as follows:

{ Message Type = 0x01 ,

Code=01,

MBSGSA ID }

Table 2

Step 42: After receiving the multicast key request message of the base station, the MBS key management center generates the following MBS_KEY_DELIVER message according to the format specified in Table 1, and returns the message to the base station requesting the multicast key;

The format of the MBS-KEY-DELIVER message is as follows:

{ Message Type =0x00,

Code = 01,

MBSGSA ID,

MGKE m-Parameter s ,

MGKEKm SyncTime, }

Step 43: After receiving the MBS_KEY_DELIVER message, the base station stores the MGWEKm and related parameters, and starts the reference time timer for the MGWEKm: MGKEKJTimer.

Step 44: When MGGEK_Timer=MGKEKm SyncTime, the base station immediately deactivates the old key MGWEKm-1 and starts to use the new key MGGEKm. In the embodiment of the present invention, if there is a newly added base station, or a certain base station needs to acquire a multicast key for some reason, as shown in FIG. 5, the specific processing procedure includes the following steps:

Step 51: The base station that needs to obtain the multicast key newly generates a multicast key request message MBS_KEY_REQUEST according to the format as specified in Table 2, and sends the message to the MBS key management center to request to acquire the corresponding multicast. Key information

The format of the MBS-KEY-REQUEST message is as follows:

{ Message Type =0x01 ,

Code = 00,

MBSGSA ID }

Step 52: Referring to step 24 described in FIG. 2, the generated MBS_KEY_DELIVER message is replied to the base station requesting the multicast key;

Steps 53-55: The processing of these steps is the same as the processing of steps 25-27 in Fig. 2, and therefore will not be described in detail here. The embodiment of the present invention further provides a system for implementing multicast key synchronization between multiple base stations, where the system includes a key management center and a plurality of base stations. The specific implementation manner is as shown in FIG. 6 , and specifically includes the following components:

(1) Synchronous reference time processing module

They are respectively disposed on each base station and the key management center, and are used to establish a reference time for synchronizing each base station with the key management center;

(2) Key distribution processing module

The key management center is configured to generate a new key and corresponding synchronization time information for each base station, and send the information to each base station separately;

The key distribution processing module specifically includes the following three component modules:

Key generation module: used to generate a new key for the key period of the currently used key of each base station before the end of its life cycle;

The synchronization time determination module: determines a corresponding synchronization time for the key generated by the key generation module; the key transmission processing module: the new key generated by the key generation module and the synchronization time determination module determines the corresponding synchronization of the key The time information is transmitted to each base station by generating a key distribution message.

(3) Key enablement processing module

The base station is configured to determine an activation time according to the corresponding synchronization time information of the received new key, and enable the new key when the activation time is reached. The key activation processing module specifically includes the following three components:

Key receiving module: configured to receive a new key sent by the key management center and its corresponding peer time information; a timer: start a timer according to the synchronization time information;

Key enablement module: Enables the key received by the key receiving module triggered by the timer. In summary, the implementation of the implementation of the present invention enables the multicast information received from different base stations at any time to be encrypted with the same multicast key, so that the combined signals can be directly determined and effectively supported. Macro-set signal reception mode, which guarantees the realization of macro-diversity technology in wireless communication systems, and can improve the reliability of wireless system communication. That is, the embodiment of the present invention solves the problem of multicast key synchronization between base stations on the basis of the reference time synchronization between the base stations in the MBS area, so as to ensure that the multicast signals received from the base stations in the MBS area at any time are all The same multicast key encryption is used to support macro diversity. The embodiments of the present invention are specifically applicable to a wireless communication network such as WiMAX. Moreover, the implementation scheme for synchronizing the inter-base station multicast keys in the MBS area provided by the embodiment of the present invention has the advantages of being simple and easy to implement.

The above is only a preferred embodiment of the present invention, but the scope of the present invention is not limited thereto, and any person skilled in the art can easily think of changes or within the technical scope disclosed by the present invention. Alternatives are intended to be covered by the scope of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

Right

A method for implementing multicast key synchronization between multiple base stations, comprising:

The method according to claim 1, wherein the step of establishing a synchronized reference time between the base station and the key management center comprises:

Synchronizing the respective system time between the plurality of base stations and the key management center to establish a synchronized reference time; or

A corresponding synchronization reference time is specifically established between the plurality of base stations and the key management center.

3. The method according to claim 1, wherein the step B comprises:

The key management center carries the key to be distributed to each base station and the synchronization time information in the same message and sends it to each base station, and when the base station is initially a sub-key, it needs to be simultaneously carried in the message. Old key and new key.

4. The method according to claim 3, wherein the step of transmitting synchronization time information usable for determining the activation time of the new key comprises:

The key management center determines corresponding synchronization time information for the key encryption key and the service encryption key to be distributed to each base station, and distributes the message through the key together with the key encryption key and the service encryption key. Send to each base station.

The method according to claim 1, wherein the step of transmitting the synchronization time information that can be used to determine the activation time of the new key comprises:

When the key management center distributes the key to each base station, the corresponding time information of the corresponding new key for enabling the distribution is also sent to each base station;

Or,

When the key management center distributes the key to each base station, the life cycle end time of the key is also sent to each base station, and each base station uses the end time as the time when the base station activates the new key.

6. The method according to claim 1, 2, 3, 4 or 5, wherein the step of enabling the new key comprises - after each base station receives a new key, in a new The corresponding to the key indicates that the synchronization time when the key is enabled is reached. Then enable the new key;

Or,

After each base station receives the new key, the new key is enabled when the synchronization time corresponding to the currently used key indicates the end of its life cycle.

The method according to claim 6, wherein the step of enabling the new key comprises:

After receiving the new key, each base station starts a corresponding timer according to the received synchronization time information indicating that the new key is enabled and the current reference time information, and enables the new secret when the timer expires. Key, to activate the original key;

Or,

When receiving the currently used key, each base station starts a corresponding timer according to the received synchronization time information indicating the end of the current key life cycle and the reference time information at the time, and enables each base station to receive when the timer expires. The new key, to deactivate the current key used.

The method according to claim 6, wherein the method further comprises:

Before the end of the life cycle corresponding to the original key, the key management center generates a corresponding new key and corresponding synchronization time information, and sends the new key and the corresponding synchronization time information to each base station.

The method according to claim 8, wherein the method further comprises:

Before the end of the life cycle of the currently used key, and the base station does not receive a new key, it actively requests the key management center for the key.

The method according to claim 9, wherein the step of actively applying for a key to the key management center comprises:

The base station sends a multicast key request message to the key management center, where the message carries the multicast broadcast service group security association identifier information;

After receiving the request message, the key management center generates a corresponding new key and corresponding synchronization time information according to the multicast broadcast service group security association identifier information, and sends the new information to each base station. Key and corresponding synchronization time information.

A system for implementing multicast key synchronization between multiple base stations, comprising: a synchronization reference time processing module, a key distribution processing module, and a key enable processing module, wherein

The synchronization reference time processing module is respectively disposed on each base station and the key management center, and is used for establishing a reference time for synchronizing each base station with the key management center; The key distribution processing module is disposed in the key management center, and is configured to generate a new key and corresponding synchronization time information for each base station, and send the information to each base station separately;

The system according to claim 11, wherein the key distribution processing module includes a key generation module, a synchronization time determination module, and a key transmission processing module, where

The peer time determination module: determines a corresponding synchronization time for the key generated by the key generation module;

The key transmission processing module sends the new key generated by the key generation module and the corresponding synchronization time information determined by the synchronization time determination module to the base station through the key distribution message.

The system according to claim 11 or 12, wherein the key activation processing module comprises a key receiving module, a timer, and a key enabling module, wherein

a key receiving module: configured to receive a new key sent by the key management center and corresponding synchronization time information thereof; a timer: start a timer according to the synchronization time information;

Key enablement module: Enables the key received by the key receiving module triggered by the timer.

A key management center, comprising: a synchronization reference time processing module and a key distribution processing module, wherein

The key distribution processing module is configured to generate a new key and corresponding synchronization time information for each base station, and send the information to each base station.

The key management system according to claim 14, wherein the key distribution processing module includes a key generation module, a synchronization time determination module, and a key transmission processing module, where

a synchronization time determining module: determining a corresponding synchronization time for a key generated by the key generation module;

A base station, comprising: a synchronization reference time processing module and a key enable processing module, wherein a synchronization reference time processing module: a reference time for establishing synchronization with the key management center; a key activation processing module: configured to determine a new one based on synchronization time information corresponding to the new key received from the key management center The time the key was enabled, and the new key is enabled when the activation time is reached.

The base station according to claim 6, wherein the key activation processing module includes a key receiving module, a timer, and a key enabling module, where