WO2007104259A1

WO2007104259A1 - method for implementing secure assurance in an Enhanced Access Network and the system thereof

Info

Publication number: WO2007104259A1
Application number: PCT/CN2007/000813
Authority: WO
Inventors: Binsong Tang; Jing Chen
Original assignee: Huawei Technologies Co., Ltd.
Priority date: 2006-03-16
Filing date: 2007-03-14
Publication date: 2007-09-20
Also published as: CN101039314B; CN101039314A

Abstract

A method for implementing security assurance in an Enhanced Access Network includes: a UE and the Enhanced Access Network set at least one counter respectively, wherein the counter is used to count the data stream transmitted between the UE and the Enhanced Access Network; the Enhanced Access Network initiates the data stream checking when the set conditions are satisfied; the UE or the Enhanced Access Network compares the counter value maintained by itself with the counter value provided by the opposite terminal; the Enhanced Access Network performs the proceeding process according to whether the checking result of the counters whose values are conflicting exists, which can assure the security of the Enhanced Access Network according to the checking result. There is also the corresponding system. Furthermore, the information, signaling, or message transmitted between the UE and the Enhanced Access Network all use the secret key shared between the UE and the Enhanced Access Network to perform the integrality protection, and the periodical local authentication is further achieved through the integrality protection.

Description

Method and system for realizing security guarantee in evolved access network This application claims to be submitted to the Chinese Patent Office on March 16, 2006, with the application number of 200610057590.7, and the invention name is "A security in an evolved access network." The priority of the Chinese Patent Application for the Method of Sexual Assurance, the entire contents of which is hereby incorporated by reference. Technical field

The present invention relates to network and communication technologies, and more particularly to the field of network security technologies, and in particular, to a method and system for implementing security assurance in an evolved access network. Background technique

In order to maintain the competitiveness of the 3GPP (3GPP) 3rd Generation Partnership Project access system, LTE (Long Term Evolution) and System Architecture Evolution (SAE) are underway. Research. The goal of network evolution is to simplify the network structure and reduce the access time delay.

Figure 1 shows the architecture of the LTE/SAE access network. As shown in Figure 1, the aGW (E-UTRAN Access Gateway) is an E-UTRAN (Enhanced Universal Terrestrial Radio Access Network). The ingress gateway is located in a secure physical location. The eNodeB or the evolved Node B is an evolved base station in the E-UTRAN, which is in an insecure physical location and is highly likely to be attacked.

Since the channel on the air interface is an extremely unstable channel, the possibility of packet loss on this channel is very high; in addition, due to the wireless nature of the air interface, an attacker can easily initiate packet insertion on the air interface. In addition, the eNodeB is in an insecure physical location and is highly vulnerable to malicious attacks. Therefore, it is not necessary to provide a security guarantee in E-UTRAN to ensure user terminals (UE, User Equipment). ) The amount of upstream and downstream data is consistent with E-UTRAN. Summary of the invention

An embodiment of the present invention provides a method and a system for implementing security assurance in an evolved access network, and checking whether the amount of data transmitted between the UE and the access network is consistent, so as to further determine an evolved access network according to the check result. safety.

Embodiments of the present invention provide a method for implementing security assurance in an evolved access network, which is used by The client and the network side are respectively provided with at least one counter for counting the amount of data transmitted between the UE and the evolved access network, and the method includes the following steps:

Counting the amount of data transmitted between the user terminal UE and the access network at the user end and the network side, respectively;

Comparing the amount of data transmitted between the user terminal UE and the access network counted by the UE and the network side counter;

Corresponding processing is performed according to the comparison result.

The embodiment of the invention further provides a system for implementing security guarantee in an evolved access network, including:

a first counter, configured on the user side, for counting the amount of data transmitted between the UE and the access network;

a second counter, configured on the network side, for counting the amount of data transmitted between the UE and the access network;

a determining unit, configured to compare data volume values transmitted between the UE and the access network calculated by the first and second counters;

The processing unit performs corresponding processing according to the comparison result of the determining unit.

In the technical solution provided by the embodiment of the present invention, the UE and the evolved access network respectively maintain one or more counters, where the counter value is used to indicate the amount of data transmitted between the ΌΈ and the evolved access network, and the evolved access network is in the When the setting condition is met, the data volume check is initiated to the UE, and the UE or the evolved access network compares the counter value provided by the peer end with the counter value maintained by the peer, and the evolved access network performs subsequent processing according to the comparison result of the counter value, to Determine the security of the evolved access network.

In addition, the information or signaling and the message transmitted between the UE and the evolved access network are integrity-protected by using a key shared between the UE and the evolved access network, and the periodic local authentication is further implemented by the integrity protection. DRAWINGS

The accompanying drawings are included to provide a further understanding of the invention

FIG. 1 is a schematic diagram of an LTE/SAE access network architecture; 2A is a flowchart of a method for detecting, by the UE side, whether the amount of received data is consistent with the amount of data sent by the network side to implement security guarantee in the embodiment of the present invention;

2B is a flowchart of a method for detecting, by a network side, whether the amount of received data is consistent with the amount of data sent by the network side to implement security guarantee in another embodiment of the present invention;

3 is a flowchart of a method for implementing security assurance in a first embodiment of the present invention; FIG. 4 is a flowchart of a method for implementing security assurance in a second embodiment of the present invention; FIG. 5 is a third embodiment of the present invention; FIG. 6B is a schematic diagram of a UE performing handover between different aGWs according to an embodiment of the present invention; FIG. 7 is a schematic structural diagram of a system for implementing security guarantee according to an embodiment of the present invention. detailed description

In order to make the objects, technical solutions and advantages of the present invention more apparent, the present invention will be further described in detail with reference to the accompanying drawings.

In the technical solution provided by the embodiment of the present invention, the UE and the evolved access network respectively maintain one or more counters, and the counter is used to count the amount of data transmitted between the UE and the evolved access network, that is, the counter value. As the amount of data transmitted between the UE and the evolved access network changes, the evolved access network initiates a data volume check to the UE when the set condition is met, and the UE or the evolved access network provides the counter value provided by the peer end. The counter values of the own are compared, and the evolved access network performs subsequent processing according to whether the counter value is the same or not.

The counter may be a counter, the counter value is used to indicate the amount of all data transmitted; it may be an uplink counter and a downlink counter, the uplink counter value is used to indicate the number of uplink data transmitted, and the downlink counter value is used to indicate the transmission. The number of downlink data; may also be a context counter, the context counter value is used to indicate the amount of data transmitted on a certain context; may also be a context uplink counter and a context downlink counter, and the context uplink counter value is used to represent a certain context. The number of uplink data transmitted, the context downlink counter value is used to indicate the amount of downlink data transmitted on a certain context.

The setting conditions described above may be such that the set period expires, or one or more counter values reach the set value, or an inspection command is received, and the like.

The user end of the evolved access network has an inconsistent value with its corresponding network side counter. When the follow-up process specifically includes:

If the counter value maintained by the UE is consistent with the counter value maintained by the evolved access network, the progress access network may end the current data volume checking process;

If the counter value maintained by the UE is inconsistent with the counter value maintained by the evolved access network, the evolved access network may release the connection between the UE and the evolved access network, or report an error to the upper layer.

2A is a schematic diagram of a first implementation manner of the present invention. As shown in FIG. 2A, the UE and the evolved access network respectively maintain one or more counters, and the counter value is used to indicate that the UE and the evolved access network are transmitted. The actual amount of data, including the following steps:

Step 201a: The evolved access network provides the UE with a counter value maintained by itself when the set condition is met. If there are multiple UE related counters maintained in the evolved access network and multiple counters need to be checked, the evolved access network may simultaneously provide some or all of the UE related counter values to the UE.

Step 202a: After receiving the counter value provided by the evolved access network, the UE compares the received counter value with its own counter value to determine whether the counter value is consistent. If the evolved access network simultaneously provides multiple counters to the UE, the UE compares the received counter value with its corresponding counter value. For example, the evolved access network simultaneously provides the uplink counter and the downlink counter to the UE, and the UE will The received uplink counter value is compared with its own uplink counter value, and the received downlink counter value is compared with its own downlink counter value.

Step 203a: The UE provides a check result to the evolved access network. Specifically, if the counter value is consistent, the UE may send an empty message to the evolved access network to notify the evolved access network that there is no counter with a value inconsistency; Inconsistent counters provide counters with inconsistent values to the evolved access network.

Step 204a: After receiving the check result, the evolved access network performs subsequent processing according to whether there is a counter with a value inconsistency.

If the evolved access network provides multiple counters to the UE, and the UE determines that there are partial counters with inconsistent values, the evolved access network may perform operations such as disconnection, 'reporting errors, etc. for counters with inconsistent values; Counter, no other processing is possible.

2B a schematic view of a second implementation of the present invention, ^2, UE and an evolved B shown in FIG. The access network maintains one or more counters respectively, and the counter value is used to indicate the amount of data transmitted between the UE and the evolved access network. The specific implementation includes the following steps:

Step 201b: The evolved access network initiates a check of the amount of data to the UE when the set condition is met.

Step 202b: After obtaining the check of the amount of data initiated by the evolved access network, the UE provides its own counter value to the evolved access network. If multiple counters are maintained in the UE and multiple counters are currently required to be checked, the UE may simultaneously provide some or all of the counter values to the evolved access network.

Step 203b: After receiving the counter value provided by the UE, the evolved access network compares the received counter value with its counter value to determine whether the counter value of the evolved access network is consistent with the counter value of the UE. If the UE simultaneously provides multiple counters to the evolved access network, the evolved access network compares the received counter with the corresponding counter maintained by itself, for example, the UE simultaneously provides an uplink counter and a downlink counter to the evolved access network. The evolved access network compares the received uplink counter with its own maintained uplink counter, and compares the received downlink counter with its own downlink counter.

Step 204b: The evolved access network performs subsequent processing according to whether the counter value of the UE is consistent with the counter value of the UE.

If the evolved access network provides multiple counters to the UE, and the UE determines that some of the counter values are inconsistent, the evolved access network may perform subsequent operations such as disconnection, reporting error, and the like, and may not perform counters with consistent values. Other processing.

In addition, when the evolved access network checks whether the amount of data transmitted between the UE and the evolved access network is consistent, the UE and the evolved access network may respectively provide the peer with a counter maintained by the peer, and then the peer will receive the counter. The counter is compared with the counter maintained by itself, and then the UE returns the check result to the evolved access network, and the evolved access network determines whether the received check result is consistent with the check result obtained by itself, if they are consistent, and there is a counter with an inconsistent value, The evolved access network may perform subsequent operations such as disconnecting related connections and reporting errors for counters with inconsistent values. If the counters are inconsistent and there are counters with inconsistent values, the evolved access network may check the amount of data transmitted by the UE again. .

As shown in FIG. 3, in the first embodiment of the present invention, the UE and the eNodeB respectively maintain one One or more counters, the counter value is used to indicate the amount of data transmitted between the UE and the eNodeB, and the specific implementation includes the following steps:

Step 301: The eNodeB sends a data volume check request to the UE when the set condition is met, where the data volume check request carries the counter value maintained by the eNodeB. If the eNodeB maintains multiple counters and currently needs to check multiple counters, the data volume check request may carry multiple counter values.

Step 302: After receiving the data volume check request, the UE compares the counter value carried in the data amount check request with its own counter value to determine whether the counter value is consistent.

Step 303: The UE returns a data volume check response to the eNodeB. If the corresponding two counter values are consistent, the data volume check response may be a message that does not carry any content, to notify the evolved access network that the corresponding two counter values are consistent. If the corresponding two counter values are inconsistent, the data amount check response carries a counter with a value inconsistency to notify the evolved access network.

Step 304: After receiving the data volume check response, the eNodeB performs subsequent processing according to whether there is a counter with a value inconsistency.

The embodiment described above is implemented by the first implementation manner, and may be implemented by the second implementation manner in practical applications.

As shown in FIG. 4, in the second embodiment of the present invention, the UE and the aGW respectively maintain one or more counters, and the counter value is used to indicate the amount of data transmitted between the UE and the aGW. The specific implementation includes the following steps:

Step 401: When the setting condition is satisfied, the aGW sends a data amount check request to the UE, and starts checking the data amount.

Step 402: After receiving the data volume check request, the UE returns a data volume check response to the aGW, where the data volume check response carries the counter value maintained by the UE. If there are multiple counters maintained in the UE and multiple counters need to be checked currently, the data volume check response carries some or all of the counter values.

Step 403: After receiving the data volume check response, the aGW compares the counter value carried in the data amount check response with the counter value maintained by itself, and determines whether there is a counter with a value inconsistency. Step 404: The aGW performs subsequent processing according to whether there is a counter with inconsistent values. The implementation of the present embodiment is described as being implemented by using the second implementation manner. In actual applications, the first implementation manner may also be implemented.

If the number of times the counter value is inconsistent in the check result reaches the set value, the aGW may report the UE abnormality to the core network (CN, Core Network), and the CN may load the corresponding UE into the blacklist and reject the UE from accessing the network. One of the times is to check the counter once, and the counter value is inconsistent, and the number of times may be continuously accumulated or may be discontinuously accumulated.

In the actual application, the manners in the first embodiment and the second embodiment may be combined to perform the check of the amount of data transmitted between the UE and the eNodeB, and the check of the amount of data transmitted between the UE and the aGW, and then the aGW is configured according to Two check results analyze the state of the eNodeB and the connection.

As shown in FIG. 5, in the third embodiment of the present invention, the UE and the eNodeB respectively maintain one or more counters, such as an N-Coimter, and the corresponding counter value is used to indicate the amount of data transmitted between the UE and the eNodeB, UE and The aGW maintains one or more counters respectively, such as a G-Counter, and the corresponding counter value is used to indicate the amount of data transmitted between the UE and the aGW. The specific implementation includes the following steps:

Step 501: According to the first implementation manner or the second implementation manner, the aGW checks the data volume transmitted between the UE and the aGW, and the aGW obtains the G-Counter check result.

Step 502 to step 503: According to the first implementation manner or the second implementation manner, the eNodeB checks the data volume transmitted between the UE and the eNodeB, and the eNodeB obtains the N-Counter check result, and then the eNodeB reports the N-Counter to the aGW. Inspection results.

Step 501 and step 502 to step 503 have no obvious execution order. Step 501 may be performed first, and then steps 502 to 503 may be performed. Steps 502 to 503 may be performed first, and then step 501 is performed; 501 and steps 502 to 503.

Step 504: It is determined whether the connection between the UE and the eNodeB is normal by checking the -Counter. By checking the G-Counter, it can be determined whether the connection between the eNodeB or the eNodeB and the aGW is normal. Therefore, the aGW can be The results of the -Counter and G-Counter check the status of the eNodeB and the connection. The specific analysis is as follows:

If the check results of N-Counter and G-Counter are the same, it indicates eNodeB, The connection between the UE and the eNodeB, and the connection between the eNodeB and the aGW are normal. If the N-Counter check result is consistent and the G-Counter check result is inconsistent, the connection between the UE and the eNodeB is normal, and the eNodeB or eNodeB is The connection between the aGWs is abnormal; since the N-Counter reflects the amount of data transmitted between the UE and the eNodeB over the air interface, the G-Counter reflects the amount of data transmitted between the UE and the aGW, and includes the air interface data transmission. The amount of network data transmission, therefore, as long as the N-Coimter inspection results are inconsistent, the G-Counter inspection results are inconsistent, even if the G-Counter inspection results are consistent, it is considered to be due to network errors, so that only N -Counter check results are inconsistent, regardless of whether the G-Counter check results are consistent, indicating that the wireless connection between the UE, or the UE and the eNodeB is abnormal;

If the check results of the N-Counter and the G-Counter are inconsistent, it indicates that the eNodeB, or the connection between the UE and the eNodeB, or the connection between the eNodeB and the aGW is abnormal.

The aGW may determine the subsequent operation according to the analysis result. For example, if the analysis result is an eNodeB abnormality, the aGW may notify the UE or the eNodeB to release the connection between the UE and the eNodeB, and further enable the UE to select another eNodeB to perform communication; if the analysis result is If the connection between the eNodeB and the aGW is abnormal, the connection with the eNodeB is released.

In addition, when the eNodeB reports the N-Counter check result to the aGW, if the number of counters in which the value of the N-Counter or the G-Counter check result is inconsistent reaches the set value, the aGW may report to the CN, and the CN may carry the corresponding UE. Blacklisting is denied, and the UE is denied access to the network.

In the above description, only the counters maintained between the UE and the eNodeB and between the UE and the aGW are distinguished by the N-Counter and the G-Counter, and are not used to define the names of the counters maintained by the eNodeB and the aGW.

The information or signaling and the message transmitted between the UE and the evolved access network are used for integrity protection by using a key shared between the UE and the evolved access network, and the periodic protection can be further implemented by the integrity protection. That is, the evolved access network or the UE sends the signaling to the peer to use the shared key for integrity protection. If the information of the peer matches the integrity-protected information, the peer passes the current local authentication.

In addition, when the UE performs handover between different eNodeBs or different aGWs, the UE is guaranteed. The counters maintained between the switched eNodeBs, or between the a and the switched aGWs are consistent, and the maintenance scheme for the counters is also proposed in the present invention.

As shown in FIG. 6A, the UE is switched from the source eNodeB to the target eNodeB, and the counters maintained by the target NodeB and the UE can be consistently implemented in three ways:

A processing method is that the target eNodeB requests the source eNodeB to provide a counter related to the UE that is maintained by the source eNodeB, and after receiving the request, the source eNodeB provides the target eNodeB with a counter related to the UE that is maintained by itself;

Another processing method is that the target eNodeB requests the UE to provide a counter maintained by the UE, and after receiving the request, the UE provides the target eNodeB with a counter maintained by itself;

The third processing method is that after the UE completes the handover of the eNodeB, it actively provides the counter to the target eNodeB for maintenance, and the counters maintained by the target eNodeB and the UE can be consistent under the normal conditions. The information or signaling and the message transmitted between the source eNodeB and the target eNodeB and between the UE and the target eNodeB are integrity protected by using a key shared between the two.

As shown in FIG. 6B, the UE is switched from the source aGW to the target aGW, so that the target aGW is

The counters maintained by the UE can be consistent and can be implemented in three ways:

A processing method is that the target aGW requests the source aGW to provide a counter related to the UE that is maintained by the source aGW. After receiving the request, the source aGW provides the target aGW with a counter related to the UE that is maintained by itself;

Another processing method is that the target aGW requests the UE to provide a counter maintained by the UE, and after receiving the request, the UE provides a counter maintained by the target aGW;

The third processing method is that after the UE completes the aGW handover, the UE actively provides a counter for maintaining the maintenance of the target aGW. The process described above enables the target aGW and the counter maintained by the UE to be consistent under normal conditions. The information or signaling and the message transmitted between the source aGW and the target aGW and between the UE and the target aGW are integrity protected by using a key shared between the two.

If the UE performs the aGW handover, the eNodeB needs to be switched. To keep the target eNodeB consistent with the counter maintained by the UE, the specific processing is the same as the description corresponding to FIG. 6A above. In the present invention, an evolved access network to which an evolved access network is located is referred to as an eNodeB, and an actual application may also be referred to as an evolved Node B. The function is the same whether it is called an eNodeB or an evolved Node B.

Referring to FIG. 7, the embodiment of the present invention further provides a system for implementing security assurance in an access network, including:

a first counter 701, configured on the user side, for counting the amount of data transmitted between the UE and the access network;

a second counter 702, configured on the network side, for counting the amount of data transmitted between the UE and the access network;

When the set condition is met, such as: the set period expires, the counter value reaches the set value, and the check command is received, and the amount of data transmitted between the UE and the access network is started to be counted, and the first counter and the second counter are counted. Counted as Countl, Count2.

The determining unit 703 is configured to compare data volume values transmitted between the UE and the access network calculated by the first and second counters;

The processing unit 704 performs corresponding processing according to the comparison result of the determining unit.

The amount of data transmitted between the UE and the access network counted by the first and second counters

When Countl and Count2 are the same, it is judged that the data transmission between the UE and the access network is normal;

When Countl and Count2 are different, the processing unit 704 disconnects the current connection or reports an error to the upper layer. The network performs the corresponding processing.

Preferably, the first and second counters use the shared key of both for integrity protection.

The above embodiments are intended to illustrate and explain the principles of the invention. It is to be understood that the specific embodiments of the present invention are not limited thereto. Various changes and modifications may be made without departing from the spirit and scope of the invention. Accordingly, the scope of the invention is defined by the claims.

Claims

Rights request

A method for implementing security assurance in an evolved access network, wherein the user end and the network side are respectively provided with at least one counter for counting the amount of data transmitted between the UE and the evolved access network. , the method includes the following steps:

Corresponding processing is performed according to the comparison result.

The method according to claim 1, wherein the step of comparing the amount of data transmitted between the UE and the access network calculated by the UE and the network side counter includes:

The evolved access network initiates a data volume check request to the UE when the set condition is met;

The UE provides the counter value of the maintenance to the evolved access network, and the evolved access network compares the received counter value with the counter value maintained by itself to determine whether the counter value is consistent; or

When the set condition is met, the access network provides the UE with a counter value maintained by itself; the UE compares the received counter value with its own counter value, determines whether the counter value is consistent, and returns to the evolved access network. test result.

3. The method according to claim 2, wherein the counter value is carried in a data amount check request; and the check result is carried in a data amount check response.

The method according to claim 2, wherein the step of initiating the checking of the amount of data to the UE comprises:

Sending a data volume check request to the UE; the UE providing its own counter value to the evolved access network is carried in the data amount check response.

5. The method according to claim 1 or 2, wherein the evolved access network comprises an evolved base station and an access gateway aGW;

In the evolved access network, the counters respectively maintained by the corresponding UE and the evolved base station are the first pair of counters, and the counters respectively maintained by the corresponding UE and the aGW are two pairs of counters, and the method further includes: The evolved base station compares the value of the first pair of counters, and sends the comparison result to the aGW;

When the set condition is met, the aGW initiates a data volume check request to the U, or compares the counter value maintained by the aGW with the counter value of the corresponding UE, and the aGW obtains a comparison result of the second pair of counters, the aGW according to the first Comparing the counter and the second pair of counters, analyzing and judging the evolved base station and the connection status:

If the first pair of counter values are consistent and the values of the second pair of counters are consistent, the connection between the UE and the evolved base station, and the connection between the evolved base station and the aGW are normal;

If the values of the first pair of counters are consistent, the connection between the UE and the evolved base station is normal, otherwise the wireless connection between the UE and the evolved base station is abnormal;

If the values of the second counter are consistent, the connection between the evolved base station and the aGW is normal; otherwise, the connection between the evolved base station and the aGW is abnormal.

The method according to claim 5, further comprising: when the analysis result is that the evolved base station is abnormal, the aGW instructs the UE or the evolved base station to disconnect the current connection; or the aGW indicates the UE or the evolved base station Disconnect the current connection and have the UE select another evolved base station to communicate; or

The analysis result is that when the connection between the evolved base station and the aGW is abnormal, the connection with the eNodeB is disconnected.

The method according to claim 5, further comprising: aGW to the core network when the number of counters in which the values of the first pair of counters or the second pair of counters are inconsistent reaches a set number of times The CN reported that the UE is abnormal.

8. The method according to claim 5, further comprising:

When the UE is handed over from the source evolved base station to the target evolved base station, the source evolved base station provides the counter value of the maintenance to the target evolved base station according to the request of the target evolved base station, or the UE provides the target evolved base station with the counter value maintained by the target evolved base station;

When the UE is handed over to the target aGW by the source aGW, the source aGW provides the target aGW with its maintained counter value according to the request of the target aGW, or the UE provides the target aGW with the counter value it maintains.

9. The method according to claim 8, wherein the counter uses the shared key of both to perform integrity protection.

The method according to claim 1 or 2, wherein the information exchanged between the UE and the evolved access network uses the shared key of both to perform integrity protection.

A method according to claim 2 or 5, wherein said setting condition is at least one of the following conditions:

The set period expires, the counter value reaches the set value, and the check command is received.

12. A system for implementing security assurance in an evolved access network, characterized in that:

The system according to claim 12, wherein the processing unit performs subsequent processing according to the comparison result, including:

When the amount of data transmitted between the UE counted by the first and second counters and the access network is different, the processing unit disconnects the current connection or reports an error to the upper layer.

14. The system of claim 12, wherein the first and second counters use the shared key of both for integrity protection.