WO2007124671A1

WO2007124671A1 - A method, device and system of negotiating the encrypting algorithm between the user equipment and the network

Info

Publication number: WO2007124671A1
Application number: PCT/CN2007/001254
Authority: WO
Inventors: Wenfu Wu
Original assignee: Huawei Technologies Co., Ltd.
Priority date: 2006-04-30
Filing date: 2007-04-17
Publication date: 2007-11-08
Also published as: CN101064921A; CN101064921B

Abstract

A method of negotiating the encrypting algorithm between the user equipment and the network, and its device and system are disclosed. When registering, the UE negotiates the encrypting algorithm of the singling plane with the network. And the encrypting algorithm of the data plane is negotiated between the UE and the network when the traffic is established. The negotiating of the data plane and the singling plane can be divided, so the encrypting between the UE and the core network can be processed accurately after the MME and the UPE divided.

Description

Method, device and system for realizing user equipment and network side encryption negotiation The present application claims to be submitted to the Chinese Patent Office on April 30, 2006, the application number is 200610060555.0, and the invention name is "a kind of user equipment and network side to implement encryption negotiation. The priority of the Chinese Patent Application, the entire disclosure of which is hereby incorporated by reference. Technical field

The invention belongs to the field of mobile communications, and in particular relates to a method, device and system for realizing data encryption between a user equipment and a network side. Background technique

Third Generation Partnership Projects (3GPP, Third Generation Partnership Projects) In order to enhance the competitiveness of future networks, a new evolutionary network architecture, including System Architecture Evolution (SAE) and long-term access network, is being studied. Evolution (LTE, Long Term Evolution), the evolved access network is called (E-UTRANEvolved Universal Terrestrial Radio Access Network). FIG. 1 shows a network architecture of an evolved packet core network, including a Mobility Management Entity (MME), a User Plane Entity (UPE), and a user plane between different access systems. Inter AS Anchor (Inter Access System Anchor) three functional entities. The MME is responsible for mobility management of the control plane, including user context and mobility state management, assigning user temporary identity, etc., corresponding to the current General Packet Radio Service (GPRS, General Packet Radio Service) / Universal Mobile Telecommunications System (UMTS, Universal) Mobile Telecommunications System) The control plane part of the internal service GPRS support node (SGSN); the UPE is responsible for paging the downlink data in idle state, managing the storage network protocol (IP, Internet Protocol) bearer parameters and intra-network routing. Information, etc., corresponds to the data plane part of the current GPRS/UMTS system internal SGSN and Gateway GPRS Supporting Node (GGSN); Inter AS Anchor acts as a user plane anchor between different access systems. The Policy and Charging Rule Function (PCRF) is used for policy control decisions and flow accounting control functions. The Home Subscriber Server (HSS) is used to store user subscription information. Each network entity is connected through a corresponding interface. When the user accesses the network, the user equipment (UE, User Equipment) accesses the MME through attachment, and the MME establishes a mobility management (MM, Mobility Management) context for the user, and then the user activates the request, and the user and the UPE/Inter AS A data bearer is established between the anchors to perform data services.

Figure 2 shows the implementation flow of the user attachment specified in the existing protocol, as detailed below:

1. UE selects the access system and grid ( etwork Discovery and Access System Selection);

2. The UE sends an attach request message (Attach Request) to the MME;

3. If the attach request message carries the registration information of the old MME, the MME sends the original registration information message (Send old registration information) to the old MME to obtain the user information.

4. The old side MME sends the user information to the MME; 5. The MME authenticates the UE;

6. The ME registers with the HSS ( Register MME/UPE);

7. The old side MME deletes the user information ( Delete UE registration information );

8. The HSS confirms the registration of the MME ( Confirm Registration );

9. The MME selects a UPE/Inter AS Anchor ( Selection of Intersystem Mobility Anchor GW );

10. Establish a data plane between the UE and UPE/IASA;

11. MME and Evolved Radio Access Network (Evolved Radio Access Network,

Configure the Quality of Service ( QoS ) used by the default IP access bearer between Evolved RAs;

12. The MME sends an attach accept message (Attach Accept) to the UE, and allocates a temporary identifier of the UE;

13. The UE confirms the Attach Confirm.

Figure 3 shows the implementation flow of user activation as specified in the existing protocol, as detailed below:

1. The UE sends an activation request message to the MME;

2. The MME selects a UPE/Inter AS Anchor ( Selection of UPE/Intersystem Mobility Anchor GW ); 3. The UPE/Inter AS Anchor uses the assigned IP address of the UE to perform IP layer configuration, and the user plane between the UE and the UPE/Inter AS Anchor is established (User Plane Route Configuration);

4. Configure the QoS ( Configure IP Bearer QoS ) used by the IP access between the MME and the Evolved RAN;

5. The MME sends an activation acceptance message to the UE.

In order to ensure the security of the air interface data, the message transmitted between the UE and the network side needs to be encrypted. At present, the encryption processing of messages in the GPRS system is performed between the UE and the SGSN. In the UMTS system, the encryption processing of the message is performed between the UE and the Radio Network Controller (RNC). For GPRS and UMTS systems, both signaling encryption and data encryption are performed on the same entity on the network side. For the evolved network, the encryption process of the non-access stratum (NAS, NonAccess Stratum) signaling is performed in the existing protocol in the UE and the logical function entity MME, and the encryption process of the user plane is performed between the UE and the logical function entity UPE. In the course of the research, the inventor has found that the encryption inconsistency between the MME and the UPE network element can be solved by processing the signaling plane and the user plane encryption on different logical functional entities in the evolved packet core network. Because if the MME logical function entity and the UPE logical function entity are not implemented in the same network side network element, the cryptographic algorithm capabilities supported in the MME logical function entity and the UPE logical function entity may be inconsistent, in which case signaling Encryption of face and user planes cannot use the same encryption algorithm, but must be handled separately. The existing implementation network only stipulates the principle of encryption processing in the evolved network, and does not specify a detailed implementation scheme in which the signaling plane and the data plane encryption are separately performed, and lacks implementability and operability. Summary of the invention

The embodiment of the invention provides a method, a device and a system for implementing encryption and negotiation between a user equipment and a network side, so that the signaling plane and the user plane encryption can be separately processed.

The present invention provides a method for implementing encryption and negotiation between a user equipment and a network side, including: when the user equipment is registered to the network, the user equipment negotiates a signaling plane encryption algorithm with the network side; when the user equipment and the network side establish a bearer, the user equipment Negotiate the data plane encryption algorithm with the network side.

The present invention provides an apparatus for implementing encryption negotiation between a user equipment and a network side, including: Receiving unit, receiving the encrypted information sent by the user equipment;

The signaling plane encryption processing unit determines the user equipment and the network side to negotiate a signaling plane encryption algorithm; the data plane encryption processing unit is configured to determine that the user equipment and the network side negotiate a data plane encryption algorithm;

a sending unit, sending the determined signaling plane and/or data plane encryption algorithm to the user equipment; when the user equipment is registered to the network, the signaling plane encryption processing unit negotiates according to the encrypted information received by the receiving unit a signaling plane encryption algorithm between the user equipment and the network side;

When the user equipment and the network side establish a bearer, the data plane encryption processing unit negotiates a data plane encryption algorithm between the user equipment and the network side according to the encryption information received by the receiving unit and the encryption information of the user plane network element.

The embodiment of the invention provides a communication system, including: a user equipment, a signaling plane network element on the network side, and a user plane network element.

When the user equipment registers with the network and reports the encrypted information of the user, the user equipment and the signaling plane network element on the network side negotiate a signaling plane encryption algorithm according to the encrypted information;

The user equipment and the network side establish and transmit a message carrying the encrypted information to the network side, and the user plane network element determines the data plane of the user equipment and the network side according to the encryption information of the user equipment and the encryption information of the user plane network element. Encryption Algorithm.

As can be seen from the foregoing embodiments of the present invention, in the present invention, the signaling plane encryption negotiation and the data plane encryption negotiation are separately processed. When the user registers with the network side, the user equipment UE and the network side signaling plane network element, such as The MME of the evolved network performs signaling plane encryption negotiation. When the bearer is set up between the user equipment UE and the network side, the user equipment UE and the network side data plane network element, such as the user plane entity UPE of the evolved network, perform data planes. Encryption negotiation. The data plane and the signaling plane are separately negotiated. When the user equipment registers with the network, the user equipment negotiates the signaling plane encryption algorithm with the network side. When the user equipment and the network side establish a bearer, the user equipment negotiates the data plane with the network side. The encryption algorithm can ensure that the encryption between the UE and the core network can be processed normally after the MME/UPE separation, and is easy to implement and operate. DRAWINGS

1 is a network architecture diagram of an evolved packet core network in the prior art; 2 is a flowchart of an implementation of user attachment specified in a prior protocol; FIG. 3 is a flowchart of implementation of user activation specified in an existing protocol;

4 is a flowchart of an implementation of user attachment in an embodiment of the present invention;

FIG. 5 is a flowchart of implementing user attachment in an embodiment of the present invention;

6 is a flowchart of an implementation of user attachment in another embodiment of the present invention;

7 is a flowchart of implementing an update of a user tracking area in an embodiment of the present invention;

8 is a flowchart of implementing user tracking area update in another embodiment of the present invention; FIG. 9 is a flowchart of implementing user activation in an embodiment of the present invention;

FIG. 10 is a flowchart of implementing user activation in an embodiment of the present invention; FIG.

FIG. 11 is a flowchart of implementing network side activation in the embodiment of the present invention.

detailed description

The present invention will be further described in detail below with reference to the accompanying drawings and embodiments.

FIG. 4 shows an implementation flow of user attachment in the embodiment of the present invention. For the convenience of description, only parts related to the present invention are shown:

1. The UE selects an access system and a network;

2. The UE sends an attach request message (Attach Request) to the MME, and the request message carries the user's encrypted information, such as an encryption algorithm supported by the UE, and the user's encrypted information is carried in the MS network capability cell of the attach request message as an example. The example structure is as follows:

If the attach request message carries the registration information of the old MME, the MME sends the original registration information message (Send old registration information) to the old MME to retrieve the user information, and the old MME sends the user information to the MME.

3. The MME authenticates the UE. In the authentication process, the UE and the UI negotiate a signaling plane encryption algorithm for signaling encryption between the UE and the UE: (1) Sending to the UE For the authentication request, the authentication request carries the signaling plane encryption algorithm negotiated according to the user's encryption information, and the example structure of the authentication request message carrying the signaling plane encryption algorithm is as follows:

8 7 6 5 4 3 2 1

Ciphering algorithm 0 Type of

IEI spare algorithm where IEI is the Information Element Identifier

(2) The UE saves the encryption algorithm negotiated by the MME carried in the authentication request, and returns an authentication response to the MME.

4. The MME registers with the HSS (Register MME/UPE); 5. The HSS confirms the registration of the MME ( Confirm Registration );

6. The MME selects a UPE/Inter AS Anchor ( Selection of Intersystem Mobility Anchor GW );

7. Establish user planes between UEUE and UPE/Inter AS Anchor, including:

(1) The MME sends a bearer setup request message to the UPE/Inter AS Anchor, where the message carries the user's encrypted information, such as an encryption algorithm supported by the UE. Taking the encrypted information of the user in the MS network capability cell carrying the bearer setup request message as an example, the example structure is as follows:

(2) The UPE sends an authentication request to the UE. The authentication request carries the user plane encryption algorithm negotiated by the UPE according to the user's encryption information. The example structure of the authentication request message carrying the user plane encryption algorithm is as follows:

8 7 6 5 4 3 2 1

Ciphering algorithm 0 Type of

IEI spare algorithm

(3) The UE saves the data plane encryption algorithm negotiated by the UPE carried in the authentication request, and returns an authentication response to the UPE.

(4) The UPE returns a Create Bearer Response message to the MME.

8. Configure the QoS (Configure IP Bearer QoS) used by the default IP access bearer between the MME and the evolved RAN network;

9. The MME sends an Attach Accept message to the UE, and allocates a temporary identifier of the UE;

10. The UE confirms the Attach Confirm.

Fig. 5 shows an implementation flow 2 of the user attachment provided by the present invention. For the convenience of description, only the parts related to the present invention are shown:

1. UE selects the access system and network ( etwork Discovery and Access System Selection);

3. The MME authenticates the UE, and during the authentication process, the UE and

The signaling plane encryption algorithm is negotiated between the MMEs for signaling encryption between the UE and the MME:

(1) The MME sends an authentication request to the UE. The authentication request carries the signaling plane encryption algorithm negotiated by the MME according to the user's encryption information. The example structure of the authentication request message carrying the signaling plane encryption algorithm is as follows:

8 7 6 5 4 3 2 1

4. The MME registers with the HSS ( Register MME/UPE);

5. The HSS confirms the registration of the MME ( Confirm Registration );

7. The MME sends a Create Bearer Request message to the UPE/Inter AS Anchor. The message carries the user's encrypted information, such as the encryption algorithm supported by the UE. The user's encrypted information is carried in the MS network capabilit cell of the bearer setup request message. The example structure is as follows:

8. The UPE negotiates the user plane encryption algorithm used between the UE and the UPE according to the encryption information of the user and the encryption information of the user, and then returns a Create Bearer Response message to the MME, where the message carries the negotiated user plane encryption. The algorithm, the example structure of the created response message carrying the user plane encryption algorithm is as follows: 8 7 6 5 4 3 2 1

9. Configure the QoS (Configure IP Bearer QoS) used by the default IP access bearer between the MME and the evolved RAN network;

10. The MME sends an Attach Accept message to the UE, and allocates a temporary identifier of the UE, where the message carries the user plane encryption algorithm negotiated between the UE and the UPE, and the user plane encryption algorithm is used between the UE and the UPE. ;

11. The UE confirms the Attach Confirm.

Fig. 6 shows an implementation flow 3 of the user attachment provided by the present invention. For the convenience of description, only the parts related to the present invention are shown:

1. The UE selects an access system and a network;

3. The MME authenticates the UE. In the authentication process, the UE and the MME negotiate a signaling plane encryption algorithm for signaling encryption between the UE and the MME: (1) The MME sends the UE to the UE. The authentication request carries the signaling plane encryption algorithm negotiated by the MME according to the encrypted information of the user, and the example structure of the authentication request message carrying the signaling plane encryption algorithm is as follows:

8 7 6 5 4 3 2 1

(2) The UE saves the encryption algorithm negotiated by the MME carried in the authentication request, and returns a weighted response to the MME.

4. The MME registers with the HSS ( Register MME/UPE);

5. The HSS confirms the registration of the MME ( Confirm Registration );

6. MME selects a UPE/Inter AS Anchor (Selection of Intersystem

Mobility Anchor GW ) ;

7. The MME forwards the attach request message of the user to the UPE/Inter AS Anchor;

8. Configuring QoS ( Configure IP Bearer QoS ) used by the default IP access bearer between the UPE/IASA and the evolved RAN network;

9. The UPE negotiates the user plane encryption algorithm used between the UE and the UPE according to the encryption information of the user and the encryption information of the user, and then sends an Attach Accept message to the MME, where the message carries the negotiated user plane encryption algorithm. An example structure for creating a bearer response message carrying a user plane encryption algorithm is as follows:

8 7 6 5 4 3 2 1

10. The MME sends an Attach Accept message to the UE, and allocates a time identifier of the UE. The message carries the user plane encryption algorithm negotiated between the UE and the UPE. The user plane encryption algorithm is used between the UE and the UPE.

11. The UE confirms the Attach Confirm.

Fig. 7 shows an implementation flow 1 of the tracking area update provided by the present invention. For the convenience of description, only the parts related to the present invention are shown:

1. The UE sends a Tracking Area Update (TAU) Request to the MME, and the message carries the user's encrypted information, such as an encryption algorithm supported by the UE, and carries the tracking area update request message with the user's encrypted information. For example, in the MS network capability cell, the example structure is as follows:

2. The MME authenticates the UE. In the authentication process, the UE and the UE

8 7 6 5 4 3 2 1

Ciphering algorithm 0 Type of

IEI spare algorithm

3. The MME selects a UPE (Selection of UPE);

4. The MME sends a Create Bearer Request message to the UPE, and the message carries the user's encrypted information, such as an encryption algorithm supported by the UE. Take the user's encrypted information in the MS network capability cell carrying the bearer setup request message as an example. The example structure is shown below:

5. The UPE negotiates the UE and the UPE based on the user's encrypted information and its own encrypted information. The user plane encryption algorithm used, and then returns a Create Bearer Response message to the MME. The message carries the negotiated user plane encryption algorithm. The example structure of the bearer response message carrying the user plane encryption algorithm is as follows:

8 7 6 5 4 3 2 1

6. Configuring the default IP access bearer between the MME and the evolved RAN network

QoS (Configure IP Bearer QoS);

7. The MME sends a tracking area update accept message (TAU Accept) to the UE, and allocates a temporary identifier of the UE, where the message carries the user plane encryption algorithm negotiated between the UE and the UPE, and the user plane is used between the subsequent UE and the UPE. Encryption Algorithm;

8. The UE confirms that the tracking area is updated successfully (TAU Confirm).

FIG. 8 shows an implementation flow 2 of the user tracking area update provided by the present invention. For the convenience of description, only parts related to the present invention are shown:

1. The UE sends a Tracking Area Update (TAU) Request to the MME, and the request message carries the user's encrypted information, such as an encryption algorithm supported by the UE, and the user's encrypted information is carried in the tracking area update request message. For example, in the MS network capability cell, the example structure is as follows:

2. The MME authenticates the UE, and during the authentication process, the UE and

8 7 6 5 4 3 2 1

3. The MME selects a UPE (Selection of UPE);

4. The MME forwards the Tracking Area Update Request (TAU Request) message to the UPE.

Configuring QoS ( Configure IP Bearer QoS ) used by the default IP access bearer between the UPE and the evolved RAN network;

6. The UPE negotiates the user plane encryption algorithm used between the UE and the UPE according to the user's encryption information and its own encryption information, and then returns a tracking area update accept (TAU Accept) message to the MME, where the message carries the negotiated user plane encryption. The algorithm, the example structure of the created response message carrying the user plane encryption algorithm is as follows:

8 7 6 5 4 3 2 1

Ciphering algorithm 0 Type of

IEI spare Algorithm

FIG. 9 shows an implementation flow of user activation provided by the present invention. For the convenience of description, only the description is shown. The parts related to the present invention are:

1. The UE sends an activation request message to the MME;

2. The MME selects a UPE/Inter AS Anchor ( Selection of UPE/Intersystem Mobility Anchor GW );

3. UPE/Inter AS Anchor uses the assigned IP address of the UE for IP layer configuration. The user plane between the UE and the UPE/Inter AS Anchor is established (User Plane Route Configuration):

(1) The MME sends a Create Bearer Request message to the UPE/Inter AS Anchor. The message carries the user's encrypted information, such as the encryption algorithm supported by the UE. For example, the user's encrypted information is carried in the MS network capability cell of the bearer setup request message. The example structure is as follows:

(2) The UPE sends an authentication request to the UE, where the authentication request carries the signaling plane encryption algorithm negotiated by the UPE according to the encryption algorithm supported by the UE, and the example structure of the authentication request message carrying the signaling plane encryption algorithm is as follows: :

8 7 6 5 4 3 2 1

Ciphering algorithm 0 Type of

IEI spare Algorithm

(3) The UE saves the data plane encryption algorithm negotiated by the UPE, and returns an authentication response to the UPE. The data encryption between the subsequent UE and the UPE uses the negotiated encryption algorithm.

4. Configuring QoS (Configure IP Bearer QoS) used by the IP access bearer between the MME and the evolved RAN network;

5. The MME sends an activation acceptance message to the UE.

FIG. 10 shows an implementation flow 2 of user activation provided by the present invention. For the convenience of description, only parts related to the present invention are shown:

1. The UE sends an activation request message to the MME;

3. The MME sends a Create Bearer Request message to the UPE, where the message carries the user's encrypted information, such as an encryption algorithm supported by the UE. The example in which the user's encrypted information is carried in the MS network capability cell of the bearer setup request message is used as an example. As follows:

4. The UPE negotiates the user plane encryption algorithm used between the UE and the UPE based on the user's encryption information and its own encryption information, and then returns a Create Bearer Response message to the MME. The message carries the negotiated user plane encryption. The algorithm, an example structure for creating a bearer response message carrying a user plane encryption algorithm is as follows:

8 7 6 5 4 3 2 1

5. Configuring QoS (Configure IP Bearer QoS) used by the default IP access bearer between the MME and the evolved RAN network;

6. The MME sends an activation acceptance message to the UE, where the message carries the negotiated user plane encryption algorithm, and the user plane encryption algorithm is used between the subsequent UE and the UPE.

FIG. 11 shows an implementation flow 1 of network side activation provided by the present invention. For the convenience of description, only parts related to the present invention are shown:

1. The UPE/IASA sends a Create Bearer Request message to the MME (Create Bearer Request). The message carries the encrypted information of the UPE, such as the supported encryption algorithm. Take the user's encrypted information in the network capability cell carrying the bearer setup request message as an example. The example structure is as follows:

2. The MME negotiates the user plane encryption algorithm used between the UE and the UPE according to the encryption information of the UE and the encryption information of the UPE. The UE has sent its own encryption information to the MME in the process of the UE registering with the MME. Attachment process, this is no longer described). The MME sends a bearer request message to the Evolved RAN (Bearer Request), and the message carries the user plane encryption algorithm negotiated between the UE and the UPE. An example structure of a bearer request message carrying a user plane encryption algorithm is as follows: 8 7 6 5 4 3 2 1

3. The Evolved RAN sends a bearer request message to the UE (Bearer Request), where the message carries the user plane encryption algorithm between the UE and the UPE;

4. The UE returns a response message to Evolved RAN (Bearer Response);

5. The Evolved RAN returns a bearer response message to the MME (Bearer Response);

6. The MME sends a Create Bearer Response message to the UPE (Create Bearer Response), and the message carries the user plane encryption algorithm used between the negotiated UE and the UPE.

In addition, an embodiment of the present invention provides a device for implementing encryption and negotiation between a user equipment and a network side, where the device includes a receiving unit, a signaling plane encryption processing unit, a data plane encryption processing unit, and a sending unit, where the device is set on the network side. Generally, the functional units of the device are distributed in different network element entities to implement corresponding functions. Specifically, for example, the signaling plane encryption processing unit and the data plane encryption processing unit are respectively disposed on the signaling plane network element and the user. In the network element, in the evolved network, the signaling plane network element is an MME, and the user plane network element is a UPE.

Receiving unit, receiving the encrypted information sent by the user equipment;

a signaling plane encryption processing unit, configured to determine that the user equipment and the network side negotiate a signaling plane encryption algorithm;

a data plane encryption processing unit, configured to determine that the user equipment negotiates a data plane encryption algorithm with the network side;

a sending unit, configured to send the determined signaling plane and/or data plane encryption algorithm to the user Prepared

When the user equipment is registered to the network, the signaling plane encryption processing unit negotiates a signaling plane encryption algorithm between the user equipment and the network side according to the encryption information received by the receiving unit;

When the user equipment and the network side establish a bearer, the data plane encryption processing unit negotiates a data plane encryption algorithm between the user equipment and the network side according to the encryption information received by the receiving unit and the encryption information of the user plane network element. As shown in step 3 and step 7 in Figure 4, the user equipment negotiates the encryption algorithm of the signaling plane and the data plane with the network side device respectively.

The encrypted information is carried in a user attach request message or a tracking area update request message sent by the user equipment to the network side. For example, referring to FIG. 4, the MME receives an attach request message that is sent by the user equipment and carries the user encrypted information.

The operation flow of each unit in the apparatus for implementing the encryption negotiation between the user equipment and the network side is substantially the same as that described in the foregoing embodiment, and details are not described herein again.

A communication system is further provided in the embodiment of the present invention, including: a user equipment, a signaling plane network element on the network side, and a user plane network element.

The encrypted information of the user is carried in a user attach request message or a tracking area update request message sent by the user equipment to the network side.

The signaling plane encryption algorithm is sent to the user equipment, and the signaling plane encryption algorithm is carried in an authentication request message sent by the network side to the user equipment.

The operation procedure between the user equipment and the network side signaling plane network element and the user plane network element in the communication system is basically the same as that described in the foregoing embodiment, and details are not described herein again.

The processes provided in the foregoing embodiments of the present invention may differ from the processes actually employed, and such differences are not to be construed as limiting the present invention. In addition, the present invention describes an implementation of the encryption and negotiation separate processing of the data plane and the signaling plane by using an evolved network as an example, and can of course be applied to Other networks. Meanwhile, in order to more clearly describe the present invention, the present invention assumes that the MME is an entity in the evolved network architecture, and the UPE and the Inter AS Anchor are one entity, but do not limit other network architectures, such as MME/UPE/Inter AS Anchor. As an independent entity.

The above is only the preferred embodiment of the present invention, and is not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection of the present invention. Within the scope.

Claims

Rights request

A method for implementing encryption negotiation between a user equipment and a network side, comprising: 'When a user equipment registers with a network, the user equipment negotiates a signaling plane encryption algorithm with the network side; and when the user equipment and the network side establish a bearer The user equipment negotiates the data plane encryption algorithm with the network side.

2. The method according to claim 1, wherein the step of the user equipment negotiating the signaling plane encryption algorithm with the network side comprises:

The network side receives the encrypted information of the user that the user equipment initiates registration and reporting;

The network side negotiates the signaling plane encryption algorithm according to the encryption information of the user, and sends the signaling plane encryption algorithm to the user equipment.

3. The method according to claim 2, wherein the user equipment and the network side negotiate a signaling plane encryption algorithm by using the following steps:

The network side receives the message carrying the encrypted information sent by the user equipment, and the signaling plane network element on the network side authenticates the user equipment, and determines the user equipment and the signaling plane network element according to the encrypted information. The encryption algorithm between.

4. The method according to claim 1, wherein the user equipment and the network side negotiate a data plane encryption algorithm by:

The network side receives the message carrying the encrypted information sent by the user equipment, and the network side determines the encryption between the user equipment and the user plane network element according to the encryption information of the user equipment and the encryption information of the user plane network element when establishing the bearer. algorithm.

The method according to claim 2 or 4, wherein the encrypted information of the user is carried in a user attach request message or a tracking area update request message sent by the user equipment to the network side.

The method according to claim 2, wherein the signaling plane encryption algorithm is carried in an authentication request message sent by the network side to the user equipment.

The method according to claim 1, wherein the step of the user equipment negotiating the data plane encryption algorithm with the network side comprises:

The first network element on the network side reports the encrypted information of the user to the second network element on the network side; the second network element on the network side negotiates the data plane encryption algorithm according to the encrypted information of the user, and The data plane encryption algorithm is sent to the user equipment.

The method according to claim 7, wherein the encrypted information of the user is carried in a bearer setup request message sent by the first network element on the network side to the second network element on the network side.

The method according to claim 7, wherein the encrypted information of the user is carried in an attach request message sent by the first network element on the network side to the second network element on the network side.

The method according to claim 7, wherein the encrypted information of the user is carried in a tracking area update request message sent by the first network element on the network side to the second network element on the network side.

The method according to claim 7, wherein the data plane encryption information is carried in an authentication request message sent by the second network element on the network side to the user equipment.

The method according to claim 7, wherein the user plane encryption algorithm carries a bearer setup response message sent by the second network element on the network side to the first network element on the network side, and the first network element on the network side The user plane encryption algorithm is carried in the attach accept or tracking area update accept message to the user equipment.

The method according to claim 1, wherein the step of the user equipment negotiating the user plane encryption algorithm with the network side comprises:

The second network element on the network side reports the encrypted information to the first network element on the network side;

The first network element on the network side negotiates the user plane encryption algorithm according to the encryption information of the user and the encryption information of the second network element on the network side, and sends the user plane encryption algorithm to the user equipment and the second network element on the network side.

The method according to claim 14, wherein the user plane encryption information is carried in a bearer setup request message sent by the second network element on the network side to the first network element on the network side.

The method of claim 2, 3 or 5, wherein the user's encryption information includes encryption algorithm information supported by the user equipment.

The method according to any one of claims 2 to 15, wherein the encryption algorithm of the data plane network element comprises an encryption algorithm supported by the user plane network element.

The method according to any one of claims 8 to 15, wherein in the evolved network, the first network element on the network side is an MME, and the second network element on the network side is a UPE.

The method according to claim 3 or 4, wherein in the evolved network, the signaling plane network element is an MME, and the user plane network element is a UPE.

19. An apparatus for implementing encryption negotiation between a user equipment and a network side, characterized in that:

Receiving unit, receiving the encrypted information sent by the user equipment;

a sending unit, configured to send the signaling plane and/or a data plane encryption algorithm to the user equipment; when the user equipment is registered to the network, the signaling plane encryption processing unit is configured according to the encrypted information received by the receiving unit Negotiating a signaling plane encryption algorithm between the user equipment and the network side;

The device according to claim 19, wherein the encrypted information is carried in a user attach request message or a tracking area update request message sent by the user equipment to the network side.

A communication system, comprising: a user equipment, a signaling plane network element on the network side, and a user plane network element, wherein

The system according to claim 21, wherein the encrypted information of the user is carried in a user attach request message or a tracking area update request message sent by the user equipment to the network side.

The system of claim 21, wherein the signaling plane encryption algorithm is sent to the user equipment, and the signaling plane encryption algorithm is carried in an authentication request message sent by the network side to the user equipment.