WO2009039782A1

WO2009039782A1 - A mobile node apparatus, a method for realizing media independent handover and the system thereof

Info

Publication number: WO2009039782A1
Application number: PCT/CN2008/072435
Authority: WO
Inventors: Guohui Zou; Bin Xia
Original assignee: Huawei Technologies Co., Ltd.
Priority date: 2007-09-19
Filing date: 2008-09-19
Publication date: 2009-04-02
Also published as: CN101394664B; CN101394664A

Abstract

A mobile node apparatus, a method for realizing media independent handover (MIH) and the system thereof are provided. The method includes: the network side sending the service information protected by a shared key to the mobile node (MN); receiving the handover prepare request message, which is sent by MN according to the service information after MN validates the common key and protected by the first shared key; validating the first shared key and controlling MN to access the target point of service (PoS). With the method, the security problem of MIH is efficiently resolved and the security of media independent service and MIH is ensured. The mobile node apparatus includes service information getting module, verifying module, requesting module and message protecting module. The system includes message sending module, system message protecting module, message receiving module, system verifying module and handover module. With the apparatus and the system, the security of MIH is ensured.

Description

Mobile node device, method and system for implementing media independent switching

The present invention relates to the field of wireless communication technologies, and in particular, to a mobile node device and a method and system for implementing media independent switching. Background technique

Media-independent switching means that by switching between different media types, mobile users can automatically select the best network connection type and seamlessly switch the voice channel when roaming between networks to achieve IEEE 802.3/802.11/802.16/3GPP. Roaming switching between various systems such as /3GPP2.

Currently, the media-independent handover technology is mainly through the Media Independent Handover Function (MIHF) module on the Mobile Node (MN), and the media independent handover service point (MIH Point) of the MN service attachment point (service PoA). Of Service, MIH PoS), MIH PoS for MN candidate PoA, MIH PoS for MN PoA, and MIH non-service point (Non-PoS) without MN PoA for mobile users in IEEE 802.3/802.11/802.16/3GPP/ Roaming switching between systems such as 3GPP2. The MIH PoS of the MN serving PoA refers to the MIH network entity that can directly exchange MIH messages with the MN having the MIH function, that is, the PoS currently serving the MN, that is, the POS (Serving PoS) in the service state; the MIH of the MN candidate PoA PoS refers to an MIH network entity that can directly exchange MIH messages with a MIH-enabled MN, that is, a candidate PoS; an MIH PoS that does not include a MN's PoA refers to an MIH network entity that can directly interact with an MIH-enabled MN, such as a wired network. The MIHF-enabled router in the MIHF Non-PoS that does not include the MN's PoA refers to the MIH network entity that can directly interact with other MIH network entities, but the network entity cannot directly exchange MIH messages with the MIH-capable MN.

In the specific handover, first, the Serving PoS provides the MN with the MIH service determined during the MIH capability discovery process, including: MIH Event Service (MIES): Provides event classification, event filtering, and events on dynamically changing link characteristics, link status, and link quality.

MIH Command Service (MICS): Provides upper layer management and control of link behavior related to handover and mobility.

MIH Information Service (MIIS): Provides detailed information on the characteristics and services of the service network and surrounding networks for effective system access and handover decisions.

Secondly, after the MN determines whether the target network to be switched is allowed to access according to the provided MIH service, the MN initiates a query request to the Serving PoS on the network side, and sends a handover request to the PoS of the target network when the Serving PoS returns the handover command on the network side. Switch.

In the process of implementing the present invention, the inventor has found that the prior art has at least the following problems: In the process of providing the MIH service by the MN and the MN switching the network, the information interaction between the MN and each network entity lacks security protection, and therefore, the media There is a security issue with irrelevant switching. Summary of the invention

A first aspect of an embodiment of the present invention is to provide a method for implementing media independent handover to solve the security problem of media independent handover.

A second aspect of an embodiment of the present invention provides a mobile node device that enables a mobile node to perform secure media independent handover.

A third aspect of the embodiments of the present invention provides a system for implementing media independent handover to implement secure media independent handover.

The first aspect of the present invention provides the following technical solutions through some embodiments: A method for implementing media-free handover, including:

The network side sends the service information protected by the shared key to the mobile node;

Receiving a handover preparation request message, where the handover preparation request message is sent by the mobile node according to the service information after verifying the shared key, and the handover preparation request message is protected by a first shared key; Verifying the first shared key and accessing the mobile node to a target service point.

The shared key is used to protect the message in the service process and the handover process, so that the third party who maliciously intercepts the message cannot obtain the content in the media-independent handover process, thereby effectively solving the security problem of the media independent handover and ensuring the media independent service. Security that is not related to media switching.

The second aspect of the present invention provides the following technical solutions through some embodiments: A mobile node device, including:

a service information obtaining module, configured to obtain service information protected by the shared key from the network side; and a verification module, configured to verify the shared key;

a requesting module, configured to send, by using the service information, a handover preparation request message to the network side, if the verification module verifies that the shared key passes;

The message protection module is configured to protect the handover preparation request message with the first shared key.

The scheme effectively ensures the security of the mobile node to send and receive messages through the modules such as the message protection module and the verification module, so that the mobile node can interact with the network-side media independent switching system with security protection function, thereby ensuring the secure receiving and transmitting of the mobile node. Information, media-independent switching for mobile node security.

The third aspect of the present invention provides the following technical solutions through some embodiments: A system for implementing media-free handover, including:

a message sending module, configured to send service information to the mobile node;

a system message protection module, configured to protect the service information by using a shared key;

a message receiving module, configured to receive a handover preparation request message that is sent by the mobile node and is protected by the first shared key;

a system verification module, configured to verify the first shared key;

And a switching module, configured to access the mobile node to the target service point according to the handover preparation request message, to complete the handover.

The scheme effectively protects various messages in the process of switching to the mobile node service network through the modules of the message protection module and the verification module, and avoids the third party who maliciously intercepts the message to obtain the switchover. The content of the message in the process solves the security problem in the media-independent handover, and ensures the security of the service and handover in the media-independent handover.

The technical solution of the present invention will be further described in detail below through the accompanying drawings and embodiments. 2 is a schematic diagram of a direct security architecture in a method for implementing media independent handover according to the present invention; FIG. 3 is a signaling flowchart of a first embodiment of a method for implementing media independent handover according to the present invention; FIG. 5 is a schematic structural diagram of a mobile node device according to an embodiment of the present invention; FIG.

FIG. 6 is a schematic structural diagram of an embodiment of a media independent switching system according to the present invention. detailed description

In the embodiment of the method for implementing media independent handover, the MN and each network entity have the MIH function, and the security association (SA) between the MN and each network entity and each network entity is established to form the security of the MIH. Architecture. The establishment of the SA is implemented by a shared key between the MN and each network entity or between network entities. For convenience of description, in the embodiment of the present invention, the shared key between the MN and the Serving PoS on the network side is referred to as a first shared key (Kms), and the key may be generated before the MN obtains the service information; The shared key with the information server is called the second shared key (Kns), which can be dynamically generated or statically configured, depending on actual needs; the key between the MN and the information server is called The third shared key (Kmn), the key needs to be dynamically generated; the shared key between the Serving PoS and each candidate PoS is referred to as a fourth shared key (Kcs); The shared key between the server (AAA Server) is called the fifth shared key (Kma); the shared key between the MN and the target PoS is called the sixth shared key (Kmc); and, according to the MN Whether MIHF needs to clarify the new communication peer of MIH, and divide the security architecture into the default security architecture. With a direct security architecture.

Under the default security architecture, the MIHF of the MN only needs to know whether the MIHF of the MIH PoS of the Serving PoA exists, and other MIHFs in the network are invisible to the MN. For the MIHF of the MN, it is only necessary to establish an SA with the MIHF of the Serving PoA's MIH PoS and request all services from it. The default security architecture is shown in Figure 1. The solid lines indicate direct connections, the dashed lines indicate that they are not directly connected, and the thick lines indicate connections with security protection associated with the MIHF of the MN. Other connections may have security associations but are not related to MN's MIHF.

Under the direct security architecture, the MN's MIHF needs to know the existence of the MIHF of the Serving PoA's MIH PoS, and also needs to know the existence of other MIHFs in the network. For MN's MIHF, it needs to establish a security association with all MIHFs that need to interact with it and request the corresponding services separately. The architecture can be as shown in Figure 2. The solid lines indicate direct connections, the dashed lines indicate that they cannot be directly connected, and the thick lines indicate connections with security protection associated with the MIHF of the MN. Other connections may have a security association but are not related to the MN's MIHF. It is important to note that the thick dotted lines also indicate that there is a security alliance between them, although they cannot be directly connected. The MIH PoS in Figure 1 and Figure 2 is a functional module that does not include the MN's PoA on the network side. It can directly interact with the MIH-capable MN, such as a MIH-enabled router in a wired network.

Method embodiment 1

FIG. 3 is a signaling flowchart of a first embodiment of a method for implementing media independent handover according to the present invention. The default security architecture is taken as an example in this embodiment.

Step 101: The MN sends a Kms-protected service request message "[MIH_Service-REQ]Kms,, to the Serving PoS.

"[MIH_ Service-REQ]Kms" means that the "MIH_Service-REQ" message is protected by Kms. The following is similar. The security between MN and Serving PoS is guaranteed by Kms.

Step 102: The Serving PoS receives the "[MIH_Service-REQ]Kms" message and verifies the Kms; by verifying the Kms, the reliability of the message is ensured, and after the verification is passed, the Serving PoS sends the Kms-protected service response message to the MN. [MIH—Service-RSP]Kms" , "[Mffl_Service-RSP]Kms, the message contains the service information requested by the MN.

Step 103: The MN receives "[MIH_Service-RSP]Kms,,, and verifies Kms;

After the verification is passed, the service information such as the surrounding network information is obtained securely and effectively. After the verification is passed, the MN selects the target network according to the service information, and initiates a Kms-protected handover preparation request message to the Serving PoS "[MIH-Prepare-REQ]Kms " , to query whether the target network allows itself to access," [MIH - Prepare-REQ] Kms can carry PoS information that the MN is ready to query.

Step 104: The Serving PoS receives "[MIH_Prepare-REQ]Kms,,, and verifies Kms; after the verification is passed, the Serving PoS sends a Kcs-protected resource query request message "[MIH_Query-REQ]Kcs" to each candidate PoS.

Step 105: Each candidate PoS receives "[MIH_ Query-REQ]Kcs", and verifies Kcs;

After the verification is passed, each candidate PoS determines whether the service point can access the MN, and returns a Kcs-protected resource query response message "[MIH_ Query-RSP]Kcs", "[MIH_ Query-RSP]Kcs" to the Serving PoS. The judgment result is included; and, if it is judged that access is available, resources may also be reserved for the MN.

Step 106: Serving PoS receives "[MIH_Query-RSP]Kcs,,, and verifies Kcs;

After the verification is passed, the Serving PoS selects the target service point for the MN according to the judgment result, and sends a Kms-protected handover command to the MN, where the handover command includes the target PoS information; or the Serving PoS sends the Kms-protected handover to the MN. The preparation response message "[MIH_Prepare-RSP]Kms", "[MIH_Prepare-RSP]Kms" contains the judgment result; after the Serving PoS receives "[MIH-Prepare-RSP]Kms", it can be immediately sent to the MN, also All candidate PoSs can be returned to the MN after returning the result.

Step 107: The MN receives the handover command or "[MIH_Prepare-RSP]Kms,, and verifies Kms; after the verification is passed, the MN sends a Kms-protected handover execution request message "[MIH_Commit-REQ]Kms to the Serving PoS according to the handover command, Or the MN obtains the judgment result from "[MIH_Prepare-RSP]Km s", and sends the KMS-protected "[MI H_Commit-REQ]Kmsr "[MIH_Commit-REQ]Kms" containing the target PoS information to the Serving PoS according to the judgment result. , Such as the IP address of the target PoS, the Network Access Identifier (NAI) or the identifier (ID) of the MIHF.

Step 108: The Serving PoS receives "[MIH-Commit-REQ]Kms" and verifies the Kms; after the verification is passed, the Serving PoS protects the "MIH_Commit-REQ" message with Kcs, and obtains [[MIH_Commit- EQ]Kcs", and Send "[MIH_Commit-REQ]Kcs," to the target PoS based on the target PoS information.

Step 109: The target PoS receives "[MIH-Commit-REQ]Kcs", and verifies Kcs;

After the verification is passed, the target PoS returns the Kcs-protected handover execution response message "[MIH-Commit-RSP]Kcs" to the Serving PoS.

Step 110: Serving PoS receives "[MIH_Commit-RSP]Kcs,,, and verifies Kcs;

After the verification is passed, the Serving PoS uses the Kms protection "MIH_Commit-RSP" message to get "[MIH_Commit-RSP]Kms" and sends it to the MN.

Step 111: The MN receives "[MIH_Commit-RSP]Kms,,, and verifies Kms;

After the verification is passed, the MN sends a Kma-protected key generation request message "[MIH-Key-REQ]Kma" to the AAA server through the target PoS.

Step 112: The target PoS forwards "[MIH_Key-REQ]Kma' to the AAA server via the "AAA REQ" message.

Step 113: The AAA server receives "AAA REQ", obtains "[MIH_Key-REQ]Kma, and then verifies Kma;

After the verification is passed, the AAA server generates Kmc and sends "AAA RSP" to the target PoS, returning the risk result and Kmc.

Step 114: The target PoS sends a key generation response message "[MIH_Key-RSP]Kmc" to the MN, and the key generation response message is protected by Kmc.

Step 115: The MN receives "[MIH_Key-RSP]Kmc,,, and verifies Kmc;

After the verification is passed, the switch is completed. After that, the MN may also send a handover complete message "[M IH_Complete-REQ]Kmc," to the target PoS, and the target PoS returns a response message "[MIH_Complete-RSP]Km cV confirms that the switch is complete.

In this embodiment, after receiving the "[MIH_Service-REQ]Kms" message, the Serving PoS may further determine whether it stores the information requested by the MN when the Kms authentication is passed, and if so, execute: Serving PoS Direction The MN sends a Kms-protected service response message "[Ml H_Service-RSP]Kms. Otherwise, the Serving PoS sends a "[MIH_Service-REQ] KnsV Information Server Receive" [MIH_Service-REQ]Kns" message to the Information Server to verify that Kns passes. After that, the [MIH_Service-RSP]Kns, message containing the service information requested by the MN is returned to the Serving PoS; the Serving PoS receives the message [MIH_Service-RSP]Kns, the message is obtained by verifying the Kns, and then: Serving PoS The Kms-protected service response message "[M IH_Service-RSP]Kms' is sent to the MN: The Serving PoS returns a failure message to the MN if the Kms has not passed the verification.

The process by which the MN obtains service information can also be implemented by the following process:

The information server broadcasts a "[MIH-Service]Kns" message to each PoS, where Kns may vary depending on the PoS;

After receiving the "[MIH_Service]Kns" message, the Serving PoS verifies the Kns and, if the verification passes, broadcasts the obtained service information to all MNs via the "[MIH_Service]Kms" message, where Kms also May vary by MN;

The MN receives the "[MIH_Service]Kms" message and obtains the service information after verifying the Kms.

In the media-independent handover process of this embodiment, the SA is established between the MN and the Serving PoS, that is, the shared key is used to ensure that the MN securely obtains the service information; and the MN and the Serving PoS, the candidate PoS, the AAA server, and the PoS The establishment of the SA guarantees the security of the network handover, thereby ensuring the security of the media independent handover as a whole.

Moreover, since the default interaction object of the MN is the Serving PoS, no identifier can be introduced during the MIH interaction, which reduces signaling overhead and facilitates wireless transmission.

For simple IP and mobile IP networks, since the MN only needs to know its own access router (AR) in these two networks, this situation is similar to the case of not performing cross-PoS access. Similar to the role of the PoS, the AR is easy to upgrade to the MI and obtain the MIH function. It does not need to be accessed across PoS. This solution can be easily applied to simple IP and mobile IP networks.

Method embodiment two

FIG. 4 is a signaling flowchart of a second embodiment of a method for implementing media independent handover according to the present invention. This example takes a direct security architecture as an example. The handover process is specifically as follows:

Step 201: The MN sends a Kmn protected service request message "[MIH_Service-REQ]

The Serving PoS determines whether the service point is the message delivery destination of the MN according to the transmission destination information in the service request message "[MIH_Service-REQ]Kmn", and if so, the shared key of the protection message should be the first shared key. The Serving PoS can be verified. After the verification is passed, the Serving PoS returns the service information to the MN. In the first embodiment, the Serving PoS receives the "[MIH-Se rvice-REQ]Kms" message and verifies the Kms; after the verification is passed, The Serving PoS sends a Kms-protected service response message to the MN "[MIH_Service-RSP]Kms,.,

Step 202: When Serving PoS determines that the service point is not the message sending target of the MN, the information server receives "[MIH_Service-REQ] Kmn", and verifies Kmn;

After the verification is passed, the information server sends a service response message "[MIH_Service-REQ]Kmn,", "[MIH_Service-REQ]Kmn" requested by the KMN protected MN to the MN, containing the service information requested by the MN.

Step 203: The MN receives the "[MIH_Service-REQ] Kmn" message and verifies the Kmn; after the verification is passed, the MN obtains the service information.

The MN selects the target PoS based on the service information and transmits the Kms-protected "[MIH_Prepare-REQ]Kms" to the Serving PoS.

Step 204: Serving PoS receives "[MIH_Prepare-REQ]Kms,,, and verifies Kms;

After the verification is passed, the Serving PoS sends the KCS-protected "[MIH_Query-REQ]Kcs" to each candidate PoS on the network side.

Step 205: Each candidate PoS receives "[MIH_Query-REQ]Kcs", and verifies Kcs; After the verification is passed, each candidate PoS determines whether the service point can access the MN, and returns the KCS-protected "[MIH_Query-RSP]Kcs,,,"[MIH_Query-RSP]Kcs to the Serving PoS, including the judgment result; If it is judged that access is available, resources may also be reserved for the MN.

Step 206: Serving PoS receives "[MIH_Query-RSP]Kcs,,, and verifies Kcs;

After the insurance certificate is passed, the Serving PoS sends the KMS-protected "[MIH_Prepare-RSP]Kms, message, "[MIH_Prepare-RSP]Kms to the MN, which contains the judgment result.

Step 207: The MN receives "[MIH_Prepare-RSP]Kms", and verifies Kms;

After the verification is passed, the MN sends the Kma-protected "[MIH_Key-REQ]Kma" to the accessible candidate PoS according to the judgment result.

Step 208: The accessible candidate PoS forwards "[MIH-Key-REQ]Kma" to the AAA server through "AAA REQ".

Step 209: The AAA server receives "[MIH-Key-REQ]Kma" and verifies Kma;

After the verification is passed, the AAA server generates Kmc and returns the 3 full certificate result and Kmc to the accessible PoS through "AAA RSP".

Step 210: The accessible PoS receives the verification result and Kmc, and sends the Kmc protected "[MIH_Key- RSP]Kmc" to the MN.

Step 211: The MN receives "[MIH_Key-RSP]Kmc,,, and verifies Kmc;

After the verification is passed, the MN selects the target PoS to be accessed from the candidate PoSs that can be accessed, and sends the KMS-protected "[MIH-Commit-REQ]Kms" to the Serving PoS.

Step 212: Serving PoS receives "[MIH-Commit-REQ]Kms" and verifies Kms; After the verification is passed, Serving PoS protects "[MIH-Commit-REQ]Kcs" with Kcs and sends it to the target PoS.

Step 213: The target PoS receives "[MIH-Commit-REQ]Kcs", and verifies Kcs;

After the verification is passed, the target PoS sends the KCS-protected "[MIH-Commit-RSP]Kcs, to the Serving PoS.

Step 214: Serving PoS receives "[MIH-Commit-RSP]Kcs,,, and verifies Kcs; After the verification is passed, the Serving PoS sends the KMS protected "[MIH-Commit- RSP]Kms'" to the MN.

Step 215: The MN receives "[Mffl_Commit-RSP]Kms,, and verifies Kms, and completes the handover. Thereafter, the MN may also send a handover complete message "[MIH_Complete-REQ]Kmc" to the target PoS, and the target PoS returns a response. The message "[MIH_Complete-RSP]Kmc" confirms that the switch is complete.

In the media-independent handover process of this embodiment, the SA is established between the MN and each PoS and between the PoSs, that is, the shared key is used to ensure the secure access of the MN to the service information and the security of the network handover process, thereby solving the media as a whole. A security issue that has nothing to do with switching.

In this embodiment, after the information server receives "[MIH_Service-REQ]Kmn", it may further determine whether the service point is a MN message transmission according to the transmission destination information in "[MIH_Service-REQ]Kmn". And the method of obtaining the service information in the embodiment may be replaced by the method for obtaining the service information in the method embodiment 1, or by using the Serving PoS broadcast service message "[MIH-Service] Kms". The MN obtains the service information, and can also directly broadcast the "[MIH_Service]Kmn" message to the MN through the information server to obtain the service information. The process of switching the network after obtaining the service information in this embodiment can also be obtained by using the method embodiment 1. The process after the information is replaced, and the network switching of the MN is implemented securely.

Because of the direct security architecture, the MN can distinguish the object of the key request and establish its SA with the target network in the original network. Therefore, the SA can be established after the handover, which reduces the handover delay. In this embodiment, after receiving the "[MIH-Prepare-RSP]Kms" message, the MN first establishes an SA with all accessible candidate PoSs, that is, generates a sharing between the MN and all accessible candidate PoSs. The key, and then initiates a handover execution request message to the target PoS, avoiding the establishment of the SA during the handover execution process or the inability to establish the handover, thereby saving the handover execution time and speeding up the network handover speed. If the MN needs to access an information server located in the home network, the Serving PoS of the visited network where the MN is located may not have a security association with the information server. The SA may be built first, and then the handover is accessed, thereby saving the access switching time.

In the above embodiment, the message is protected by a shared key, which is either encryption or integrity. Protection, which method is used is determined by a specific agreement.

Mobile node device embodiment

5 is a schematic structural diagram of an embodiment of a mobile node device according to the present invention. The mobile node device 10 includes: a service information acquiring module 11, a verification module 12, a requesting module 13, and a message protection module 14; wherein the service information acquiring module 11 is used for the slave network. The side obtains the service information protected by the shared key; the verification module 12 is configured to verify the shared key, such as Kms, Kmn, Kmc; and the requesting module 13 is configured to verify, at the verification module 12, that the shared key passes And sending a handover preparation request message to the network side according to the service information; or sending a service request message for acquiring the service information to the network side; the message protection module 14 protects the handover preparation request message and the service by using Kms Request message; or protect the service request message with Kmn.

In this embodiment, the service information acquiring module 11 is further configured to receive a Kms-protected handover command or a handover preparation response message and a handover execution response message that are sent by the network side, where the handover preparation response message includes the determination result; The requesting module 13 is further configured to send a Kms-protected handover execution request message to the network side according to the handover command; or obtain the determination result from the handover preparation response message, and according to the determination result, The network side sends a Kms-protected handover execution request message; the handover execution request message includes target service point information; and the requesting module 13 is further configured to send a KMA-protected key generation request message to the network-side AAA server. The message protection module 14 is further configured to protect the key generation request message with Kma; the service information obtaining module 11 is further configured to receive a Kmc-protected key generation response message sent by the network side; the verification module 12 is further configured to verify the Kmc .

The mobile node device embodiment described above enables the mobile node to securely perform media independent switching through the verification module 12 and the message protection module 14.

System embodiment

FIG. 6 is a schematic structural diagram of an embodiment of a media independent switching system according to the present invention. The system 20 includes a message sending module 21, a system message protection module 22, a message receiving module 23, a system checking module 24, and a switching module 25. The system message protection module 22 is used. Protect the service information with a shared key; then send it by message The sending module 21 sends the protected service information to the MN; the message receiving module 23 is configured to receive the Kms-protected handover preparation request message sent by the MN; the system verification module 24 is configured to verify the Kms; and the switching module 25 is configured to prepare according to the handover The request message connects the MN to the target service point and completes the handover.

In this embodiment, the message receiving module 23 is further configured to receive the Kms-protected service request message sent by the MN; the message sending module 21 may be further configured to send a service response message including the service information to the MN; the system message protection module 22 may also use the Kms. The service response message is protected.

The switching module 25 may include a first receiving module, a first verifying module, a first protection module, a first sending module, a second receiving module, a second verifying module, a second protecting module, a second sending module, and a third receiving module. a third verification module, a key generation module, and a third transmission module; wherein, the first verification module, the first protection module, and the first transmission module are disposed in the Serving PoS, and after the system verification module verifies that the Kms is passed, the first protection module is used The Kcs protects the resource query request message and sends it to the candidate PoS by the first sending module. The second receiving module, the second verifying module, the second protection module, and the second sending module are set in the candidate PoS or the target PoS, and the second receiving module receives the first a resource query request message sent by the sending module, the second verification module verifies the Kcs of the protection resource query request message, and after the verification is passed, the candidate PoS generates a resource query response message, and after the second protection module is protected by the Kcs, the second sending module Sending to the Serving PoS; the first receiving module receives the resource query response message, and the first verification module verifies the Kcs; The first protection module sends the Kms-protected handover execution request message sent by the MN, and the first verification module verifies the Kms. After the verification is passed, the first protection module sends the Kms-protected handover execution request message sent by the MN. The first protection module uses Kcs to protect the handover execution request message, and the first sending module sends the Kcs-protected handover execution request message to the second receiving module. After receiving the second receiving module, the second verification module verifies the Kcs, and after the verification is passed, The target PoS generates a handover execution response message, the second protection module uses Kcs to protect the handover execution response message, and the second sending module sends the protected handover execution response message to the MN; the second receiving module receives the Kma-protected key sent by the MN. Generating a request message, the second sending module sends the Kma protected key generation request message to the third receiving module; the third receiving module, the third verifying module, the key generating module, and the third sending module are disposed in the AAA server, Three receiving module Receiving a key generation request message, the third verification module verifies Kma; after the verification is passed, the key generation module generates Kmc, and the third sending module sends the verification result of the third verification module and the Kcs to the second receiving module; the second receiving module Receiving, the target PoS generates a key generation response message, the second protection module generates a response message by using the Kmc protection key, and the second sending module sends the protected key generation response message to the MN; the second receiving module receives the MN transmission After the Kmc protection switch completion request message, the second check ii^mo block verification Kmc, after the verification is passed, the target PoS generates a handover completion response message, the second protection module is protected by Kmc, and the second transmission module completes the protection handover. A response message is sent to the MN.

In the foregoing system embodiment, the media independent switching system may further include a determining module, where the determining module is configured to be located in the Serving PoS, and configured to determine whether the PoS is the sending target of the service request message, or determine whether the MN requests information is stored by the MN; If the PoS is the destination of the service request message, the Serving PoS performs a corresponding operation, such as verifying the Kms. If it is determined that the MN requests the information, the first sending module sends the information requested by the MN to the MN.

The media independent switching system may further include a creating module, and the creating module is set on the Serving PoS. If the determining module determines that the Serving PoS does not store the information requested by the MN, the new service request message is created and sent to the information server.

In the above system embodiment, the system message protection module, the system verification module, and the key generation module ensure the security of the media independent handover.

A person skilled in the art can understand that all or part of the steps of implementing the above method embodiments may be completed by using hardware related to program instructions, and the foregoing program may be stored in a computer readable storage medium, and the program is executed when executed. The foregoing steps include the steps of the foregoing method embodiments; and the foregoing storage medium includes: a medium that can store program codes, such as a ROM, a RAM, a magnetic disk, or an optical disk.

It should be noted that the above embodiments are only for explaining the technical solutions of the present invention, and are not intended to be limiting; although the present invention has been described in detail with reference to the foregoing embodiments, it will be understood by those skilled in the art that: The technical solutions described in the foregoing embodiments are modified, or some of the technical features are equivalently replaced. The modifications and substitutions do not depart from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

Rights request

A method for implementing media independent switching, which is characterized by comprising:

Receiving a handover preparation request message, where the handover preparation request message is sent by the mobile node according to the service information after verifying the shared key, and the handover preparation request message is protected by a first shared key;

Verifying the first shared key and accessing the mobile node to a target service point.

2. The method according to claim 1, wherein the network side transmits the service information protected by the shared key to the mobile node, specifically:

Receiving, by the network side, the shared key protected service request message sent by the mobile node, and verifying the shared key;

After the verification is passed, the network side sends a service response message that is protected by the shared key to the mobile node, where the service response message includes service information requested by the mobile node.

The method according to claim 2, wherein the verifying the shared key further comprises:

The service point that receives the service request message in the network side determines whether the service point is a sending target of the service request message;

And if the service point is not the sending target of the service request message, forwarding the service request message to a sending target of the service request message; the network side receiving the sending target returns after receiving the service request message The response message of the service request, the service response message includes service information requested by the mobile node.

The method according to claim 2, wherein before the sending, by the network side, the service response message protected by the shared key to the mobile node, the method further includes:

The service point in the service state in the network side determines, when the shared key verification is passed, whether the service point stores the service information requested by the mobile node; If not, the service point in the service state creates a new service request message, and is protected by the second shared key, and then sent to the information server in the network side; the information server receives the new service request message. And verifying the second shared key; after the verification is passed, the information server returns a new service response message protected by the second shared key to the service point in the service state, the new service response message Include the service information requested by the mobile node; the service point in the service state receives the new service response message, and verifies the second shared key; after the verification is passed, the service point in the service state is obtained The service information.

The method according to claim 1, wherein the network side transmits the service information protected by the shared key to the mobile node, specifically:

The information server in the network side broadcasts the service information to each service point on the network side, and the service information is protected by a second shared key;

The service point in the service state in the network side receives the service information, and verifies the second shared key;

After the verification is passed, the service point in the service state broadcasts the service message protected by the shared key, and the service message includes the service information.

The network side broadcasts a service message protected by the first shared key or the third shared key, or the network side unicasts the service message protected by the first shared key to the mobile node, where the service message includes Service information.

The method according to claim 1, wherein the verifying the first shared key and accessing the mobile node to the target service point is specifically:

The network side verifies the first shared key;

After the verification is passed, the network side returns, according to the handover preparation request message, a handover command or a handover preparation response message that is protected by the first shared key to the mobile node, and the handover preparation response message includes whether the handover preparation response message includes The judgment result of entering the mobile node; Receiving, by the network side, the handover execution request message that is sent by the mobile node and protected by the first shared key, and verifying the first shared key;

After the verification is passed, the network side returns a handover execution response message that is protected by the first shared key to the mobile node according to the handover execution request message;

Receiving, by the network side, a key generation request message that is protected by the fifth shared key and sent by the mobile node, and verifying the fifth shared key;

After the verification is passed, the network side returns a key generation response message protected by the sixth shared key to the mobile node.

The method according to claim 7, wherein the network side before receiving the handover execution request message that is sent by the mobile node and is protected by the first shared key further includes: The service status service point receives the handover execution request message that is sent by the mobile node and is protected by the first shared key, and the handover execution request message protected by the first shared key is received by the mobile node. Transmitting a command or switching a preparation response message, and verifying the first shared key; or

The service point in the service state in the network side receives the handover execution request message that is sent by the mobile node according to the determination result and is protected by the first shared key; the handover execution request message is received by the mobile node by the mobile node. Determining a handover command or a handover preparation response message, and verifying the first shared key; the determination result is obtained by the mobile node from the handover preparation response message; the handover execution request message includes a target service Point information.

The method according to claim 7, wherein the network side further includes: before receiving, by the mobile node, the key generation request message protected by the fifth shared key;

Receiving, by the mobile node, a key generation request message protected by the fifth shared key, where the key generation request message protected by the fifth shared key is received by the mobile node The corresponding message is executed, and the first shared key is verified and issued.

The method according to claim 1, wherein the verifying the first shared key and the accessing the mobile node to the target service point are: The network side verifies the first shared key;

After the verification is passed, the network side returns, according to the handover preparation request message, a handover command or a handover preparation response message that is protected by the first shared key to the mobile node;

After the verification is passed, the network side returns a key generation response message protected by the sixth shared key to the mobile node according to the key generation request message;

Receiving, by the network side, a handover execution request message that is sent by the mobile node and protected by the first shared key, and verifying the first shared key;

After the verification is passed, the network side returns a handover execution response message that is protected by the first shared key to the mobile node.

The method according to claim 10, wherein, before the receiving, by the network side, the key generation request message protected by the fifth shared key sent by the mobile node, the method further includes:

Receiving a fifth shared key protected key generation request message sent by the mobile node according to the determination result; the fifth shared key protected key generation request message is received by the mobile node by the mobile node The preparation preparation response message is sent, and the first shared key is verified and issued.

The method according to claim 10, wherein the receiving, by the network side, the handover execution request message that is sent by the mobile node and that is protected by the first shared key, further comprises: receiving, sending, by the mobile node, The handover execution request message protected by the first shared key; the handover execution request message protected by the first shared key is received by the mobile node to receive the key generation response message, and the verification Issued after the sixth shared key.

The method according to any one of claims 7 to 12, wherein the network side returns a handover that is protected by the first shared key to the mobile node according to the handover preparation request message. The command or switch preparation response message is specifically:

The service point in the service state of the network side sends a resource query request message protected by the fourth shared key to each candidate service point in the network side; Receiving, by each candidate service point, the resource query request message, and verifying the fourth shared key;

After the verification is passed, the candidate service points determine whether the service point can access the mobile node, and return a resource query response message protected by the fourth shared key to the service point in the service state. The resource query response message includes a judgment result;

The service point in the service state receives the resource query response message, and verifies the fourth shared key;

After the verification is passed, the service point in the service state selects a target service point for the mobile node to access according to the determination result, and sends a handover command that is protected by the first shared key to the mobile node. The handover command includes the target service point information; or the service point in the service state sends a handover preparation response message protected by the first shared key to the mobile node, where the handover preparation response message includes There is the result of the judgment.

The method according to any one of claims 7 to 12, wherein the network side returns a handover execution by the first shared key protection to the mobile node according to the handover execution request message. The response message is specifically:

The service point in the service state in the network side protects the handover execution request message by using a fourth shared key, and sends the handover execution request message to the target service point according to the target service point information;

Receiving, by the target service point, the handover execution request message, and verifying the fourth shared key; after the verification is passed, the target service point returns to the service point in the service state to be protected by the fourth shared key Switching execution response message;

The service point in the service state receives the handover execution response message, and verifies the fourth shared key;

After the verification is passed, the service point in the service state protects the handover execution response message with the first shared key, and sends the handover execution response message to the mobile node.

The method according to any one of claims 7-9, wherein the network side Returning, by the mobile node, the key generation response message protected by the sixth shared key is: the target service point on the network side sends the fifth shared key protection to the authentication and authorization charging server on the network side. Key generation request message;

Receiving, by the authentication and authorization charging server, the key generation request message, and verifying the fifth shared key;

After the verification is passed, the authentication and authorization charging server generates a sixth shared key, and returns a verification result and the sixth shared key to the target service point;

The target service point returns a key generation response message protected by the sixth shared key to the mobile node.

The method according to any one of claims 10 to 12, wherein the network side returns a key generated by the sixth shared key protection to the mobile node according to the key generation request message. The response message is specifically:

The candidate service point accessible in the network side forwards the key generation request message to the authentication and authorization accounting server on the network side;

After the verification is passed, the authentication and authorization charging server generates a sixth shared key, and returns a verification result and the sixth shared key to the accessible service point;

The accessible service point receives the verification result and the sixth shared key, and transmits a key generation response message protected by the sixth shared key to the mobile node.

17. A mobile node device, comprising:

The mobile node device according to claim 17, wherein the requesting module is further configured to send a service request message for acquiring the service information to a network side, where the message protection module is further used for The first shared key protects the service request message; the service information obtaining module is further configured to receive a service response message that is sent by the network side and includes the service information.

The mobile node device according to claim 17, wherein the service information acquiring module is further configured to receive a service message that is broadcast by the network side and is protected by the first shared key or the third shared key, where The service message contains the service information.

The mobile node device according to claim 17, wherein the requesting module is further configured to send, to the network side, a service request message for acquiring the service information; the message protection module is further configured to use The third shared key protects the service request message; the service information obtaining module is further configured to receive a service response message that is sent by the network side and includes the service information; the verification module is further configured to verify that the service response message is protected The third shared key.

The mobile node device according to claim 17, wherein the service information acquiring module is further configured to receive a first shared key protected service message unicast by the network side, where the service message includes Service information.

The mobile node device according to any one of claims 17 to 21, wherein: the service information acquiring module is further configured to receive a handover command that is sent by the network side and is protected by the first shared key or a handover preparation response message and a handover execution response message, a handover execution response message, and a key generation response message protected by the sixth shared key;

The requesting module is further configured to send, by using the handover command or the handover preparation response message, a handover execution request message that is protected by the first shared key to the network side; and send a key generation request message to the network side;

The message protection module is further configured to protect the handover execution request message with the first shared key, and protect the key generation request message with a fifth shared key;

The verification module is further configured to verify the sixth shared key.

23. A system for implementing media independent switching, comprising: a message sending module, configured to send service information to the mobile node;

a system verification module, configured to verify the first shared key;