WO2009043278A1 - Procédé, système et dispositif pour négocier la capacité de sécurité pendant qu'un terminal se déplace - Google Patents

Procédé, système et dispositif pour négocier la capacité de sécurité pendant qu'un terminal se déplace Download PDF

Info

Publication number
WO2009043278A1
WO2009043278A1 PCT/CN2008/072486 CN2008072486W WO2009043278A1 WO 2009043278 A1 WO2009043278 A1 WO 2009043278A1 CN 2008072486 W CN2008072486 W CN 2008072486W WO 2009043278 A1 WO2009043278 A1 WO 2009043278A1
Authority
WO
WIPO (PCT)
Prior art keywords
key
mobility management
mme
sgsn
authentication vector
Prior art date
Application number
PCT/CN2008/072486
Other languages
English (en)
French (fr)
Inventor
Chengdong He
Original Assignee
Huawei Technologies Co., Ltd.
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Family has litigation
First worldwide family litigation filed litigation Critical https://patents.darts-ip.com/?family=40518035&utm_source=google_patent&utm_medium=platform_link&utm_campaign=public_patent_search&patent=WO2009043278(A1) "Global patent litigation dataset” by Darts-ip is licensed under a Creative Commons Attribution 4.0 International License.
Application filed by Huawei Technologies Co., Ltd. filed Critical Huawei Technologies Co., Ltd.
Priority to EP08800967A priority Critical patent/EP2187561B1/en
Publication of WO2009043278A1 publication Critical patent/WO2009043278A1/zh
Priority to US12/717,385 priority patent/US9060268B2/en
Priority to US14/728,687 priority patent/US9572027B2/en
Priority to US15/408,684 priority patent/US10548012B2/en

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
    • H04L63/205—Network architectures or network communication protocols for network security for managing network security; network security policies in general involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/083—Network architectures or network communication protocols for network security for authentication of entities using passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/107—Network architectures or network communication protocols for network security for controlling access to devices or network resources wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04M—TELEPHONIC COMMUNICATION
    • H04M1/00—Substation equipment, e.g. for use by subscribers
    • H04M1/66—Substation equipment, e.g. for use by subscribers with means for preventing unauthorised or fraudulent calling
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/043—Key management, e.g. using generic bootstrapping architecture [GBA] using a trusted network node as an anchor
    • H04W12/0431—Key distribution or pre-distribution; Key agreement
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/043—Key management, e.g. using generic bootstrapping architecture [GBA] using a trusted network node as an anchor
    • H04W12/0433—Key management protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W60/00—Affiliation to network, e.g. registration; Terminating affiliation with the network, e.g. de-registration
    • H04W60/04—Affiliation to network, e.g. registration; Terminating affiliation with the network, e.g. de-registration using triggered events
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W8/00—Network data management
    • H04W8/02—Processing of mobility data, e.g. registration information at HLR [Home Location Register] or VLR [Visitor Location Register]; Transfer of mobility data, e.g. between HLR, VLR or external networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W8/00—Network data management
    • H04W8/22—Processing or transfer of terminal data, e.g. status or physical capabilities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W80/00—Wireless network protocols or protocol adaptations to wireless operation
    • H04W80/02—Data link layer protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W88/00—Devices specially adapted for wireless communication networks, e.g. terminals, base stations or access point devices
    • H04W88/12—Access point controller devices

Definitions

  • the present invention relates to the field of communications technologies, and in particular, to a method, system and device for negotiating security capabilities when a terminal moves.
  • the wireless network includes a wireless access network and a core network.
  • the future evolution of the wireless network core network includes a Mobile Management Entity (MME), which functions as a GPRS (General Packet Radio Service) Support Node (SGSN) for 2G/3G networks. Similarly, it mainly completes mobility management, user authentication, and so on.
  • MME Mobile Management Entity
  • SGSN General Packet Radio Service Support Node
  • NAS Non-Access Signaling
  • a UE accessing the network through the LTE Long Term Evolution
  • LTE Long Term Evolution
  • GERAN Global Mobile Communication Edge Radio Access Network
  • UTRAN 3G Terrestrial Radio Access Network
  • RAU routing area update
  • the entity that performs the security capability negotiation for the UE has changed, for example, the MME becomes the SGSN, and the security capabilities of these entities are not necessarily consistent. Therefore, the security capability negotiation process needs to be re-executed to ensure subsequent Security during the interaction between the UE and the network in the process.
  • the RAU procedure needs to complete the encryption algorithm and integrity protection algorithm negotiation between the UE and the RNC, as well as the encryption key and integrity guarantee. Negotiation of the key.
  • the RAU procedure needs to complete the encryption algorithm between the UE and the 2G-SGSN and the negotiation of the encryption key.
  • the embodiments of the present invention provide a method for negotiating security capability when a terminal moves, so that when a UE in an idle state moves from an LTE network to a 2G/3G network, security capability negotiation can be performed.
  • the embodiment of the present invention further provides a system for negotiating security capability of a terminal, so that when a UE in an idle state moves from an LTE network to a 2G/3G network, security capability negotiation can be performed.
  • the embodiment of the present invention further provides an SGSN, which can obtain an authentication vector related key when the UE in the idle state moves from the LTE network to the 2G/3G network.
  • the embodiment of the present invention further provides an MME, and when the UE in the idle state moves from the LTE network to the 2G/3G network, the authentication vector related key may be sent to the 2G/3G network side.
  • a method for negotiating security capability when a terminal moves, when the user equipment UE moves from a long-term evolution LTE source network to a 2G/3G target network includes :
  • the target network side entity receives the routing area update request sent by the UE, obtains the security capability supported by the UE, and acquires an authentication vector related key derived according to the root key;
  • the UE derives an authentication vector related key according to its own root key.
  • a system for negotiating security capability when a terminal moves comprising a user equipment UE and a target network side entity,
  • the UE when used to move from a long-term evolution LTE source network to a 2G/3G target network, The target network side entity sends a routing area update request; receives the selected security algorithm sent by the target network side entity; and derives an authentication vector related key according to its own root key;
  • the target network side entity is configured to receive a routing area update request sent by the UE, obtain a security capability supported by the UE, and an authentication vector related key derived according to the root key; and select according to the security capability supported by the UE A security algorithm sends the selected security algorithm to the UE.
  • a serving general packet radio service support node SGSN is applied to a user equipment UE to move from a long term evolution LTE source network to a 2G/3G target network, the SGSN comprising a key acquisition module for mobility from a mobility management entity MME Obtaining a root key in the management context response message, and deriving an authentication vector related key according to the root key;
  • a mobility management entity MME is applied to a user equipment UE to move from a long-term evolution LTE source network to a 2G/3G target network, where the MME includes a key derivation module and a sending module.
  • the key derivation module is configured to: after receiving the mobility management context request message sent by the serving general packet radio service support node SGSN, derive an authentication vector related key according to the root key;
  • the sending module is configured to send the authentication vector related key obtained by the key derivation module to the SGSN by using a mobility management context response message.
  • the target network side entity when the UE moves from the LTE source network to the 2G/3G target network, the target network side entity receives the routing area update request sent by the UE, and obtains the security supported by the UE. Capability, and an authentication vector related key derived from the root key; the UE derives the authentication vector related key according to its own root key, thereby realizing the negotiation of the key in the security capability negotiation; the target network side entity is based on The security capability supported by the UE selects a security algorithm, and sends the selected security algorithm to the UE, thereby implementing negotiation of the security algorithm in the security capability negotiation. Therefore, when the UE moves from the LTE source network to the 2G/3G target network, the security capability can be negotiated with the network side to ensure security when interacting with the network.
  • FIG. 1 is a flowchart of a method for negotiating security capability when a terminal moves according to an embodiment of the present invention
  • FIG. 2 is a flowchart of a method for negotiating security capability of a terminal when moving according to a second embodiment of the present invention
  • FIG. 4 is a flowchart of a method for negotiating security capability of a terminal when moving according to a fourth embodiment of the present invention
  • FIG. 5 is a flowchart of a method for negotiating security capability of a terminal when moving according to an embodiment of the present invention
  • Embodiment 6 is a flowchart of a method for negotiating security capability when a terminal moves
  • FIG. 7 is a schematic diagram of a system for negotiating security capability when a terminal moves according to an embodiment of the present invention
  • FIG. 8 is a schematic diagram of a 2G system structure for negotiating security capability of a terminal when moving according to Embodiment 7 of the present invention
  • And external connection diagram ;
  • FIG. 9 is a schematic diagram of a 3G system structure and an external connection relationship of a security capability negotiation when a terminal moves according to an embodiment of the present invention.
  • FIG. 10 is a schematic diagram of a service general packet radio service support node SGSN according to an embodiment of the present invention.
  • FIG. 11 is a schematic diagram of a mobility management entity MME according to Embodiment 11 of the present invention.
  • the target network side entity receives the routing area update request sent by the UE, and obtains the security capability supported by the UE, when the UE moves from the LTE source network to the 2G/3G target network. And an authentication vector related key derived from the root key; selecting a security algorithm according to a security capability supported by the UE, and transmitting the selected security algorithm to the UE; the UE deriving the authentication vector related key according to the root key of the UE .
  • the process of performing security capability negotiation when the UE moves from the LTE network to the 3G network is described in detail below by using the first embodiment to the third embodiment.
  • a process of security capability negotiation is initiated.
  • the target network side entity is a 3G-SGSN and a radio network controller (RNC, Radio Network Controller ).
  • Embodiment 1 is a diagrammatic representation of Embodiment 1:
  • the 3G-SGSN directly acquires the authentication vector related key derived from the root key from the MME.
  • FIG. 1 is a flowchart of a method for negotiating security capability when a terminal moves according to an embodiment of the present invention. As shown in Figure 1, the method includes the following steps:
  • Step 100 The UE sends a routing area update request (RAU Request) to the 3G-SGSN through the RNC.
  • RAU Request routing area update request
  • the RAU request sent by the UE to the 3G_SGSN may carry the security supported by the UE, in addition to some parameters well known to those skilled in the art, such as, for example, Temporary Mobile Subscriber Identity (TMSI). Capabilities, including encryption algorithms and/or integrity protection algorithms.
  • TMSI Temporary Mobile Subscriber Identity
  • Step 101 to Step 103 The 3G-SGSN acquires the authentication vector related key derived from the root key from the MME through the mobility management context message.
  • 3G - The SGSN sends a mobility management context request message to the MME, and the MME derives an authentication vector related key, including an integrity protection key IK and an encryption key, by using a one-way transformation function according to its own root key Kasme.
  • CK, or IK, and CK which are further obtained by unidirectional transformation of IK and CK, and then return a mobility management context response message carrying the authentication vector related key to the 3G-SGSN;
  • 3G - SGSN correlates the authentication vector The key acts as the current encryption key and integrity protection key.
  • the mobility management context response message returned by the MME to the 3G-SGSN in step 103 needs to further carry the security supported by the UE. ability.
  • Unidirectional transformation refers to the transformation of the original parameters by some algorithm to obtain the target parameters, but the transformation process of the original parameters cannot be derived from the destination parameters. For example, if CK is obtained by the algorithm f(Kasme), Kasme cannot be derived backwards from CK by any inverse algorithm.
  • a transformation is a one-way transformation.
  • Steps 104 to 106 The 3G-SGSN sends a security mode command (SMC, Security Mode Command) message carrying the security capability supported by the UE, the security capability allowed by the system, and the security key to the RNC.
  • the RNC supports the security capability and system supported by the UE.
  • the allowed security capability and the security capabilities supported by itself, the security algorithm is selected, including the encryption algorithm and the integrity protection algorithm; and then the SMC message carrying the security capability supported by the UE and the selected security algorithm is sent to the UE.
  • the SMC message can also be included in the RAU accept message.
  • Step 107 109 The UE derives an authentication vector related key according to its own root key, including IK and CK, or IK' and CK' obtained by unidirectional transformation of IK and CK, respectively, as the current encryption key. Key and integrity protection key; and according to the security capabilities supported by the UE sent by the RNC, and the security capabilities stored by itself, determine whether there is a degraded attack; then send an SMC Complete (SMC Complete) message to the RNC, from the RNC to the 3G - The SGSN sends an SMC Complete message carrying the selected security algorithm.
  • SMC Complete SMC Complete
  • the SMC completion message may also be included in the RAU completion message.
  • Step 110 to Step 111 3G -
  • the SGSN sends a RAU Accept message to the UE. After receiving the message, the UE returns a RAU Complete message to the 3G-SGSN.
  • Embodiment 2 is a diagrammatic representation of Embodiment 1:
  • the 3G-SGSN after obtaining the root key from the MME, the 3G-SGSN derives an authentication vector related key according to the root key.
  • FIG. 2 is a flowchart of a method for negotiating security capability when a terminal moves according to an embodiment of the present invention. As shown in Figure 2, the method includes the following steps:
  • Step 200 The UE sends a RAU request to the 3G-SGSN through the RNC.
  • the RAU request sent by the UE to the 3G_SGSN in addition to carrying some parameters well known to those skilled in the art, for example, the TMSI, may also carry the security capabilities supported by the UE, including an encryption algorithm and/or an integrity protection algorithm.
  • Steps 201 to 203 The 3G-SGSN acquires the root key from the MME through the mobility management context message, and then derives the authentication vector related key according to the root key.
  • the method includes: 3G - the SGSN sends a mobility management context request message to the MME, and the MME returns a mobility management context response message carrying the root key to the 3G-SGSN; the 3G-SGSN passes the single key according to the root key Kasme in the response message. Deriving an authentication vector related key to the transform function, including the integrity protection key IK and the encryption key CK, or further IK and CK obtained by unidirectional transformation of IK and CK, respectively, as the current encryption key Key and integrity protection keys.
  • the mobility management context response message returned by the MME to the 3G-SGSN in this step 103 needs to further carry the security supported by the UE. ability.
  • Steps 204 to 206 The 3G-SGSN sends an SMC message carrying the security capability supported by the UE, the security capability allowed by the system, and the security key to the RNC.
  • the RNC is based on the security capabilities supported by the UE, the security capabilities allowed by the system, and the security supported by the system. Capability, selecting a security algorithm, including an encryption algorithm and an integrity protection algorithm; then transmitting an SMC message carrying the security capabilities supported by the UE and the selected security algorithm to the UE.
  • the SMC message can also be included in the RAU accept message.
  • Step 207 209 The UE derives an authentication vector related key according to its own root key, including IK and CK, or IK' and CK' obtained by unidirectional transformation of IK and CK, respectively, as the current encryption key.
  • the key and integrity protection key and according to the security capability supported by the UE sent by the RNC, and the security capability stored by the RNC, determine whether there is a degraded attack; then send an SMC complete message to the RNC, and the RNC sends the bearer selection to the 3G-SGSN.
  • the security algorithm of the SMC completes the message.
  • the SMC completion message may also be included in the RAU completion message.
  • Steps 210 to 211 The 3G-SGSN sends an RAU accept message to the UE. After receiving the message, the UE returns a RAU Complete message to the 3G-SGSN.
  • Embodiment 3
  • the UE of the 3G-SGSN obtains an authentication vector related key through an authentication and key agreement (AKA) process.
  • AKA authentication and key agreement
  • FIG. 3 is a flowchart of a method for negotiating security capability of a terminal when moving according to an embodiment of the present invention. As shown in Figure 3, the method includes the following steps:
  • Step 300 The UE sends a RAU Request to the 3G-SGSN through the RNC.
  • the mobility management context response message returned by the MME to the 3G-SGSN in step 302 needs to further carry the security supported by the UE. ability.
  • Step 303 The 3G-SGSN and the UE obtain the authentication vector related keys (IK and CK) from the Home Subscriber Server (HSS) through the AKA process.
  • IK and CK authentication vector related keys
  • Steps 304 to 306 The SGSN sends an SMC message carrying the security capability supported by the UE, the security capability allowed by the system, and the security key to the RNC.
  • the RNC is based on the security capabilities supported by the UE, the security capabilities allowed by the system, and the security supported by the system. Capability, selecting a security algorithm, including an encryption algorithm and an integrity protection algorithm; then transmitting an SMC message carrying the security capabilities supported by the UE and the selected security algorithm to the UE.
  • the SMC message can also be included in the RAU accept message.
  • Steps 307 to 310 are the same as steps 108 to 111, and are not described herein again.
  • the process of performing security capability negotiation when the UE moves from the LTE network to the 2G network is described in detail below through Embodiment 4 to Embodiment 6.
  • the security capability negotiation process is initiated.
  • the target network side entity is 2G - SGSN.
  • Embodiment 4 is a diagrammatic representation of Embodiment 4:
  • the 2G-SGSN obtains the reference derived from the root key directly from the MME. Weight vector related key.
  • FIG. 4 is a flowchart of a method for negotiating security capability of a terminal when moving according to Embodiment 4 of the present invention. As shown in Figure 4, the method includes the following steps:
  • Step 400 The UE sends a RAU request to the 2G-SGSN.
  • the RAU request sent by the UE to the 2G_SGSN in addition to carrying some parameters well known to those skilled in the art, such as the TMSI, may also carry the security capabilities supported by the UE, including the encryption algorithm and/or the integrity protection algorithm.
  • the UE sends a RAU request to the 2G-SGSN through the base station system (BSS, Base Station System).
  • BSS Base Station System
  • the following description simplifies communication between the UE and the 2G-SGSN through the BSS to facilitate communication between the UE and the 2G-SGSN.
  • the SGSN obtains an authentication vector related key derived from the root key from the mobility management context response message from the MME.
  • the method includes: 2G - the SGSN sends a mobility management context request message to the MME, and the MME derives the authentication vector related key, including the encryption key Kc, by the one-way transformation function according to the root key Kasme, or further by the Kc Kc obtained after unidirectional transformation; and then returning a mobility management context response message carrying the authentication vector related key to the 2G-SGSN; 2G - SGSN uses the authentication vector related key as the current encryption key.
  • the mobility management context response message returned by the MME to the 2G-SGSN in step 403 needs to further carry the security supported by the UE. ability.
  • Step 404 to step 405 2G -
  • the SGSN selects a security algorithm, including an encryption algorithm, according to the security capabilities supported by the UE, the security capabilities allowed by the system, and the security capabilities supported by the UE. Then, the security function and the security supported by the UE are transmitted to the UE.
  • the RAU of the algorithm accepts the message.
  • Step 406 407 The UE derives an authentication vector related key according to its own root key, including Kc, or Kc obtained by further unidirectionally transforming Kc, as the current encryption key; And according to the security capability supported by the UE sent by the 2G-SGSN, and the security capability of the storage, determine whether there is a degraded attack; and then send a RAU completion message to the 2G-SGSN.
  • Embodiment 5 is a diagrammatic representation of Embodiment 5:
  • the 2G-SGSN obtains the root key from the MME, and then derives the authentication vector related key according to the obtained root key.
  • FIG. 5 is a flowchart of a method for negotiating security capability of a terminal when moving according to Embodiment 5 of the present invention. As shown in Figure 5, the method includes the following steps:
  • Step 500 The UE sends a RAU request to the 2G-SGSN.
  • Step 501 to step 502 2G -
  • the SGSN obtains the root key from the mobility management context response message from the MME.
  • the method includes: 2G:
  • the SGSN sends a mobility management context request message to the MME, and the MME returns a mobility management context response message carrying the root key to the 2G-SGSN.
  • the mobility management context response message returned by the MME to the 2G-SGSN in step 502 needs to further carry the security supported by the UE. ability.
  • Step 503 The 2G-SGSN derives the authentication vector related key according to the obtained root key; and selects a security algorithm, including an encryption algorithm, according to the security capability supported by the UE, the security capability allowed by the system, and the security capability supported by the UE.
  • Steps 504 to 506 are the same as steps 405 to 407, and are not described herein again.
  • Example 6
  • the 2G_SGSN obtains the authentication vector related key through the 2G re-authentication process.
  • FIG. 6 is a flowchart of a method for negotiating security capability of a terminal when moving according to Embodiment 6 of the present invention. As shown in Figure 6, the method includes the following steps:
  • Step 600 The UE sends a RAU request to the 2G-SGSN.
  • Steps 601 to 602 2G -
  • the SGSN sends a mobility management context to the MME.
  • the MME returns a response message containing the mobility management context to the 2G-SGSN. If the RAU request sent by the UE to the 2G-SGSN does not carry the security capability supported by the UE in step 600, the mobility management context response message returned by the MME to the 2G-SGSN in step 602 needs to further carry the security supported by the UE. ability.
  • Step 603 The 2G-SGSN and the UE obtain the authentication vector related key (Kc) from the HSS through the 2G re-authentication process.
  • Step 604 to step 606 The SGSN selects a security algorithm, including an encryption algorithm, according to the security capabilities supported by the UE, the security capabilities allowed by the system, and the security capabilities supported by the UE.
  • the SGSN then sends the security capability and selection security supported by the UE to the UE.
  • the RAU of the algorithm accepts the message; the UE returns a RAU Complete message to the 2G-SGSN.
  • the embodiment of the present invention further provides a system for negotiating security capability of a terminal, as shown in FIG. 7, including a UE 100 and a target network side entity 200.
  • the UE 100 is configured to send a routing area update request to the target network side entity 200 when moving from the LTE source network to the 2G/3G target network; receive the selected security algorithm sent by the target network side entity 200; and derive according to its own root key The authentication vector related key is obtained.
  • the target network side entity 200 is configured to receive a routing area update request sent by the UE, obtain a security capability supported by the UE, and an authentication vector related key derived according to the root key; and select a security algorithm according to the security capability supported by the UE 100, to The UE 100 transmits the selected security algorithm.
  • the following example 7 and the embodiment 8 respectively take the 2G system and the 3G system negotiated by the security of the terminal as an example, and the system for negotiating the security capability of the terminal during the embodiment of the present invention is described.
  • the target network side entity is the SGSN (2G - SGSN) 210 in the 2G network.
  • FIG. 8 is a diagram showing a 2G system structure and an external connection relationship of security capability negotiation when a terminal moves in the embodiment of the present invention.
  • the SGSN 210 includes a key acquisition module 211 and a selection transmission module 212.
  • the key obtaining module 211 is configured to: after receiving a routing area update request sent by the UE, A root key is obtained from a mobility management context response message from the mobility management entity MME, and an authentication vector related key is derived from the root key.
  • Transmitting the selection module 212 configured to obtain the UE 100's security capabilities, the UE 100 according to the acquired security capability supported, select the security algorithm, and transmitting the selected security algorithm to UE100 o
  • the mobile management entity MME 310 is further applied to the user equipment UE to move from the long-term evolution LTE source network to the 2G/3G target network.
  • the MME 310 includes a storage module 311 and a first sending module 312.
  • the storage module 311 is configured to save a root key.
  • the first sending module 312 is configured to send the root key saved by the storage module 311 by using a mobility management context response message after receiving the mobility management context request message sent by the general packet radio service support node SGSN. To the SGSN.
  • the key obtaining module 211 is configured to obtain, from a mobility management context response message from the MME, an authentication vector related key that is derived by the MME according to its own root key.
  • the mobility management entity MME includes a key derivation module and a second sending module, and the key deriving module is configured to: after receiving the mobility management context request message sent by the SGSN, derive an authentication vector according to the root key
  • the second sending module is configured to send the authentication vector related key obtained by the key derivation module to the SGSN by using a mobility management context response message.
  • the target network side entity 200 includes the SGSN (3G - SGSN) 220 and the RNC 230 in the 3G network.
  • FIG. 9 is a diagram showing the structure and external connection relationship of the 3G system for security capability negotiation when the terminal moves in the embodiment of the present invention.
  • the SGSN 220 in the system includes a key obtaining module 221 and a message sending module 222, and the key obtaining module 221 is configured to use a mobility management context from the MME.
  • the authentication vector related key derived by the MME according to the root key is obtained.
  • the message sending module is configured to carry the security capability supported by the UE, the security capability allowed by the system, and the security mode of the security key.
  • the command message is sent to the RNC 230 for processing.
  • the MME 320 in this embodiment includes a key derivation module 321 and a second sending module 322.
  • the key derivation module 321 is configured to: after receiving the mobility management context request message sent by the serving general packet radio service support node SGSN, derive an authentication vector related key according to the root key;
  • the second sending module 322 is configured to send the authentication vector related key obtained by the key derivation module 321 to the SGSN by using a mobility management context response message.
  • the first module 312 is configured to include a storage module 311 and a first sending module 312, where the storage module 311 is configured to save a root key, and the first sending module 312 is configured to: after receiving the mobility management context request message sent by the SGSN, The root key saved by the storage module 311 is sent to the SGSN through a mobility management context response message.
  • the embodiment of the present invention further provides a serving general packet radio service support node SGSN, which is applied to a user equipment UE to move from a long-term evolution LTE source network to a 2G/3G target network.
  • SGSN will be described below by taking the embodiment 9 and the tenth embodiment as an example.
  • the embodiment of the present invention further provides a service general packet radio service support node SGSN, including a key acquisition module, for receiving from the mobility management entity MME.
  • the root key is obtained in the mobility management context response message, and the authentication vector related key is derived according to the root key.
  • the key obtaining module is configured to obtain, from the mobility management context response message from the mobility management entity MME, the MME to derive according to its own root key.
  • the authentication vector related key is configured to obtain, from the mobility management context response message from the mobility management entity MME, the MME to derive according to its own root key.
  • the SGSN is used when the user equipment UE moves from the long term evolution LTE source network to the 2G target network.
  • the SGSN includes a key acquisition module 211 and a selection transmission module 212.
  • the key obtaining module 211 is configured to obtain a root key from a mobility management context response message from the mobility management entity MME, and derive an authentication vector related key according to the root key.
  • the selection sending module 212 is configured to acquire the security capability supported by the UE 100, select a security algorithm according to the obtained security capability supported by the UE 100, and send the selected security algorithm to the UE 100.
  • the present invention is not limited thereto, and the key acquisition module is used in another embodiment to acquire an authentication vector derived by the MME according to its own root key from a mobility management context response message from the mobility management entity MME. Related key.
  • the embodiment of the present invention further provides a mobility management entity MME, which is applied to a user equipment UE to move from a long-term evolution LTE source network to a 2G/3G target network.
  • MME mobility management entity
  • the MME of the present embodiment includes a key derivation module 331 and a sending module 332, where the GWSN obtains an authentication vector related key, which is derived from the MME. 331.
  • the method is configured to: after receiving the mobility management context request message sent by the SGSN, derive an authentication vector related key according to the root key; and send, by the sending module 332, the authentication vector obtained by the key derivation module 331 The key is sent to the serving SGSN through the mobility management context response message.
  • the target network side entity when the UE moves from the LTE source network to the 2G/3G target network, the target network side entity obtains the UE support after receiving the RAU request sent by the UE.
  • the security capability, and the authentication vector related key derived from the root key the UE also derives the authentication vector related key according to its own root key, thereby realizing the key negotiation; the target network side also itself According to the security capabilities supported by the UE
  • the selected security algorithm is sent to the UE, thereby implementing negotiation of the security algorithm.
  • security capability negotiation can be implemented, thereby ensuring security when the subsequent UE interacts with the network.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Signal Processing (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Databases & Information Systems (AREA)
  • Mobile Radio Communication Systems (AREA)

Description

终端移动时安全能力协商的方法、 系统及装置 技术领域
本发明涉及通信技术领域， 具体涉及一种终端移动时安全能力协商的 方法、 系统及装置。
背景技术
无线网络包括无线接入网和核心网两部分。 未来演进的无线网络核 心网包括移动管理实体 ( MME , Mobile Management Entity ) , 其功能与 2G/3G 网络的服务通用分组无线业务 （GPRS , General Packet Radio Service ) 支持节点 （ SGSN, Service GPRS Support Node ) 类似， 主要完 成移动性管理、用户鉴权等。当用户设备（UE, User Equipment )在 2G/3G 或未来演进的无线网络中处于空闲态时， 需要分别与 SGSN或 MME之 间进行非接入信令 ( NAS , Non-Access Signaling ) 安全能力的协商， 以 保证 UE信令的正常接收及通信系统的安全。
当通过未来演进无线接入网 （LTE, Long Term Evolution )接入网 络的 UE在空闲态移动时，可能会移动到 2G的全球移动通信边缘无线接 入网 （ GERAN, GSM Edge Radio Access Network ) 或 3G的通用陆地无 线接入网 （UTRAN, UMTS Terrestrial Radio Access Network ) 的路由区 域中， 从而可能重新通过 2G或 3G ( 2G/3G ) 网络侧接入网络， 此时会 发生路由区域更新 （RAU, inter RAT Route Area Update ) 过程， 即发生 了异种网络之间的路由区域更新过程。 由于此过程中， 为该 UE执行安 全能力协商的实体了发生了变化， 例如由 MME 变为 SGSN, 而且这些 实体的安全能力不一定是一致的，因此需要重新执行安全能力协商过程， 以保证后续过程中 UE和网络交互时的安全。
当 UE从 LTE网络移动到 UTRAN时， RAU过程需要完成 UE和 RNC之间的加密算法和完整性保护算法协商， 以及加密密钥和完整性保 护密钥的协商。
当 UE从 LTE网络移动到 GERAN时 , RAU过程需要完成 UE和 2G - SGSN之间的加密算法以及加密密钥的协商。
现有技术不存在这样的异种网络之间 RAU过程中安全能力协商的方 法， 因此在 UE从 LTE网络移动到 2G/3G网络时， 无法进行安全能力协商， 从而无法保证后续 UE与网络交互时的安全。
发明内容
本发明实施例提供一种终端移动时安全能力协商的方法， 使得当处于 空闲态的 UE从 LTE网络移动到 2G/3G网络时， 能够进行安全能力协商。
本发明实施例还提供一种终端移动时安全能力协商的系统， 使得当处 于空闲态的 UE从 LTE网络移动到 2G/3G网络时，能够进行安全能力协商。
本发明实施例还提供一种 SGSN,当处于空闲态的 UE从 LTE网络移动 到 2G/3G网络时， 可以获取到鉴权矢量相关密钥。
本发明实施例还提供一种 MME , 当处于空闲态的 UE从 LTE网络移动 到 2G/3G网络时， 可以将鉴权矢量相关密钥发送至 2G/3G网络侧。
为达到上述目的， 本发明实施例的技术方案是这样实现的： 一种终端移动时安全能力协商的方法， 当用户设备 UE从长期演进 LTE源网络移动到 2G/3G目标网络时， 该方法包括：
目标网络侧实体接收 UE发送的路由区域更新请求， 获取所述 UE支持 的安全能力， 以及获取根据根密钥推导出的鉴权矢量相关密钥；
根据所述 UE支持的安全能力选择安全算法， 向所述 UE发送所选择的 安全算法；
所述 UE根据自身的根密钥推导出鉴权矢量相关密钥。
一种终端移动时安全能力协商的系统，包括用户设备 UE和目标网络侧 实体，
所述 UE, 用于从长期演进 LTE源网络移动到 2G/3G目标网络时， 向 目标网络侧实体发送路由区域更新请求； 接收目标网络侧实体发送的所选 择的安全算法； 根据自身的根密钥推导出鉴权矢量相关密钥；
所述目标网络侧实体， 用于接收 UE发送的路由区域更新请求， 获取所 述 UE支持的安全能力， 以及根据根密钥推导的鉴权矢量相关密钥； 根据所 述 UE支持的安全能力选择安全算法， 向所述 UE发送所选择的安全算法。
一种服务通用分组无线业务支持节点 SGSN, 应用于用户设备 UE从长 期演进 LTE源网络移动到 2G/3G目标网络中，该 SGSN包括密钥获取模块， 用于从来自移动管理实体 MME 的移动性管理上下文响应消息中获取 根密钥， 并根据所述根密钥推导出鉴权矢量相关密钥；
或用于从来自移动管理实体 MME的移动性管理上下文响应消息中，获 取 MME根据自身的根密钥推导出的鉴权矢量相关密钥。
一种移动管理实体 MME,应用于用户设备 UE从长期演进 LTE源网络 移动到 2G/3G目标网络中， 该 MME包括密钥推导模块和发送模块，
所述密钥推导模块， 用于在接收到服务通用分组无线业务支持节点 SGSN发送的移动性管理上下文请求消息后 ,根据根密钥推导出鉴权矢量相 关密钥；
所述发送模块，用于将密钥推导模块得到的鉴权矢量相关密钥通过移动 性管理上下文响应消息， 发送至 SGSN。
与现有技术相比， 本发明实施例所提供的技术方案， 当 UE从 LTE源 网络移动到 2G/3G目标网络时， 目标网络侧实体接收 UE发送的路由区域更 新请求，获取 UE支持的安全能力， 以及根据根密钥推导出的鉴权矢量相关 密钥； UE根据自身的根密钥推导出鉴权矢量相关密钥， 从而实现了安全能 力协商中密钥的协商； 目标网络侧实体根据 UE支持的安全能力选择安全算 法，向 UE发送所选择的安全算法，实现了安全能力协商中安全算法的协商。 从而使得， 当 UE从 LTE源网络移动到 2G/3G目标网络时， 能够与网络侧 实现安全能力的协商， 从而保证后续与网络交互时的安全。 附图说明
图 1为本发明实施例一终端移动时安全能力协商的方法流程图； 图 2为本发明实施例二终端移动时安全能力协商的方法流程图； 图 3为本发明实施例三终端移动时安全能力协商的方法流程图； 图 4为本发明实施例四终端移动时安全能力协商的方法流程图； 图 5为本发明实施例五终端移动时安全能力协商的方法流程图； 图 6为本发明实施例六终端移动时安全能力协商的方法流程图； 图 7为本发明实施例终端移动时安全能力协商的系统的示意图； 图 8为本发明实施例七终端移动时安全能力协商的 2G系统结构及对外 连接关系图；
图 9为本发明实施例八终端移动时安全能力协商的 3G系统结构及对外 连接关系图；
图 10为本发明实施例十服务通用分组无线业务支持节点 SGSN的示意 图；
图 11为本发明实施例十一移动管理实体 MME的示意图。
具体实施方式
下面结合附图及具体实施例对本发明进行详细说明。
本发明实施例提供的终端移动时安全能力协商的方法，当 UE从 LTE 源网络移动到 2G/3 G目标网络时， 目标网络侧实体接收 UE发送的路由 区域更新请求， 获取 UE支持的安全能力， 以及根据根密钥推导出的鉴 权矢量相关密钥； 根据 UE支持的安全能力选择安全算法， 向 UE发送 所选择的安全算法； UE根据自身的根密钥推导出鉴权矢量相关密钥。
以下首先通过实施例一至实施例三， 对 UE从 LTE网络移动到 3G 网络时， 进行安全能力协商的过程进行详细说明。 已经在空闲态时接入 LTE网络的 UE从 LTE源网络移动到 3G目标网络时， 发起安全能力协 商的过程。其中，目标网络侧实体为 3G - SGSN和无线网络控制器（ RNC , Radio Network Controller ) 。
实施例一：
本实施例中， 3G - SGSN从 MME直接获取根据根密钥推导出的鉴 权矢量相关密钥。
图 1为本发明实施例一终端移动时安全能力协商的方法流程图。 如 图 1所示， 该方法包括以下步骤：
步骤 100: UE通过 RNC向 3G - SGSN发送路由区域更新请求（ RAU Request ) 。
本步骤 UE向 3G _ SGSN发送的 RAU请求中， 除携带本领域技术 人员公知的一些参数， 例如， 例如临时移动用户识别号码 （ TMSI , Temporary Mobile Subscriber Identity )之外， 还可以携带 UE支持的安全 能力， 包括加密算法和 /或完整性保护算法。
步骤 101〜步骤 103 : 3G - SGSN 通过移动性管理上下文消息， 从 MME获取根据根密钥推导出的鉴权矢量相关密钥。
具体包括： 3G - SGSN向 MME发送移动性管理上下文请求消息， MME 根据自身的根密钥 Kasme, 通过单向变换函数推导出鉴权矢量相 关密钥， 包括完整性保护密钥 IK和加密密钥 CK, 或进一步由 IK和 CK 经单向变换后得到的 IK，和 CK，； 然后向 3G - SGSN返回携带鉴权矢量 相关密钥的移动性管理上下文响应消息； 3G - SGSN将鉴权矢量相关密 钥作为当前的加密密钥和完整性保护密钥。
如果步骤 100中， 在 UE发送至 3G - SGSN的 RAU请求中没有携 带 UE支持的安全能力， 则步骤 103中 MME向 3G - SGSN返回的移动 性管理上下文响应消息中， 需进一步携带 UE支持的安全能力。
单向变换是指通过某种算法将原参数变换后得到目的参数， 但是无 法从目的参数返推得到原参数的变换过程。例如，如果通过算法 f(Kasme) 可以得到 CK, 但是无法从 CK通过任何逆算法反向推导出 Kasme, 这种 变换就是单向变换。
步骤 104〜步骤 106: 3G - SGSN向 RNC发送携带 UE支持的安全能 力、 系统允许的安全能力及安全密钥的安全模式命令 （ SMC , Security Mode Command ) 消息； RNC根据 UE支持的安全能力、 系统允许的安 全能力及自身支持的安全能力， 选择安全算法， 包括加密算法和完整性 保护算法； 然后向 UE发送携带 UE支持的安全能力和选择的安全算法 的 SMC消息。
其中 SMC消息也可以包含在 RAU接受消息中。
步骤 107 109: UE根据自身的根密钥推导出鉴权矢量相关密钥， 包 括 IK和 CK, 或进一步由 IK和 CK经单向变换后得到的 IK'和 CK' , 分 别作为当前的加密密钥和完整性保护密钥； 并根据 RNC发送的 UE支持 的安全能力， 以及自身存储的安全能力， 判断是否存在降质攻击； 然后 向 RNC发送 SMC完成 （ SMC Complete ) 消息， 由 RNC向 3G - SGSN 发送携带选择的安全算法的 SMC完成消息。
其中 SMC完成消息也可以包含在 RAU完成消息中。
步骤 110〜步骤 111： 3G - SGSN向 UE发送 RAU接受（ RAU Accept ) 消息； UE接收到该消息后， 向 3G - SGSN返回 RAU完成消息。
实施例二：
本实施例中 3G - SGSN从 MME获取根密钥后， 根据该根密钥推导 得到鉴权矢量相关密钥。
图 2为本发明实施例一终端移动时安全能力协商的方法流程图。 如 图 2所示， 该方法包括以下步骤：
步骤 200: UE通过 RNC向 3G - SGSN发送 RAU请求。
本步骤 UE向 3G _ SGSN发送的 RAU请求中， 除携带本领域技术 人员公知的一些参数， 例如， TMSI之外， 还可以携带 UE支持的安全能 力， 包括加密算法和 /或完整性保护算法。 步骤 201〜步骤 203 : 3G - SGSN 通过移动性管理上下文消息， 从 MME获取根密钥， 然后根据该根密钥推导出鉴权矢量相关密钥。
具体包括： 3G - SGSN向 MME发送移动性管理上下文请求消息， MME向 3G - SGSN返回携带根密钥的移动性管理上下文响应消息； 3G - SGSN根据该响应消息中的根密钥 Kasme, 通过单向变换函数推导出 鉴权矢量相关密钥， 包括完整性保护密钥 IK和加密密钥 CK, 或进一步 由 IK和 CK经单向变换后得到的 IK，和 CK，， 分别作为当前的加密密钥 和完整性保护密钥。
如果步骤 200中， 在 UE发送至 3G _ SGSN的 RAU请求中没有携 带 UE支持的安全能力， 本步骤 103中 MME向 3G - SGSN返回的移动 性管理上下文响应消息中， 需进一步携带 UE支持的安全能力。
步骤 204〜步骤 206: 3G - SGSN向 RNC发送携带 UE支持的安全能 力、 系统允许的安全能力及安全密钥的 SMC消息； RNC根据 UE支持 的安全能力、 系统允许的安全能力及自身支持的安全能力， 选择安全算 法， 包括加密算法和完整性保护算法； 然后向 UE发送携带 UE支持的 安全能力和选择的安全算法的 SMC消息。
其中 SMC消息也可以包含在 RAU接受消息中。
步骤 207 209: UE根据自身的根密钥推导出鉴权矢量相关密钥， 包 括 IK和 CK, 或进一步由 IK和 CK经单向变换后得到的 IK'和 CK' , 分 别作为当前的加密密钥和完整性保护密钥； 并根据 RNC发送的 UE支持 的安全能力， 以及自身存储的安全能力， 判断是否存在降质攻击； 然后 向 RNC发送 SMC完成消息， 由 RNC向 3G - SGSN发送携带选择的安 全算法的 SMC完成消息。
其中 SMC完成消息也可以包含在 RAU完成消息中。
步骤 210〜步骤 211： 3G - SGSN向 UE发送 RAU接受消息； UE接 收到该消息后， 向 3G - SGSN返回 RAU完成消息。 实施例三：
本实施例中， 3G - SGSN 的 UE 通过认证与密钥协商 （AKA , Authentication and Key Agreement ) 过程获取鉴权矢量相关密钥。
图 3为本发明实施例三终端移动时安全能力协商的方法流程图。 如 图 3所示， 该方法包括以下步骤：
步骤 300: UE通过 RNC向 3G - SGSN发送 RAU Request„ 步骤 301〜步骤 302: 3G - SGSN 通过移动性管理上下文消息， 从 MME获取根据移动性管理上下方。
如果步骤 300中， 在 UE发送至 3G _ SGSN的 RAU请求中没有携 带 UE支持的安全能力， 则步骤 302中 MME向 3G - SGSN返回的移动 性管理上下文响应消息中， 需进一步携带 UE支持的安全能力。
步骤 303: 3G - SGSN和 UE通过 AKA过程， 从归属用户服务器 ( HSS, Home Subscriber Server ) 获取鉴权矢量相关密钥 ( IK和 CK ) 。
步骤 304〜步骤 306: 3G - SGSN向 RNC发送携带 UE支持的安全能 力、 系统允许的安全能力及安全密钥的 SMC消息； RNC根据 UE支持 的安全能力、 系统允许的安全能力及自身支持的安全能力， 选择安全算 法， 包括加密算法和完整性保护算法； 然后向 UE发送携带 UE支持的 安全能力和选择的安全算法的 SMC消息。
其中 SMC消息也可以包含在 RAU接受消息中。
步骤 307〜步骤 310与步骤 108〜步骤 111相同， 在此不再赘述。 以下通过实施例四至实施例六， 对 UE从 LTE网络移动到 2G网络 时， 进行安全能力协商的过程进行详细说明。 已经在空闲态时接入 LTE 网络的 UE从 LTE源网络移动到 2G目标网络时， 发起安全能力协商的 过程。 其中， 目标网络侧实体为 2G - SGSN。
实施例四：
本实施例中， 2G - SGSN直接从 MME获取根据根密钥推导出的鉴 权矢量相关密钥。
图 4为本发明实施例四终端移动时安全能力协商的方法流程图。 如 图 4所示， 该方法包括以下步骤：
步骤 400: UE向 2G - SGSN发送 RAU请求。
本步骤 UE向 2G _ SGSN发送的 RAU请求中， 除携带本领域技术 人员公知的一些参数， 例如 TMSI之外， 还可以携带 UE支持的安全能 力， 包括加密算法和 /或完整性保护算法。
本步骤中 UE通过基站系统（ BSS , Base Station System )向 2G - SGSN 发送 RAU请求。 为了描述方便， 以下描述都将 UE与 2G - SGSN之间 通过 BSS进行通信简化为 UE与 2G - SGSN之间进行通信。
步骤 401〜步骤 403 : 2G - SGSN从来自 MME的移动性管理上下文 响应消息中， 获取根据根密钥推导出的鉴权矢量相关密钥。
具体包括： 2G - SGSN向 MME发送移动性管理上下文请求消息， MME 根据自身的根密钥 Kasme, 通过单向变换函数推导出鉴权矢量相 关密钥， 包括加密密钥 Kc, 或进一步由 Kc经单向变换后得到的 Kc，； 然后向 2G - SGSN返回携带鉴权矢量相关密钥的移动性管理上下文响应 消息； 2G - SGSN将鉴权矢量相关密钥作为当前的加密密钥。
如果步骤 400中， 在 UE发送至 2G - SGSN的 RAU请求中没有携 带 UE支持的安全能力， 则步骤 403中 MME向 2G - SGSN返回的移动 性管理上下文响应消息中， 需进一步携带 UE支持的安全能力。
步骤 404〜步骤 405: 2G - SGSN根据 UE支持的安全能力、 系统允 许的安全能力及自身支持的安全能力， 选择安全算法， 包括加密算法； 然后向 UE发送携带 UE支持的安全能力和选择的安全算法的 RAU接受 消息。
步骤 406 407: UE根据自身的根密钥推导出鉴权矢量相关密钥， 包 括 Kc, 或进一步由 Kc经单向变换后得到的 Kc，， 作为当前的加密密钥； 并根据 2G - SGSN发送的 UE支持的安全能力， 以及自身存储的安全能 力， 判断是否存在降质攻击； 然后向 2G - SGSN发送 RAU完成消息。
实施例五：
本实施例中， 2G - SGSN从 MME获取根密钥， 然后根据获取的根 密钥推导出鉴权矢量相关密钥。
图 5为本发明实施例五终端移动时安全能力协商的方法流程图。 如 图 5所示， 该方法包括以下步骤：
步骤 500: UE向 2G - SGSN发送 RAU请求。
步骤 501〜步骤 502: 2G - SGSN从来自 MME的移动性管理上下文 响应消息中， 获取根密钥。
具体包括： 2G - SGSN向 MME发送移动性管理上下文请求消息， MME向 2G - SGSN返回携带根密钥的移动性管理上下文响应消息。
如果步骤 500中， 在 UE发送至 2G - SGSN的 RAU请求中没有携 带 UE支持的安全能力， 则步骤 502中 MME向 2G - SGSN返回的移动 性管理上下文响应消息中， 需进一步携带 UE支持的安全能力。
步骤 503 : 2G - SGSN根据获取的根密钥， 推导出鉴权矢量相关密 钥； 并根据 UE支持的安全能力、 系统允许的安全能力及自身支持的安 全能力， 选择安全算法， 包括加密算法。
步骤 504〜步骤 506与步骤 405〜步骤 407相同， 在此不再赘述。 实施例六：
本实施例中， 2G _ SGSN通过 2G重新认证过程获取鉴权矢量相关 密钥。
图 6为本发明实施例六终端移动时安全能力协商的方法流程图。 如 图 6所示， 该方法包括以下步骤：
步骤 600: UE向 2G - SGSN发送 RAU请求。
步骤 601〜步骤 602: 2G - SGSN向 MME发送移动性管理上下文请 求消息， MME向 2G - SGSN返回包含移动性管理上下文的响应消息。 如果步骤 600中， 在 UE发送至 2G - SGSN的 RAU请求中没有携 带 UE支持的安全能力， 则步骤 602中 MME向 2G - SGSN返回的移动 性管理上下文响应消息中， 需进一步携带 UE支持的安全能力。
步骤 603: 2G - SGSN和 UE通过 2G重新认证过程， 从 HSS获取 鉴权矢量相关密钥 （Kc ) 。
步骤 604〜步骤 606: 2G - SGSN根据 UE支持的安全能力、 系统允 许的安全能力及自身支持的安全能力， 选择安全算法， 包括加密算法； 然后向 UE发送携带 UE支持的安全能力和选择的安全算法的 RAU接受 消息； UE向 2G - SGSN返回 RAU完成消息。
本发明实施例还提供一种终端移动时安全能力协商的系统， 如图 7 所 示， 包括 UE100和目标网络侧实体 200。
UE100用于从 LTE源网络移动到 2G/3G目标网络时， 向目标网络侧实 体 200发送路由区域更新请求； 接收目标网络侧实体 200发送的所选择的 安全算法； 并根据自身的根密钥推导出鉴权矢量相关密钥。
目标网络侧实体 200, 用于接收 UE100发送的路由区域更新请求， 获 取 UE支持的安全能力， 以及根据根密钥推导的鉴权矢量相关密钥； 并根据 UE100支持的安全能力选择安全算法， 向 UE100发送所选择的安全算法。
以下实施例七和实施例八分别以终端移动时安全能力协商的 2G系统和 3G系统为例， 对本发明实施例终端移动时安全能力协商的系统进行说明。
实施例七：
终端移动时安全能力协商的 2G系统中， 目标网络侧实体为 2G网络中 的 SGSN ( 2G - SGSN ) 210。 图 8为本发明实施例中终端移动时安全能力 协商的 2G系统结构及对外连接关系图。 如图 8所示， 其中， SGSN210包 括密钥获取模块 211和选择发送模块 212。
所述密钥获取模块 211 , 用于接收到 UE发送的路由区域更新请求后， 从来自移动管理实体 MME的移动性管理上下文响应消息中获取根密钥，并 根据所述根密钥， 推导出鉴权矢量相关密钥。
所述选择发送模块 212 , 用于获取 UE100支持的安全能力， 根据获取 的 UE100 支持的安全能力， 选择安全算法， 并将选择的安全算法发送至 UE100 o
如图 8所示， 在本发明实施例终端移动时安全能力协商的 2G系统中， 还包括移动管理实体 MME310 , 应用于用户设备 UE从长期演进 LTE源网 络移动到 2G/3G目标网络中， 所述 MME310包括存储模块 311和第一发送 模块 312。
所述存储模块 311 , 用于保存根密钥。
所述第一发送模块 312 , 用于在接收到通用分组无线业务支持节点 SGSN发送的移动性管理上下文请求消息后，将所述存储模块 311保存的根 密钥， 通过移动性管理上下文响应消息发送至 SGSN。
本发明实施例并不局限于此， 若所述密钥获取模块 211 用于从来自 MME的移动性管理上下文响应消息中， 获取 MME根据自身的根密钥推导 出的鉴权矢量相关密钥，则相应地移动管理实体 MME包括密钥推导模块和 第二发送模块， 所述密钥推导模块， 用于在接收到 SGSN发送的移动性管 理上下文请求消息后， 根据根密钥推导出鉴权矢量相关密钥； 所述第二发 送模块， 用于将密钥推导模块得到的鉴权矢量相关密钥通过移动性管理上 下文响应消息， 发送至 SGSN。
实施例八：
终端移动时安全能力协商的 3G系统中， 目标网络侧实体 200 包括 3G网络中的 SGSN ( 3G - SGSN ) 220和 RNC230。 图 9为本发明实施例 中终端移动时安全能力协商的 3G系统结构及对外连接关系图。
如图 9所示， 该系统中 SGSN220包括密钥获取模块 221和消息发送 模块 222 , 所述密钥获取模块 221 , 用于从来自 MME的移动性管理上下文 响应消息中，获取 MME根据自身的根密钥推导出的鉴权矢量相关密钥； 所 述消息发送模块，用于将携带 UE支持的安全能力、 系统允许的安全能力及 安全密钥的安全模式命令消息， 发送给 RNC230进行处理。
相应地，本实施例中所述 MME320包括密钥推导模块 321和第二发 送模块 322。
所述密钥推导模块 321 ,用于在接收到服务通用分组无线业务支持节点 SGSN发送的移动性管理上下文请求消息后 ,根据根密钥推导出鉴权矢量相 关密钥；
所述第二发送模块 322,用于将密钥推导模块 321得到的鉴权矢量相关 密钥通过移动性管理上下文响应消息， 发送至 SGSN。
但本发明实施例并不局限于此， 若 SGSN从 MME直接获取根密钥， 并根据所述根密钥，推导出鉴权矢量相关密钥时， 则相应的 MME与实施例 七中所述一致， 具体包括存储模块 311和第一发送模块 312, 其中， 存储模 块 311 , 用于保存根密钥； 第一发送模块 312, 用于在接收到 SGSN发送的 移动性管理上下文请求消息后， 将存储模块 311 保存的根密钥， 通过移动 性管理上下文响应消息发送至 SGSN。
本发明实施例还提供了一种服务通用分组无线业务支持节点 SGSN, 应用于用户设备 UE从长期演进 LTE源网络移动到 2G/3G目标网络中。 下 面以实施例九和实施例十为例来说明 SGSN。
实施例九
在用户设备 UE从长期演进 LTE源网络移动到 3G目标网络中时，本发 明实施例还提供了一种服务通用分组无线业务支持节点 SGSN, 包括密钥 获取模块，用于从来自移动管理实体 MME的移动性管理上下文响应消息中 获取根密钥， 并根据所述根密钥推导出鉴权矢量相关密钥。
在本发明的其它实施例中，所述密钥获取模块用于从来自移动管理实体 MME的移动性管理上下文响应消息中， 获取 MME根据自身的根密钥推导 出的鉴权矢量相关密钥。
实施例十
本实施例 SGSN用于在用户设备 UE从长期演进 LTE源网络移动到 2G 目标网络中时。 如图 10所示， 该 SGSN包括密钥获取模块 211和选择发送 模块 212。
所述密钥获取模块 211用于从来自移动管理实体 MME的移动性管理上 下文响应消息中获取根密钥， 并根据所述根密钥推导出鉴权矢量相关密钥。
所述选择发送模块 212用于获取 UE100支持的安全能力， 根据获取的 UE100支持的安全能力，选择安全算法，并将选择的安全算法发送至 UE100。
本发明并不局限于此，所述密钥获取模块在其它实施例中用于从来自移 动管理实体 MME的移动性管理上下文响应消息中，获取 MME根据自身的 根密钥推导出的鉴权矢量相关密钥。
本发明实施例还提供了一种移动管理实体 MME, 应用于用户设备 UE 从长期演进 LTE源网络移动到 2G/3G目标网络中。
实施例十一
当 SGSN从 MME获取根据根密钥推导出的鉴权矢量相关密钥时，对应 的本实施例 MME如图 11所示，具体包括密钥推导模块 331和发送模块 332 , 其中， 密钥推导模块 331 , 用于在接收到 SGSN发送的移动性管理上下文请 求消息后， 根据根密钥推导出鉴权矢量相关密钥； 发送模块 332, 用于将密 钥推导模块 331得到的鉴权矢量相关密钥通过移动性管理上下文响应消息， 发送至服务 SGSN。
由以上所述可以看出， 本发明实施例所提供的技术方案， 当 UE从 LTE源网络移动到 2G/3G目标网络时， 目标网络侧实体在接收到 UE发 送的 RAU请求后， 获取 UE支持的安全能力， 以及根据根密钥推导出的 鉴权矢量相关密钥， UE也根据自身的根密钥推导出鉴权矢量相关密钥， 从而实现了密钥的协商； 目标网络侧还将自身根据 UE支持的安全能力 选择的安全算法， 发送到 UE, 从而实现了安全算法的协商。 使得当 UE 从 LTE源网络移动到 2G/3G目标网络时， 可以实现安全能力的协商，从 而保证后续 UE与网络交互时的安全。
上述本发明实施例序号仅仅为了描述， 不代表实施例的优劣。 上述 本发明实施例描述的 "步骤" 一词也不代表实施例执行方法的顺序。
以上所述仅为本发明的较佳实施例而已， 并非用于限定本发明的保护 范围。 凡在本发明的精神和原则之内， 所作的任何修改、 等同替换、 改进 等， 均应包含在本发明的保护范围之内。

Claims

权 利 要求 书
1、 一种终端移动时安全能力协商的方法， 其特征在于， 当用户设备 UE从 长期演进 LTE源网络移动到 2G/3G目标网络时， 该方法包括：
目标网络侧实体接收 UE发送的路由区域更新请求， 获取所述 UE支持的安 全能力， 以及获取根据根密钥推导出的鉴权矢量相关密钥；
根据所述 UE支持的安全能力选择安全算法， 向所述 UE发送所选择的安全 算法；
所述 UE根据自身的根密钥推导出鉴权矢量相关密钥。
2、 如权利要求 1所述的方法， 其特征在于， 所述获取根据根密钥推导的鉴 权矢量相关密钥为：
由作为目标网络侧实体的服务通用分组无线业务支持节点 SGSN从来自移 动管理实体 MME的移动性管理上下文响应消息中，获取根密钥，并根据所述获 取的根密钥推导出鉴权矢量相关密钥；
或者，由作为目标网络侧实体的 SGSN从来自 MME的移动性管理上下文响 应消息中， 获取 MME根据自身的根密钥推导出的鉴权矢量相关密钥。
3、 如权利要求 1所述的方法， 其特征在于， 所述目标网络为 2G网络时， 所述鉴权矢量相关密钥至少包括加密密钥 Kc或 Kc经单向变换后得到的值； 所述目标网络为 3G网络时，所述鉴权矢量相关密钥至少包括完整性密钥 IK 和加密密钥 CK, 或者至少包括 IK和 CK经单向变换后得到的值。
4、 如权利要求 1所述的方法， 其特征在于， 所述获取 UE支持的安全能力 为：
由作为目标网络侧实体的 SGSN从 UE发送的路由区域更新请求中获取 UE 支持的安全能力；
或者，由作为目标网络侧实体的 SGSN从来自 MME的移动性管理上下文响 应消息中， 获取 UE支持的安全能力。
5、 一种终端移动时安全能力协商的系统， 其特征在于， 该系统包括用户设 备 UE和目标网络侧实体，
所述 UE, 用于从长期演进 LTE源网络移动到 2G/3G 目标网络时， 向目标 网络侧实体发送路由区域更新请求； 接收目标网络侧实体发送的所选择的安全 算法； 根据自身的根密钥推导出鉴权矢量相关密钥；
所述目标网络侧实体， 用于接收 UE发送的路由区域更新请求， 获取所述 UE支持的安全能力， 以及获取根据根密钥推导的鉴权矢量相关密钥； 根据所述 UE支持的安全能力选择安全算法， 向所述 UE发送所选择的安全算法。
6、 如权利要求 5所述的系统， 其特征在于， 所述目标网络侧实体为 2G网 络中的服务通用分组无线业务支持节点 SGSN,所述 SGSN包括密钥获取模块和 选择发送模块，
所述密钥获取模块， 用于接收到 UE发送的路由区域更新请求后， 从来自移 动管理实体 MME的移动性管理上下文响应消息中获取根密钥，并根据所述根密 钥推导出鉴权矢量相关密钥； 或
用于从来自移动管理实体 MME 的移动性管理上下文响应消息中， 获取 MME根据自身的根密钥推导出的鉴权矢量相关密钥；
所述选择发送模块， 用于获取 UE支持的安全能力， 根据获取的 UE支持的 安全能力， 选择安全算法， 并将选择的安全算法发送至 UE。
7、 如权利要求 5所述的系统， 其特征在于， 所述目标网络侧实体包括 3G 网络中的 SGSN, 其中， 所述 SGSN包括密钥获取模块，
所述密钥获取模块， 用于接收到 UE发送的路由区域更新请求后， 从来自移 动管理实体 MME的移动性管理上下文响应消息中获取根密钥，并根据所述根密 钥， 推导出鉴权矢量相关密钥； 或
用于从来自 MME的移动性管理上下文响应消息中，获取 MME根据自身的 根密钥推导出的鉴权矢量相关密钥。
8、如权利要求 6或 7所述的系统，其特征在于，还包括移动管理实体 MME, 应用于用户设备 UE从长期演进 LTE源网络移动到 2G/3G目标网络中， 若所述密钥获取模块用于从来自 MME 的移动性管理上下文响应消息中获 取根密钥， 则所述 MME包括存储模块和第一发送模块， 所述存储模块， 用于保 存根密钥； 所述第一发送模块， 用于在接收到 SGSN发送的移动性管理上下文 请求消息后， 将所述存储模块保存的根密钥， 通过移动性管理上下文响应消息 发送至 SGSN;
若所述密钥获取模块用于从来自 MME的移动性管理上下文响应消息中，获 取 MME根据自身的根密钥推导出的鉴权矢量相关密钥，则所述 MME包括密钥 推导模块和第二发送模块， 所述密钥推导模块， 用于在接收到 SGSN发送的移 动性管理上下文请求消息后， 根据根密钥推导出鉴权矢量相关密钥； 所述第二 发送模块， 用于将所述密钥推导模块得到的鉴权矢量相关密钥通过移动性管理 上下文响应消息， 发送至 SGSN。
9、 一种服务通用分组无线业务支持节点 SGSN, 其特征在于，
应用于用户设备 UE从长期演进 LTE源网络移动到 2G目标网络中， 包括密 钥获取模块和选择发送模块； 所述密钥获取模块，用于接收到 UE发送的路由区 域更新请求后，从来自移动管理实体 MME的移动性管理上下文响应消息中获取 根密钥， 并根据所述根密钥推导出鉴权矢量相关密钥； 或用于从来自移动管理 实体 MME的移动性管理上下文响应消息中，获取 MME根据自身的根密钥推导 出的鉴权矢量相关密钥； 所述选择发送模块， 用于获取 UE支持的安全能力， 根 据获取的 UE支持的安全能力，选择安全算法，并将选择的安全算法发送至 UE; 或应用于用户设备 UE从长期演进 LTE源网络移动到 3G目标网络中， 包括 密钥获取模块，所述密钥获取模块，用于接收到 UE发送的路由区域更新请求后， 从来自移动管理实体 MME的移动性管理上下文响应消息中获取根密钥，并根据 所述根密钥，推导出鉴权矢量相关密钥； 或用于从来自 MME的移动性管理上下 文响应消息中， 获取 MME根据自身的根密钥推导出的鉴权矢量相关密钥。
10、 一种移动管理实体 MME, 其特征在于， 应用于用户设备 UE从长期演 进 LTE源网络移动到 2G/3G目标网络中， 该 MME包括密钥推导模块和发送模 块，
所述密钥推导模块， 用于在接收到服务通用分组无线业务支持节点 SGSN 发送的移动性管理上下文请求消息后， 根据根密钥推导出鉴权矢量相关密钥； 所述发送模块,用于将密钥推导模块得到的鉴权矢量相关密钥通过移动性管 理上下文响应消息， 发送至 SGSN。
PCT/CN2008/072486 2007-09-29 2008-09-24 Procédé, système et dispositif pour négocier la capacité de sécurité pendant qu'un terminal se déplace WO2009043278A1 (fr)

Priority Applications (4)

Application Number Priority Date Filing Date Title
EP08800967A EP2187561B1 (en) 2007-09-29 2008-09-24 Method, system and devices for negotiating security capabilities while a terminal is moving
US12/717,385 US9060268B2 (en) 2007-09-29 2010-03-04 Negotiating security capabilities during movement of UE
US14/728,687 US9572027B2 (en) 2007-09-29 2015-06-02 Method, system and apparatus for negotiating security capabilities during movement of UE
US15/408,684 US10548012B2 (en) 2007-09-29 2017-01-18 Method, system and apparatus for negotiating security capabilities during movement of UE

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN200710181068.4 2007-09-29
CN2007101810684A CN101399767B (zh) 2007-09-29 2007-09-29 终端移动时安全能力协商的方法、系统及装置

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US12/717,385 Continuation US9060268B2 (en) 2007-09-29 2010-03-04 Negotiating security capabilities during movement of UE

Publications (1)

Publication Number Publication Date
WO2009043278A1 true WO2009043278A1 (fr) 2009-04-09

Family

ID=40518035

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2008/072486 WO2009043278A1 (fr) 2007-09-29 2008-09-24 Procédé, système et dispositif pour négocier la capacité de sécurité pendant qu'un terminal se déplace

Country Status (4)

Country Link
US (3) US9060268B2 (zh)
EP (1) EP2187561B1 (zh)
CN (1) CN101399767B (zh)
WO (1) WO2009043278A1 (zh)

Families Citing this family (22)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101399767B (zh) 2007-09-29 2011-04-20 华为技术有限公司 终端移动时安全能力协商的方法、系统及装置
CN101873245B (zh) * 2009-04-27 2013-04-24 华为终端有限公司 家庭网络间建立连接的方法、设备及网络
CN101998395B (zh) * 2009-08-27 2013-12-04 华为技术有限公司 鉴权矢量获取方法、归属服务器和网络系统
CN101742498A (zh) * 2009-12-18 2010-06-16 中兴通讯股份有限公司 空口密钥的管理方法和系统
CN102118810B (zh) * 2010-02-10 2013-11-06 电信科学技术研究院 一种切换时避免路径转换方法、系统和设备
CN101835151B (zh) * 2010-04-16 2016-03-30 中兴通讯股份有限公司 空中接口密钥的更新方法及无线接入系统
CN101835154B (zh) * 2010-04-20 2016-03-30 中兴通讯股份有限公司 一种建立增强的空口密钥的方法及系统
CN102378168B (zh) * 2010-08-17 2016-02-10 中兴通讯股份有限公司 多系统核心网通知密钥的方法和多系统网络
US8620317B2 (en) * 2011-02-16 2013-12-31 Htc Corporation Method and apparatus for communicating network features during a routing area update procedure
US8897751B2 (en) * 2011-03-14 2014-11-25 Alcatel Lucent Prevention of eavesdropping type of attack in hybrid communication system
KR101873330B1 (ko) 2011-10-04 2018-07-03 삼성전자 주식회사 암호화 제어 방법 및 이를 지원하는 네트워크 시스템과 단말기 및 단말기 운용 방법
CN103702328B (zh) * 2012-09-28 2017-11-21 中国电信股份有限公司 Uim卡接入epc网络的认证方法和系统
EP2944067B1 (en) 2013-01-10 2023-03-01 NEC Corporation Mtc key management for key derivation at both ue and network
CN104244247B (zh) * 2013-06-07 2019-02-05 华为技术有限公司 非接入层、接入层安全算法处理方法及设备
US10123228B2 (en) * 2013-08-15 2018-11-06 Nokia Technologies Oy Signaling support for devices with multiple and/or flexible form factors
EP3146741B1 (en) * 2014-05-20 2021-10-06 Nokia Technologies Oy Cellular network authentication control
RU2017132104A (ru) * 2015-02-16 2019-03-18 Нек Корпорейшн Система связи, устройство узла, терминал связи, способ управления ключами и энергонезависимый читаемый компьютером носитель, на котором хранится программа
RU2683853C1 (ru) * 2015-04-08 2019-04-02 Хуавей Текнолоджиз Ко., Лтд. Способ улучшения ключа системы gprs, устройство sgsn, пользовательское устройство, hlr/hss и система gprs
CN109314857B (zh) * 2016-07-04 2020-09-29 华为技术有限公司 管理终端设备的imsi状态的方法、装置及系统
ES2926307T3 (es) 2018-02-19 2022-10-25 Ericsson Telefon Ab L M Soporte al interfuncionamiento y/o la movilidad entre diferentes sistemas de comunicación inalámbrica
CN110392369B (zh) * 2018-04-16 2021-10-12 大唐移动通信设备有限公司 一种短信息服务能力更新方法、设备及装置
WO2020090886A1 (en) * 2018-11-02 2020-05-07 Nec Corporation Method, ue, and network for providing kdf negotiation

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1589060A (zh) * 2004-09-30 2005-03-02 西安西电捷通无线网络通信有限公司 一种使移动节点实现自代理功能的方法
CN1795656A (zh) * 2003-05-23 2006-06-28 艾利森电话股份有限公司 移动通信系统中的安全通信改向
CN1953374A (zh) * 2006-09-21 2007-04-25 中国船舶重工集团公司第七○九研究所 移动自组织网络中用于分布式身份认证的安全引导模型

Family Cites Families (71)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6028933A (en) 1997-04-17 2000-02-22 Lucent Technologies Inc. Encrypting method and apparatus enabling multiple access for multiple services and multiple transmission modes over a broadband communication network
GB0011913D0 (en) 2000-05-17 2000-07-05 Nokia Networks Oy Connections in a communication system
US7181012B2 (en) 2000-09-11 2007-02-20 Telefonaktiebolaget Lm Ericsson (Publ) Secured map messages for telecommunications networks
SE518479C2 (sv) * 2000-10-13 2002-10-15 Ericsson Telefon Ab L M Kommunikationssystem som stödjer trådlös kommunikation av paketdata och förfarande och anordning relaterande därtill
FI111423B (fi) * 2000-11-28 2003-07-15 Nokia Corp Järjestelmä kanavanvaihdon jälkeen tapahtuvan tietoliikenteen salauksen varmistamiseksi
US6857075B2 (en) 2000-12-11 2005-02-15 Lucent Technologies Inc. Key conversion system and method
US20030028644A1 (en) * 2001-08-02 2003-02-06 Patrick Maguire System and method for load sharing within a core network
WO2003037021A1 (en) 2001-10-19 2003-05-01 Nokia Corporation Forwarding a terminal identity between core network nodes
CN1172469C (zh) * 2001-12-13 2004-10-20 华为技术有限公司 一种自主选择加密算法实现保密通信的方法
US20030139180A1 (en) 2002-01-24 2003-07-24 Mcintosh Chris P. Private cellular network with a public network interface and a wireless local area network extension
US20030235305A1 (en) 2002-06-20 2003-12-25 Hsu Raymond T. Key generation in a communication system
CN1186906C (zh) 2003-05-14 2005-01-26 东南大学 无线局域网安全接入控制方法
EP1665838B1 (en) * 2003-08-13 2010-03-10 Roamware, Inc. Signaling gateway with multiple imsi with multiple msisdn (mimm) service in a single sim for multiple roaming partners
BRPI0415641A (pt) * 2003-10-24 2006-12-12 Qualcomm Inc handoff entre uma rede local sem fio e um sistema de comunicação celular
WO2005043282A2 (en) * 2003-10-31 2005-05-12 Electronics And Telecommunications Research Institute Method for authenticating subscriber station, method for configuring protocol thereof, and apparatus thereof in wireless portable internet system
DE602005007526D1 (de) * 2004-02-27 2008-07-31 Ibm System zum Erreichen einer anonymen Kommunikation einer Nachricht unter Verwendung einer Geheimschlüsselkryptographie
BRPI0508765A (pt) * 2004-03-31 2007-08-28 Sk Telecom Co Ltd método para handover entre rede de comunicação assìncrona e rede de comunicação assìncrona de terminal de comunicação móvel multimodo multibanda e de terminal de comunicação móvel para o mesmo
KR101119372B1 (ko) * 2004-05-10 2012-06-12 엘지전자 주식회사 Ｉｐ 연결 설정 방법
JP4429132B2 (ja) * 2004-09-30 2010-03-10 富士通株式会社 移動無線通信システム
US7848754B2 (en) * 2005-01-05 2010-12-07 Sk Telecom Co., Ltd. Dual band/dual mode mobile communication terminal and control method thereof
CN100574185C (zh) 2005-01-07 2009-12-23 华为技术有限公司 在ip多媒体业务子系统网络中保障媒体流安全性的方法
WO2006085207A1 (en) 2005-02-11 2006-08-17 Nokia Corporation Method and apparatus for providing bootstrapping procedures in a communication network
EP2456276B1 (en) 2005-04-26 2014-06-25 Vodafone Group PLC Telecommunications Networks
CN100373991C (zh) 2005-06-30 2008-03-05 中国科学院计算技术研究所 一种分组网络中语音通信的加密协商方法
CN101243719B (zh) 2005-07-06 2012-10-17 诺基亚公司 安全的会话密钥上下文
EP1764970A1 (en) 2005-09-19 2007-03-21 Matsushita Electric Industrial Co., Ltd. Multiple interface mobile node with simultaneous home- and foreign network connection
CN1937487A (zh) 2005-09-22 2007-03-28 北京三星通信技术研究有限公司 Lte中鉴权和加密的方法
US8122240B2 (en) 2005-10-13 2012-02-21 Telefonaktiebolaget Lm Ericsson (Publ) Method and apparatus for establishing a security association
EP1784035A1 (en) 2005-11-07 2007-05-09 Alcatel Lucent A method for connection re-establishment in a mobile communication system
CN1983921B (zh) 2005-12-16 2010-05-05 华为技术有限公司 一种端到端媒体流安全的实现方法及系统
US7929703B2 (en) 2005-12-28 2011-04-19 Alcatel-Lucent Usa Inc. Methods and system for managing security keys within a wireless network
KR101213285B1 (ko) 2006-01-04 2012-12-17 삼성전자주식회사 이동통신 시스템에서 아이들모드 단말기의 세션 설정 프로토콜 데이터를 전송하는 방법 및 장치
KR101344743B1 (ko) * 2006-01-12 2013-12-26 퀄컴 인코포레이티드 단말의 효율적인 셋 관리에 따른 핸드오프 방법 및 장치
CN101005692A (zh) 2006-01-20 2007-07-25 北京三星通信技术研究有限公司 减少终端在lte和3g接入技术间切换的信令的方法
DE102006006485A1 (de) * 2006-02-10 2007-08-23 T-Mobile International Ag & Co. Kg Verfahren zur Durchführung eines Pagings in einem zellularen Mobilkommunikationssystem
PL1989906T3 (pl) 2006-02-28 2017-08-31 Nokia Technologies Oy Przekazywanie w sieciach komunikacyjnych
US8832449B2 (en) 2006-03-22 2014-09-09 Lg Electronics Inc. Security considerations for the LTE of UMTS
US20070224993A1 (en) 2006-03-27 2007-09-27 Nokia Corporation Apparatus, method and computer program product providing unified reactive and proactive handovers
EP1841267B1 (en) 2006-03-31 2019-06-12 Samsung Electronics Co., Ltd. System and method for optimizing authentication procedure during inter access system handovers
KR20070099849A (ko) 2006-04-05 2007-10-10 삼성전자주식회사 이동통신 시스템의 공통 라우팅 영역에 위치한 아이들사용자 단말기에게 회선교환 호를 전달하기 위한 방법 및장치
WO2007125406A2 (en) * 2006-05-01 2007-11-08 Nokia Corporation Apparatus, method and computer program product providing uplink synchronization through use of dedicated uplink resource assignment
GB0608612D0 (en) 2006-05-02 2006-06-14 Vodafone Plc Telecommunications networks
US20070280177A1 (en) * 2006-05-31 2007-12-06 Nokia Corporation Managing user profile information in a mobile telecommunications network
US8107433B2 (en) 2006-06-16 2012-01-31 Nokia Corporation Changing LTE specific anchor with simple tunnel switching
CN101473679B (zh) 2006-06-16 2012-11-14 诺基亚公司 在系统间切换的情况下用于为终端传送pdp上下文信息的设备和方法
CA2655721C (en) 2006-06-19 2013-10-22 Interdigital Technology Corporation Method and apparatus for security protection of an original user identity in an initial signaling message
US7760676B2 (en) * 2006-06-20 2010-07-20 Intel Corporation Adaptive DRX cycle length based on available battery power
US20080010677A1 (en) * 2006-06-26 2008-01-10 Nokia Corporation Apparatus, method and computer program product providing improved sequence number handling in networks
US20080039086A1 (en) * 2006-07-14 2008-02-14 Gallagher Michael D Generic Access to the Iu Interface
US7852817B2 (en) * 2006-07-14 2010-12-14 Kineto Wireless, Inc. Generic access to the Iu interface
US7912004B2 (en) * 2006-07-14 2011-03-22 Kineto Wireless, Inc. Generic access to the Iu interface
ES2526199T3 (es) 2006-08-18 2015-01-08 Telefonaktiebolaget Lm Ericsson (Publ) Correlación que implica cambio inter sistema entre diferentes tipos de portadores radio
WO2008038949A1 (en) 2006-09-28 2008-04-03 Samsung Electronics Co., Ltd. A system and method of providing user equipment initiated and assisted backward handover in heterogeneous wireless networks
EP1914930A1 (en) 2006-10-17 2008-04-23 Matsushita Electric Industrial Co., Ltd. User plane entity selection in a mobile communication system having overlapping pool areas
US8094817B2 (en) * 2006-10-18 2012-01-10 Telefonaktiebolaget Lm Ericsson (Publ) Cryptographic key management in communication networks
WO2008046915A1 (en) * 2006-10-20 2008-04-24 Nokia Corporation Generating keys for protection in next generation mobile networks
US20080101400A1 (en) * 2006-10-30 2008-05-01 Nokia Corporation Managing attachment of a wireless terminal to local area networks
EP2530981B1 (en) * 2006-10-30 2018-04-11 InterDigital Technology Corporation Grouping of tracking area
WO2008080637A1 (en) * 2007-01-04 2008-07-10 Telefonaktiebolaget Lm Ericsson (Publ) Method and apparatus for determining an authentication procedure
ES2375001T3 (es) * 2007-01-15 2012-02-23 Telefonaktiebolaget Lm Ericsson (Publ) Método y disposiciones para localizar un equipo de usuario para servicios de circuitos conmutados mediante una red de comunicación lte de paquetes conmutados.
FI20070095A0 (fi) 2007-02-02 2007-02-02 Nokia Corp Turva-avainten luominen langatonta viestintää varten
FI20070157A0 (fi) 2007-02-23 2007-02-23 Nokia Corp Nopea päivityssanomien autentikointi avainderivaatiolla mobiileissa IP-järjestelmissä
CN101304600B (zh) 2007-05-08 2011-12-07 华为技术有限公司 安全能力协商的方法及系统
US8533455B2 (en) 2007-05-30 2013-09-10 Telefonaktiebolaget L M Ericsson (Publ) Method and apparatus for combining internet protocol authentication and mobility signaling
US8699711B2 (en) * 2007-07-18 2014-04-15 Interdigital Technology Corporation Method and apparatus to implement security in a long term evolution wireless device
US8780856B2 (en) 2007-09-18 2014-07-15 Telefonaktiebolaget Lm Ericsson (Publ) Inter-system handoffs in multi-access environments
CN101399767B (zh) 2007-09-29 2011-04-20 华为技术有限公司 终端移动时安全能力协商的方法、系统及装置
EP2214444A1 (en) 2009-01-30 2010-08-04 Nec Corporation Method for optimizing the reduction of mobility signalling at inter-rat change
ES2401757T3 (es) * 2009-04-08 2013-04-24 Telefonaktiebolaget Lm Ericsson (Publ) Gestión de movilidad en un sistema de comunicaciones
US20110235505A1 (en) * 2010-03-29 2011-09-29 Hitachi, Ltd. Efficient deployment of mobility management entity (MME) with stateful geo-redundancy
EP2509345A1 (en) * 2011-04-05 2012-10-10 Panasonic Corporation Improved small data transmissions for machine-type-communication (MTC) devices

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1795656A (zh) * 2003-05-23 2006-06-28 艾利森电话股份有限公司 移动通信系统中的安全通信改向
CN1589060A (zh) * 2004-09-30 2005-03-02 西安西电捷通无线网络通信有限公司 一种使移动节点实现自代理功能的方法
CN1953374A (zh) * 2006-09-21 2007-04-25 中国船舶重工集团公司第七○九研究所 移动自组织网络中用于分布式身份认证的安全引导模型

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP2187561A4 *

Also Published As

Publication number Publication date
US20150264563A1 (en) 2015-09-17
CN101399767B (zh) 2011-04-20
CN101399767A (zh) 2009-04-01
EP2187561B1 (en) 2013-02-20
EP2187561A4 (en) 2011-04-27
US20170127284A1 (en) 2017-05-04
US9060268B2 (en) 2015-06-16
US10548012B2 (en) 2020-01-28
US20100159882A1 (en) 2010-06-24
US9572027B2 (en) 2017-02-14
EP2187561A1 (en) 2010-05-19

Similar Documents

Publication Publication Date Title
WO2009043278A1 (fr) Procédé, système et dispositif pour négocier la capacité de sécurité pendant qu'un terminal se déplace
EP3576446B1 (en) Key derivation method
JP4976548B2 (ja) 端末が移動するときにセキュリティ機能を折衝するための方法、システム、および装置
CA2642822C (en) System and method for optimizing authentication procedure during inter access system handovers
WO2019017837A1 (zh) 网络安全管理的方法及装置
WO2018170617A1 (zh) 一种基于非3gpp网络的入网认证方法、相关设备及系统
WO2008138273A1 (en) Method for performing security negotiation during handoff between different wireless access technology and device thereof
WO2016134536A1 (zh) 密钥生成方法、设备及系统
WO2013181847A1 (zh) 一种无线局域网接入鉴权方法、设备及系统
WO2019029531A1 (zh) 触发网络鉴权的方法及相关设备
WO2009152759A1 (zh) 防止网络安全失步的方法和装置
WO2014059947A1 (zh) 一种双向认证的方法、设备及系统
WO2013174267A1 (zh) 无线局域网络的安全建立方法及系统、设备
WO2011137823A1 (zh) 密钥隔离方法和装置
WO2009152656A1 (zh) 用户设备转移时密钥身份标识符的生成方法和生成系统
WO2010069202A1 (zh) 认证协商方法及系统、安全网关、家庭无线接入点
WO2009149666A1 (zh) 算法协商的方法、装置及系统
WO2009051405A2 (en) Method of establishing security association in inter-rat handover
CN116325840A (zh) 一种密钥推衍方法及其装置、系统
WO2007033548A1 (fr) Procede et dispositif pour obtenir les informations d'association de securite pendant la procedure de transfert du terminal mobile

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 08800967

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 2008800967

Country of ref document: EP

NENP Non-entry into the national phase

Ref country code: DE