WO2010012201A1

WO2010012201A1 - An authorization method, a communication apparatus and a communication system

Info

Publication number: WO2010012201A1
Application number: PCT/CN2009/072845
Authority: WO
Inventors: 刘菁; 陈璟; 彭炎; 张爱琴
Original assignee: 深圳华为通信技术有限公司
Priority date: 2008-07-29
Filing date: 2009-07-21
Publication date: 2010-02-04
Also published as: CN101640887A; CN101640887B

Abstract

An authorization method, a communication apparatus and a communication system are provided, in which the realization of the authorization method includes: the first device receives an authentication request transmitted by a relay station, wherein the authentication request includes an ID identifier of the relay station; obtaining an authentication vector and transmitting it to the relay station, indicating the relay station to authenticate the authentication vector, wherein the authentication vector is generated by the second device independent of the core network and corresponds to the ID identifier of the relay station; receiving a response value which is transmitted by the relay station after the authentication for the authentication vector passes, authenticating the response value, and deriving an air key when the authentication passes.

Description

Authentication method, communication device and communication system

This application claims priority to Chinese Patent Application No. 200810041298.5, entitled "Authentication Method, Communication Device, and Communication System", filed on July 29, 2008, the entire contents of which is incorporated herein by reference. In the application.

Technical field

The present invention relates to the field of communications technologies, and in particular, to an authentication method, a communication device, and a communication system. Background technique

With the increasing coverage of mobile systems, the number of user access systems is gradually increasing, and the services provided by service providers are diversified, which makes the complexity of the network continuously improved. How to ensure the security of network and service information is a current Urgent need to solve the problem.

In the mobile communication system, in order to ensure the security of the service, the network side needs to perform authentication processing on the user equipment (User Equipment, UE), so that the illegal UE cannot obtain the service provided by the network side, thereby ensuring the interests of the operator. . At the same time, the UE also needs to verify whether the authentication information sent by the network side is valid, that is, the UE performs authentication processing on the network side, and prevents the illegal network side from using the authentication information that has been used by the legal network side to perform replay attacks on the UE, so that the UE I believe that the illegal network side is legal.

In the existing Long Term Evolved (LTE) network system, the air interface link between the UE and the evolved base station (E-UTRAN Node B, eNB) is single-hop, and the Evolved Packet System (Evolved Packet System) is adopted. EPS) Authentication and Key Agreement (AKA) protocol to complete the authentication process of the user and the network side, that is, the process of identity authentication and key agreement, which is based on the pre-shared one by the user and the network side. Permanent symmetric key. The entire authentication process is included in an authentication process, and authentication is performed by means of an authentication tuple including: a random number (RAND), an expected response (XRES), a key ( K and an authentication token (AUTN), wherein the key is derived from an encryption key (Cipher Key, CK) and an integrity key (Integrity Key, IK); the AUTN further includes an authentication sequence number (Sequence Number, SQN), Authentication Management Field (AMF) and Message Authentication Code (MAC).

After the introduction of the relay station (RS), the air interface link between the UE and the eNB in the LTE system is segmented, including the access link between the UE and the RS, and the relay chain between the RS and the eNB. Road. In the network access process of the RS, the RS can be regarded as the UE for network access, that is, the RS adopts the same authentication process as the legacy UE. For the specific access process, refer to Figure 1. The authentication process in the RS access process is :

Step 101: The RS sends an authentication request to the Mobility Management Entity (MME), where the message carries the International Mobile Subscriber Identity (IMSI) of the RS, and the capability of the RS (that is, the supported encryption and encryption). The integrity protection algorithm), and the key identifier (KSI, etc.) corresponding to the derived key (K);

Step 102: The MME forwards an RS authentication request to the Home Subscriber Server (HSS), where the message carries the identity identifier of the RS, the service network identifier, and the like, and the HSS finds the shared secret corresponding to the user according to the IMSI of the RS. Key K, and randomly generate a RAND, and then generate an authentication vector (AV) corresponding to the RS according to the RAND, the currently stored authentication SQN, RS and HSS shared key K and other information, wherein the AV includes RAND, XRES, flat and AUTN;

Step 103: The HSS returns an authentication response to the MME, where the message carries the authentication vector AV of the user, and the key identifier 3⁄4/ _AW£ corresponding to the key _SM£ , and the MME will receive the authentication of the RS. Vector to save;

Step 104: The MME sends an RS authentication request to the RS, where the message carries the corresponding RAND and AUTN in the RS authentication vector, and the key identifier/ _{ASM £} corresponding to the key _SM£ .

Step 105: The RS performs verification according to the received RAND and AUTN, including: according to RAND,

The SQN in the AUTN and the key K shared by the network side jointly calculate a MAC value, and compare whether the MAC value is consistent with the MAC value parsed from the received AUTN. If they are consistent, the RS authenticates the network side. Passing, using RAND and the key K shared with the network side to calculate a response (Response, RES) is sent to the MME;

Step 106: The MME compares whether the RES received from the RS is consistent with the XRES stored in the user AV. If the network side authenticates the RS, the MME further derives the air interface key K according to the key _{ASM £} . _{The eNB} sends the air interface key and the encryption and integrity protection algorithm supported by the RS to the _eNB through a Security Mode Command (SMC);

Step 107: The eNB performs an encryption and integrity protection algorithm supported by the received RS, and The encryption and integrity protection algorithm supported by the body, the algorithm for determining the encryption and integrity protection keys of the air interface user plane and the control plane, and the selected algorithm is sent to the RS through the SMC. At this time, the RS and the eNB can each utilize the same. The air interface key K _eNB further derives the user air interface encryption and integrity protection key through the selected key algorithm.

In the process of implementing the present invention, the inventor has found that the above technical solution has at least the following drawbacks: In the LTE system after the introduction of the RS, the authentication process of the RS needs to be modified correspondingly to the HSS of the core network, including increasing the HSS to the RS. Storage of security context information.

Summary of the invention

The embodiments of the present invention provide an authentication method, a communication device, and a communication system. The embodiments of the present invention are implemented by the following technical solutions:

An authentication method, including:

The first device receives the authentication request sent by the relay station, and the authentication request includes the relay station identity identifier; the first device acquires the authentication vector, sends an authentication vector to the relay station, and instructs the relay station to authenticate the authentication vector, and the authentication vector is generated by the second device independent of the core network. Corresponding to the relay station identity identifier; the first device receives the response value sent by the relay station after the authentication vector is authenticated, and authenticates the response value, and when the authentication passes, the air interface key is derived.

A communication device comprising:

a request receiving unit, configured to receive an authentication request sent by the relay station, where the authentication request includes a relay station identity identifier;

An obtaining unit, configured to obtain an authentication vector, where the authentication vector is generated by a second device independent of the core network, and corresponding to the relay station identity identifier;

An authentication vector sending unit, configured to send, to the relay station, an authentication vector acquired by the acquiring unit, and instruct the relay station to authenticate the authentication vector;

a response value receiving unit, configured to receive a response value sent by the relay station after the authentication vector authentication sent by the authentication vector sending unit passes;

An authentication unit, configured to authenticate a response value received by the response value receiving unit;

The air interface key deriving unit is configured to derive an air interface key when the authentication unit passes the response value authentication.

A communication system comprising: a first device, configured to receive an authentication request sent by the relay station, where the authentication request includes an identity of the relay station, acquire an authentication vector, send the authentication vector to the relay station, and instruct the relay station to authenticate the authentication vector And generating, by the second device independent of the core network, the identifier corresponding to the relay station, and receiving the response value sent by the relay station after the authentication vector is authenticated, and authenticating the response value. , when the authentication is passed, the air interface key is derived. It can be seen that, in the embodiment of the present invention, the access network side receives the authentication request sent by the RS, generates an authentication vector, and sends the authentication vector to the RS, and receives the response value sent by the RS after the authentication vector is authenticated, and the response value is authenticated, and the authentication is passed after the authentication is performed. Key, complete authentication of the RS. A network logical entity is introduced on the access network side, and the logical entity on the access network side shares the shared key with the relay station, and the access network side completes the identity authentication and key derivation of the RS, thereby completing the network security connection of the relay station. Therefore, the network security access of the relay station can be realized without modifying the core network, so that the impact of the system after the introduction of the RS on the entire network is minimized.

DRAWINGS

1 is a signaling diagram of a prior art relay station access authentication;

2 is a flow chart of a method for implementing Embodiment 1 of the present invention;

3 is a signaling diagram of a method for implementing Embodiment 2 of the present invention;

4 is a signaling diagram of a method for implementing Embodiment 3 of the present invention;

5 is a signaling diagram of a method for implementing Embodiment 4 of the present invention;

6 is a schematic diagram of a communication device implementing an embodiment of the present invention;

Figure 7 is a block diagram showing the composition of a communication system embodying an embodiment of the present invention.

detailed description

The embodiments of the present invention provide an authentication method, a communication device, and a communication system, which can avoid changes to the core network caused by the access network entering the RS.

The RS is an access network device. In most cases, the RS may be directly deployed by the access network operator in the network, that is, the RS and the eNB belong to one operator. In order to minimize the impact on the entire network after the introduction of the RS, it may be considered to limit the impact of the introduction of the RS only on the access network side, that is, by introducing a logical entity relay station database (RSDA) in the access network, by the RSDA The authentication function such as RS authentication and key derivation is completed, and the logical entity stores all relevant context information of the RS. Therefore, the LTE system after the introduction of the RS does not need to be modified on the core network. RS can be securely connected to the network to minimize the impact on the network.

The authentication method proposed by the embodiment of the present invention is based on the pre-shared permanent key K between the RS and the logical entity RSDA, and uses the AKA protocol to complete RS and network side identity authentication and key derivation.

According to the embodiment of the present invention, whether the physical location of the RSDA overlaps with the eNB, and whether the eNB is still

The RSDA authenticates the RS, and the corresponding embodiments are given, which are described in detail below.

Embodiment 1

In the solution provided by the embodiment, the first device and the second device on the access network side complete the authentication of the RS together, and the systems that support the symmetric key authentication mode after the introduction of the RS can authenticate the RS. Therefore, the eNB in the subsequent embodiments may be a base station supporting the symmetric key authentication mode.

Referring to Figure 2, the method includes:

Step 201: The first device receives an authentication request sent by the RS, where the authentication request includes a relay station identity identifier.

The authentication request can be included in the authentication request message.

Step 202: The first device acquires an authentication vector, and sends an authentication vector to the RS, instructing the RS to authenticate the authentication vector, where the authentication vector is generated by the second device independent of the core network, and corresponds to the RS identity.

The second device independent of the core network searches for a shared key corresponding to the RS identity, generates a random number, and generates an authentication vector corresponding to the shared key and the random number.

The first device may be a base station, and the second device independent of the core network is a logical entity, and the base station is connected to the logical entity.

The first device may be a base station, and the second device independent of the core network is a logical entity, and the logical entity may be integrated in the base station.

The first device and the second device independent of the core network may be the same logical entity.

The above base station may also be an eNB.

Step 203: Receive a response value sent after the RS authentication is passed, and perform the authentication on the response value. If the authentication is passed, the air interface key is derived.

Receiving the response value sent after the RS authentication is passed, comparing the response value with the expected response value in the authentication vector. If the authentication is consistent, the authentication is passed, and the air interface key is derived, and the capability corresponding to the RS is determined. The key derivation algorithm can also send the key derivation algorithm to the RS, and the RS can derive the encryption and integrity protection key corresponding to the key derivation algorithm.

At this point, the access network side has completed the authentication of the RS. In order to enable the subsequent RS and the access network side to communicate securely, the method may further include the steps of: deriving an encryption key corresponding to the air interface key and integrity protection. key.

The above-mentioned derived encryption key and integrity-protected key are derived from the base station on the access network side, for example: derived by an eNB in the LTE system or in a Worldwide Interoperability for Microwave Access (Wimax) system. BS derived.

In this embodiment, the access network side receives the authentication request sent by the RS, generates an authentication vector, and sends the authentication vector to the RS, and receives the response value sent by the RS after the authentication vector is authenticated, and authenticates the response value, and the air interface is authenticated after the authentication is passed. Key, complete the authentication of the RS. In this embodiment, the authentication function of the RS is completely limited to the access network side, so as to avoid the modification of the core network after the RS is introduced into the access network, so that the impact of the system after the introduction of the RS on the entire network is minimized.

The first embodiment is a method for implementing authentication from the access network side, and the second embodiment is a method for implementing authentication by using specific signaling interaction between the RS and the eNB/RSDA.

Embodiment 2

In this embodiment, when the physical location of the RSDA is integrated with the eNB, the eNB/RSDA completes the authentication of the RS. The eNBs in this embodiment can be the base stations supporting the symmetric key authentication mode, and the eNBs in this embodiment can be used to authenticate the RSs. The details will be described below with reference to the drawings.

Referring to FIG. 3, the specific steps of implementing the method in Embodiment 2 are described in detail: Step 301: The RS sends an authentication request to the eNB/RSDA.

The authentication request may be included in an authentication request message, where the message carries an RS identity, a supported encryption and integrity protection algorithm, and a key identifier corresponding to the eNB/RSDA derived key. The identity of the RS may be the IMSI of the RS, or the MAC address of the RS.

Step 302: eNB/RSDA generates AV;

The eNB/RSDA finds the shared key K corresponding to the RS according to the RS identity, and randomly generates a RAND, and then according to the RAND, the key shared between the SQN, RS and RSDA currently saved by itself. K generates an AV corresponding to the RS, wherein the AV includes RAND, XRES, and K AUTN; the embodiment of the present invention does not limit the parameters for generating the AV.

Step 303: The eNB/RSDA returns an authentication response to the RS.

The authentication response carries the RAND and AUTN corresponding to the AV of the RS, and the key identifier KSI corresponding to the key K.

Step 304: The RS performs authentication and generates a RES value.

The RS performs verification according to the received RAND and AUTN, including: calculating a MAC value according to the RAND, the SQN in the AUTN, and the key K shared with the RSDA, and comparing the MAC value with the parsed from the received AUTN. Whether the MAC values are consistent. If the RS passes the authentication of the network side, the RES and the key K shared with the RSDA are used to calculate a RES value.

Step 305: The RS returns an RES value to the eNB/RSDA.

Step 306: The eNB/RSDA performs authentication, and derives an air interface key ^ _ss ;

The eNB/RSDA compares whether the RES received from the RS is consistent with the XRES in the AV in which the RS was previously generated. If the network side authenticates the RS, the eNB/RSDA proceeds according to the key ^^ _£ ― _3⁄45 Derived air interface key K _eNB — _RS .

So far, the eNB/RSDA on the access network side has been authenticated by the RS. For the subsequent secure communication between the RS and the access network side, the following steps can also be performed.

Step 307: The eNB/RSDA sends the air interface key K _eNB — _RS and the determined encryption algorithm and integrity protection algorithm to the RS through the SMC.

eNB/RSDA combines RS-supported encryption and integrity protection algorithms with its own supported encryption and integrity protection algorithms to determine the key derivation algorithm for the air interface user plane and control plane encryption key and integrity protection key, and will pass the SMC The air interface key K _eNB — _RS and the determined key derivation algorithm are sent to the RS.

Step 308: The RS and the eNB/RSDA derive the air interface encryption key and the integrity protected key.

The RS and the eNB/RSDA can each further derive the air interface encryption key and the integrity protected key by using the air interface key K _eNB — _RS through the selected key algorithm.

In this embodiment, the RSDA and the eNB are integrated on the access network side, and the authentication function of the RS is completely limited to the access network side, thereby avoiding changes to the core network caused by the access network entering the RS. The impact of the system after the RS into the RS is minimized.

The second embodiment is that the physical location of the RSDA coincides with the eNB, and is completed by the RS and the eNB/RSDA entity. Implementation of Authentication of RS The method of the present invention is described below. When the physical location of the RSDA and the eNB are not coincident, an embodiment of the method of the present invention is implemented, and according to the identity authentication location, it can be divided into two cases, A corresponding embodiment.

Embodiment 3

In this embodiment, the identity authentication is located on the eNB, and the eNB performs the authentication function of the RS. Introduce

The eNBs in this embodiment can be the base stations supporting the symmetric key authentication mode. The details will be described below with reference to the drawings.

Referring to FIG. 4, the specific steps of implementing the method in Embodiment 3 are described in detail: Step 401: The RS sends an authentication request to the eNB.

The authentication request may be included in the authentication request message, where the message carries an RS identity, a supported encryption and integrity protection algorithm, and a derivative key „corresponding key identifier ^/ ₄ „, etc., wherein The identity of the RS may be the IMSI of the RS, or the MAC address of the RS, and the like.

Step 402: The eNB forwards an RS authentication request to the RSDA.

The message carries the identity of the RS, the service network identifier, and the like.

Step 403: RSDA generates an AV corresponding to the RS;

The RSDA finds the shared key K corresponding to the RS according to the identity of the RS, and randomly generates a RAND, and then generates an AV corresponding to the RS according to the key K and other information shared between the RAND, the SQN RS and the RSDA currently saved by itself. Where the AV includes RAND XRES K AUTN; other parameters may also be used to generate the AV, and embodiments of the present invention do not limit the parameters for generating the AV.

Step 404: The RSDA returns an authentication response to the eNB.

The authentication response carries the corresponding RAND and AUTN in the AV of the RS, and the key

For the content such as the key identifier KSI corresponding to K, the eNB saves the received AV of the RS.

Step 405: The eNB sends an RS authentication request message to the RS.

The message carries the contents of the corresponding RAND and AUTN in the AV of the RS, and the key identifier KSI corresponding to the key ₅ .

Step 406: The RS performs authentication, and generates an RES value. The RS performs verification according to the received RAND and AUTN, and includes: calculating a MAC value according to the SQN in the RAND, the AUTN, and the key K shared with the RSDA, and comparing the MAC value and parsing from the received AUTN. Whether the MAC values are consistent. If the RS passes the authentication of the network side, the RES and the key K shared with the RSDA are used to calculate a RES.

Step 407: The RS sends the RES value to the eNB by sending an RS authentication response message.

Step 408: The eNB performs authentication, and derives an air interface key ^ _ss ;

The eNB compares whether the RES received from the RS is consistent with the XRES in the AV storing the RS locally. If the network side authenticates the RS, the eNB further derives the air interface key according to the key _{SM £} _ss.

At this point, the access network side has completed authentication of the RS. In order to secure communication between the RS and the access network side, the following steps can also be performed.

Step 409: The eNB sends the air interface key K _eNB — _RS and the determined encryption algorithm and integrity protection algorithm to the RS through the SMC.

The eNB combines the encryption and integrity protection algorithms supported by the RS and the encryption and integrity protection algorithms supported by the eNB to determine the key derivation algorithm of the user plane and the control plane encryption key and the integrity protection key, and the air interface key is determined by the SMC. The K _eNB — _RS and the determined key derivation algorithm are sent to the RS.

Step 410: The RS and the eNB derive an air interface encryption key and an integrity protected key.

The RS and the eNB can each further derive the air interface encryption key and the integrity protected key by using the air interface key K _eNB — _RS through the selected key algorithm.

In this embodiment, by introducing an RSDA on the access network side, the context information of the RS is stored, and the RS and the RSDA pre-share a permanent key K. The RSDA is connected to the eNB through a wired or wireless manner, and the eNB completes the RS identification. The weight function, thus completely limiting the RS access authentication to the access network side, thereby avoiding changes to the core network caused by the access network entering the RS, so that the impact of the system after the switch into the RS affects the entire network. Minimized.

The third embodiment is an embodiment in which the identity authentication is located on the eNB and the eNB performs the authentication function of the RS. The following describes an embodiment in which the identity authentication is located on the RSDA and the RSA performs the authentication function of the RS.

Embodiment 4

In this embodiment, the identity authentication is located on the RSDA, and the RSA is authenticated by the RSDA. The solution of this embodiment requires that the network identifier of all eNBs connected by wires be required on the RSDA. The eNBs in this embodiment can be the base stations supporting the symmetric key authentication mode, and the eNBs in this embodiment can be used to authenticate the RSs. The details will be described below with reference to the accompanying drawings.

Referring to FIG. 5, the specific steps of implementing the method in Embodiment 4 are described in detail below: Step 501: The RS sends an authentication request to the RSDA.

The authentication request may be included in an authentication request message, where the message carries an RS identity, a supported encryption and integrity protection algorithm, and a key identifier corresponding to the derived key ^/ ₄ „ The identity of the RS may be the IMSI of the RS, or the MAC address of the RS, and the like.

Step 502: RSDA generates AV;

The RSDA finds the shared key K corresponding to the RS according to the RS identity, and randomly generates a RAND, and then generates an AV corresponding to the RS according to the KEY, the key K and the other information shared between the SQN, the RS and the RSDA currently saved by the RAND. , where AV includes RAND, XRES, K

AUTN; Other parameters may also be used to generate the AV. The embodiment of the present invention does not limit the parameters for generating the AV.

Step 503: The RSDA returns an authentication response to the RS.

The message carries the corresponding RAND and AUTN in the AV of the RS, and the key identifier KSI corresponding to the key K.

Step 504 and step 304, and details are not described herein;

Step 505: The RS returns an RES value to the RSDA;

Step 506: RSDA performs authentication, and derives an air interface key ^

RSDA compares whether the RES received from the RS is consistent with the XRES in the AV that generated the RS. If the network side authenticates the RS, the RSDA further derives the air interface key according to the key ^^^^^. _eNB - _RS

Step 507: The RSDA sends the derived key K _eNB — _RS and the encryption and integrity algorithm supported by the RS to the _eNB through the SMC.

Step 508: The eNB sends the determined encryption algorithm and integrity protection algorithm to the RS through the SMC. The eNB determines the key derivation algorithm of the air interface user plane and the control plane encryption key and the complete protection key according to the encryption and integrity protection algorithm supported by the RS and the encryption and integrity protection algorithms supported by the RS, and the SMC will The selected algorithm is sent to the RS.

Step 509 refers to step 410, and details are not described herein again.

In this embodiment, by introducing an RSDA on the access network side, the context information of the RS is stored, and the RS and the RSDA pre-share a permanent key K. The RSDA is connected to the eNB through a wired or wireless manner, and the RS is completed by the RSDA. The weight function, thus completely limiting the RS access authentication to the access network side, thereby avoiding changes to the core network caused by the access network entering the RS, so that the system after the bow I enters the RS affects the entire network. Minimized.

The above embodiment describes several methods for RS access authentication, and the related devices are described below.

Referring to Figure 6, a communication device includes:

The request receiving unit 110 is configured to receive an authentication request sent by the RS, where the authentication request includes an RS identity identifier;

The obtaining unit 111 is configured to obtain an authentication vector, where the authentication vector is generated by a second device independent of the core network, and corresponds to the RS identity identifier;

The obtaining unit 111 may acquire the authentication vector after receiving the authentication request in the request receiving unit 110.

The authentication vector sending unit 112 is configured to send, to the RS, the authentication vector acquired by the acquiring unit 111, and the indication

The RS authenticates the authentication vector;

The response value receiving unit 113 is configured to receive a response value that is sent by the RS after the authentication vector sent by the authentication vector sending unit 112 is passed;

The authentication unit 114 is configured to authenticate the response value received by the response value receiving unit 113. The air interface key deriving unit 115 is configured to derive an air interface key when the authentication unit 114 passes the response value authentication.

The communication device further includes: a key derivation unit, configured to derive an encryption key and an integrity-protected key corresponding to the air interface key derived by the air interface key derivation unit 115.

See Figure 7, a communication system, including:

The relay station 121 is configured to send an authentication request to the first device 122, where the authentication request includes an RS identity, and receives an authentication vector sent by the first device 122, and authenticates the authentication vector, and the authentication is passed. Generating a response value, and transmitting a response value to the first device 122;

The first device 122 is configured to receive an authentication request sent by the relay station 121, where the authentication request includes an identity of the relay station, acquire an authentication vector, send an authentication vector to the relay station 121, and receive a response value sent by the relay station 121 after the authentication vector is authenticated. The value is authenticated, and when the authentication is passed, the air interface key is derived;

The second device 123, independent of the core network, is configured to generate an authentication vector, and the authentication vector corresponds to the relay station identity.

The first device 122 may be a base station, and the second device 123 independent of the core network may be a logical entity, and the logical entity is connected to the base station.

The first device 122 may be a base station, and the second device 123 independent of the core network may be a logical entity, and the logical entity is integrated in the base station.

The first device 122 and the second device 123 independent of the core network may be the same logical entity. The base station is further configured to derive an encryption key and an integrity-protected key corresponding to the air interface key.

In the embodiment of the present invention, the access network side receives the authentication request sent by the RS, generates an authentication vector, and sends the authentication vector to

The RS receives the response value sent by the RS after the authentication vector is authenticated, and authenticates the response value. After the authentication is passed, the air interface key is derived to complete the authentication of the RS. A network logical entity is introduced on the access network side, and the logical entity on the access network side shares the shared key with the relay station, and the access network side completes the identity authentication and key derivation of the RS, thereby completing the network security connection of the relay station. Therefore, the network security access of the relay station can be realized without modifying the core network, so that the impact of the system after the introduction of the RS on the entire network is minimized.

Further, the RSDA and the eNB may be integrated on the access network side to completely limit the authentication function of the RS to the access network side. By introducing an RSDA on the access network side, the context information of the RS is stored. The RSDA is shared with the RSDA. The RSDA is connected to the eNB by wire or wirelessly. The eNB performs the authentication function of the RS or the RSA performs the authentication function of the RS. The RS access authentication is completely restricted to the access network. .

A person skilled in the art can understand that all or part of the steps of implementing the above embodiments can be completed by a program to instruct related hardware, and the program can be stored in a computer readable storage medium, the above mentioned storage. The medium can be a read only memory, a magnetic disk or a compact disk or the like. The foregoing detailed description of the authentication method, the communication device, and the communication system provided by the embodiments of the present invention is only for assisting in understanding the method of the present invention and its core ideas. Meanwhile, for those skilled in the art, The present invention is not limited by the scope of the present invention.

Claims

Rights request

An authentication method, comprising:

The first device receives an authentication request sent by the relay station, where the authentication request includes a relay station identity identifier;

The first device acquires an authentication vector, and sends the authentication vector to the relay station, instructing the relay station to authenticate the authentication vector, where the authentication vector is generated by a second device independent of the core network, and the relay station Identity corresponding;

The first device receives a response value sent by the relay station after the authentication vector is authenticated, and performs authentication on the response value. When the authentication passes, the air interface key is derived.

The authentication method according to claim 1, wherein the first device is a base station, the second device is a logical entity, and the logical entity is connected to the base station;

The step of the first device acquiring the authentication vector is specifically:

The first device receives an authentication vector sent by the second device.

The authentication method according to claim 1, wherein the first device is a base station, the second device is a logical entity, and the logical entity is integrated in the base station.

The authentication method according to claim 1, wherein the first device and the second device are the same logical entity.

The authentication method according to any one of claims 1 to 4, wherein the step of generating the authentication vector by the second device independent of the core network is specifically:

The second device independent of the core network searches for a shared key corresponding to the relay station identity, generates a random number, and generates the authentication vector corresponding to the shared key and the random number.

The authentication method according to any one of claims 1 to 4, wherein the authentication vector includes an expected response value;

The step of authenticating the response value is specifically:

The response value is compared with the expected response value in the authentication vector, and if they match, the authentication passes.

The authentication method according to claim 2 or 3, wherein the step of deriving the air interface key further comprises:

The base station derives an encryption key and an integrity protected key corresponding to the air interface key.

The authentication method according to claim 4, wherein the step of deriving the air interface key further comprises:

The logical entity sends the air interface key to the base station, instructing the base station to derive an encryption key and an integrity protected key corresponding to the air interface key.

9. A communication device, comprising:

An acquiring unit, configured to obtain an authentication vector, where the authentication vector is generated by a second device independent of the core network, corresponding to the relay station identity identifier; and the vector indicates that the relay station authenticates the authentication vector;

a response value receiving unit, configured to receive a response value that is sent by the relay station after the authentication vector sent by the authentication vector sending unit is authenticated;

An authentication unit, configured to authenticate the response value received by the response value receiving unit, and an air interface key deriving unit, configured to: when the authentication unit authenticates the response value, derive an air interface key.

The communication device according to claim 9, further comprising:

And a key derivation unit, configured to derive an encryption key and an integrity-protected key corresponding to the air interface key derived by the air interface key derivation unit.

A communication system, comprising:

a first device, configured to receive an authentication request sent by the relay station, where the authentication request includes an identity of the relay station, acquire an authentication vector, send the authentication vector to the relay station, and instruct the relay station to authenticate the authentication vector And generating, by the second device independent of the core network, the identifier corresponding to the relay station, and receiving the response value sent by the relay station after the authentication vector is authenticated, and authenticating the response value. , when the authentication is passed, the air interface key is derived.

The communication system according to claim 11, wherein the first device is a base station, the second device is a logical entity, and the logical entity is connected to the base station.

The communication system according to claim 11, wherein the first device is a base station, the second device is a logical entity, and the logical entity is integrated in the base station.

14. The communication system according to claim 11, wherein the first device and the second device are the same logical entity.