WO2011020445A1

WO2011020445A1 - Interaction method and apparatus for secure information

Info

Publication number: WO2011020445A1
Application number: PCT/CN2010/076221
Authority: WO
Inventors: 和峰; 黄亚达; 邓云
Original assignee: 中兴通讯股份有限公司
Priority date: 2009-08-21
Filing date: 2010-08-20
Publication date: 2011-02-24
Also published as: CN101998388A; CN101998388B

Abstract

An interaction method for secure information is provided, which includes: a first NodeB selects one or more component carriers from the component carriers in a carrier aggregation cell managed by a second NodeB; the first NodeB computes the information of the selected component carriers as the input parameter to obtain the key after handover; the first NodeB transmits a handover request carrying the key after handover to the second NodeB; the first NodeB transmits the information of the selected component carriers to the user equipment(UE) so that the UE computes the received information of the selected component carriers as the input parameter to obtain the key after handover. Correspondingly an apparatus for secure information is provided. The interaction of component carrier information enables both the UE and the eNodeB on the handover target side to obtain the same KeNB after handover so as to be compatible with the current handover flow of Long Term Evolution(LTE), facilitate the balanced upgrade of the network, guarantee the security of the handover to the carrier aggregation cell and solve the problem that the security of information can not be guaranteed during the process of the handover to the carrier aggregation cell.

Description

Security information interaction method and device

The present invention relates to the field of communications, and in particular, to a method and apparatus for interacting with security information, for implementing security information interaction in a process of handover to a carrier aggregation cell. BACKGROUND As shown in FIG. 1, a Long Term Evolution (LTE) network consists of an Evolved Universal Terrestrial Radio Access Network (E-UTRAN) and an Evolved Packet Core (EPC). ) Composition, the network is flat. EUTRAN is connected to the EPC through the SI interface. The EUTRAN is composed of a plurality of interconnected evolved base stations (eNBs, Evolved NodeBs), and each eNB is connected through an X2 interface; the EPC is composed of a mobility management entity (MME, Mobility Management Entity) and a monthly gateway entity (S-GW). , Serving Gateway ). In LTE, the user equipment (UE, User Equipment) may cause a change in the serving cell of the UE because it is in the network coverage area i or mobile. In order to maintain the service continuity of the UE, the network assisted UE needs to perform handover between the cells. Currently, the handover in the LTE process can be mainly divided into an S1 switch and an X2 switch according to the process, which respectively correspond to the handover process through the S1 port and the X2 port. The initiator of the handover is called the source side, and the destination of the handover is called the target side. In order to ensure the security of the UE after handover, it is necessary to determine the security key (KeNB) of the UE on the target side during the handover process. In the S1 handover, the new KeNB on the target side is forwarded by the target side according to the next mega-value (NH, Next Hop) and the next hop count counter (NCC, Next Hop Chaining Counter) and the target cell corresponding to the MME. The physical 'J, the physical cell identity (PCI, Physical Cell Identity) and the cell's downlink carrier frequency (EARFCN-DL, E-UTRA Absolute Radio Frequency Channel Number-Down Link) are calculated; and in the X2 switch, the new target side KeNB, that is, KeNB*, is the source side of the target side cell based on the physical side of the target side cell (PCI, Physical Cell Identity), and the downlink carrier frequency of the cell (EARFCN-DL, E-UTRA Absolute Radio Frequency Channel Number- Down Link) and the currently used KeNB (or next hop (NH, Next Hop)) to calculate the KeNB* on the target side. Then, the KeNB* and the corresponding Next Hop Chaining Counter are sent to the target side through a handover request message (Handover Request), and the target side passes the NCC through the handover command message (Handover Command) through the source side. Send to the UE. The UE calculates the same method as the network side according to the NCC information in the handover command. A new security key, where the NCC is mainly used to indicate whether the input parameter used in calculating the new key is KeNB or NH. In LTE, a TDD cell provides only one carrier for uplink and downlink transmission, and an FDD cell provides only one pair of carriers (one uplink and one downlink carrier) for uplink and downlink transmission. In order to meet people's demand for higher bandwidth, the 3rd Generation Partnership Project (3GPP) proposes a new enhancement to the LTE system, called LTE Advance. Carrier aggregation (CA) is proposed in LTE Advance. The carrier aggregation method achieves a larger bandwidth. In this case, a cell is composed of multiple consecutive or discontinuous carriers. Each carrier is called a component carrier (CC) and can provide multi-carrier services for the UE at the same time. The component carrier can adopt a carrier compatible with the LTE system, and the carrier is called a backward compatible carrier; the component carrier can also adopt a carrier that is not compatible with the existing LTE system, and the carrier is called a backward compatible carrier (Non -backwards compatible carrier ), this carrier is only used for LTE Advance UE and higher UEs; the component carrier can also be an extension carrier. This carrier cannot be used alone, and needs to be used independently with other carriers. use together. It should be noted that the above-mentioned carrier aggregation cell is only a logical term for a plurality of consecutive or discontinuous carriers. Each component carrier in the above description may also be regarded as a cell, and the cell has only one carrier. Therefore, in the present invention, the carrier aggregation cell can also be regarded as a general term for a plurality of cells. It can be seen from the above that in the carrier aggregation cell, the UE can use several uplink carriers and downlink carriers at the same time, and based on the current protocol discussion, if the target side is a carrier aggregation cell in the handover, the UE can support multiple to the target side cell. CC switches at the same time. Before the handover, the source side can determine the target carrier of the UE after the handover by the measurement of the UE. However, the inventor has found that: since there are multiple CCs on the target side, and the prior art does not disclose the method of interaction of security information in multiple CC scenarios, information cannot be guaranteed in the process of handover to the carrier aggregation cell. Security. SUMMARY OF THE INVENTION The present invention has been made in view of the problem that the security of information cannot be ensured in the process of switching to carrier aggregation and area in the prior art. Therefore, the main object of the present invention is to provide a method and apparatus for interacting security information. To solve at least one of the above problems. In order to achieve the above object, according to an aspect of the present invention, an interactive party of security information is provided. The method includes: the first node B selects one or more component carriers from component carriers of a carrier aggregation cell managed by the second node B; and the first node B calculates information of the selected component carrier as an input parameter. a key after the handover; the first node B sends a handover request message to the second node B, where the request message carries the switched key; the first node B selects the selected The information of the component carrier is sent to the terminal UE, so that the UE calculates the received key by using the received information of the selected component carrier as an input parameter. In order to achieve the above object, according to another aspect of the present invention, a method for interacting security information is provided, including: a first node B sends a handover request message to a second node B, where the handover request message is carried in the For calculating parameter information of a key used after the handover, the parameter information includes key information or a next hop value NH; the second Node B selects one or more components from component carriers of the carrier aggregation cell managed by itself The carrier information is used to calculate the key used after the handover according to the information of the selected component carrier and the parameter information carried in the handover request message; the second node B uses the information and location of the selected component carrier. The parameter information is sent to the terminal UE, so that the UE calculates the key used after the handover according to the information of the selected component carrier and the parameter information. In order to achieve the above object, according to still another aspect of the present invention, an apparatus for interacting with security information is provided, which is located in a first Node B, for implementing interaction of security information in a process of handover to a carrier aggregation cell, the interaction The device includes: a selection module, configured to select one or more component carriers from component carriers of a carrier aggregation cell managed by the second Node B; and a processing module, configured to calculate information of the selected component carrier as an input parameter a first sending module, configured to send a handover request message to the second node B, where the request message carries the switched key; and a second sending module, configured to send to the terminal UE Information of the selected component carrier, so that the UE calculates the switched key by using the information of the selected component carrier as an input parameter. According to the present invention, the UE and the eNodeB on the handover target side obtain the same switched security key through the interaction of the component carrier information, thereby being compatible with the current LTE handover procedure, facilitating the smooth upgrade of the network, and ensuring the aggregation of the carrier to the carrier. Switching security. BRIEF DESCRIPTION OF THE DRAWINGS The accompanying drawings, which are set to illustrate,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, In the drawing: 1 is a schematic diagram of a network architecture of an LTE network side according to the related art; FIG. 2 is a preferred flowchart of an interaction method of security information according to an embodiment of the present invention; FIG. 3 is a flowchart according to an embodiment of the present invention. FIG. 4 is a flowchart of an X2 handover with a negotiation process according to an embodiment of the present invention; FIG. 5 is a schematic diagram of an S1 handover process according to an embodiment of the present invention; Another preferred flowchart of the method for interacting security information according to an embodiment of the present invention; FIG. 7 is a structural diagram of an apparatus for interacting with security information according to an embodiment of the present invention. BEST MODE FOR CARRYING OUT THE INVENTION Hereinafter, the present invention will be described in detail with reference to the accompanying drawings. It should be noted that the embodiments in the present application and the features in the embodiments may be combined with each other without conflict. The present invention provides a method and device for interacting security information by using parameters such as component carrier information, so that the UE and the handover target are implemented, in consideration of the problem that the security of the information cannot be ensured in the process of switching to the carrier aggregation cell. The eNodeBs on the side obtain the same security key after the handover, which is compatible with the current LTE handover procedure, facilitating the smooth upgrade of the network, and ensuring the security of handover to the carrier aggregation cell. According to an embodiment of the present invention, a method for interacting security information is provided, which is used to implement interaction of security information in a process of handover to a carrier aggregation cell. As shown in FIG. 2, the interaction party of the security information in the embodiment of the present invention includes the following steps: Step S202: The first node B selects one or more component carriers from component carriers of the carrier aggregation cell managed by the second node B. Step S204, the first node B calculates the switched key by using the information of the selected component carrier as an input parameter; Step S206, the first node B sends a handover request message to the second node B, where The request message carries the above-mentioned switched key; Step S208: The first node B sends the information of the selected component carrier to the terminal UE, so that the UE calculates the received key by using the received information of the selected component carrier as an input parameter. According to the embodiment, the interaction between the component carrier information enables the UE and the eNodeB on the handover target side to obtain the same switched security key, which is compatible with the current LTE handover procedure, facilitates smooth network upgrade, and ensures carrier aggregation. Cell handover security. Preferably, the handover request message includes information of the selected component carrier, where the information of the component carrier includes at least one of the following: a physical cell identifier corresponding to the selected component carrier and a downlink carrier frequency. Preferably, after the first node B sends the information of the selected component carrier to the terminal UE, the method further includes: the UE calculating the received information of the selected component carrier as an input parameter, and after the switching, The UE sends a handover confirmation message to the second node B on the selected component carrier, where the UE encrypts the handover confirmation message by using the switched key. In this scenario, after receiving the handover confirmation message, the second node B decrypts the key using the switched key, thereby implementing security information interaction and ensuring security for handover to the carrier aggregation cell. Preferably, the handover request message includes a carrier aggregation 'J, a global identifier of a zone managed by the second node B. Preferably, in the foregoing embodiment, when the first node B sends the information of the selected component carrier to the terminal UE, the method further includes: sending, by the first node B, the global identifier to a terminal UE; the UE calculates the switched key by using the global identifier as an input parameter; and the UE sends a handover confirmation message encrypted by the switched key to the second node B. Preferably, when the first node B selects a plurality of the component carriers, the first node B calculates the key of the selected component carrier as an input parameter, and the key after the handover includes: the first node B sequentially calculates information of the selected one component carrier as an input parameter to obtain a switched key corresponding to the component carrier. In this scenario, the sending, by the first node B, the handover request message to the second node B includes: the first node B sending a handover request message to the second node B, where the request message is Carrying the plurality of switched keys. Preferably, in the embodiment described in the preceding paragraph, the first node B carries the selected component Sending the information of the wave to the terminal UE includes: the second node B selects a key from the plurality of switched keys as a key used after the handover; and the second node B sends the selected key to send Giving the first node B; the first node B transmitting information of the component carrier corresponding to the selected key to the UE; the UE calculating the received information of the component carrier as an input parameter to obtain the handover a key that is sent by the UE to the second Node B on the selected component carrier, where the UE performs a force key on the handover confirmation message by using the switched key. . Preferably, in the embodiment that the first node B selects a plurality of the component carriers, the first node B sends the information of the selected component carrier to the terminal UE, where: the first node B The information of the selected multiple component carriers is sent to the UE; the UE selects information of one component carrier from the received information of the multiple component carriers, and calculates the information of the component carrier as an input parameter to obtain the a key after the handover; the UE sends a handover confirmation message to the second node B on the selected component carrier, where the UE encrypts the handover confirmation message by using the switched key. Preferably, in the embodiment described in the preceding paragraph, the second node B receives the

UE handover message after confirmation, further comprising: after said second key point B sequentially switching the plurality of the received acknowledgment message, select a key to decrypt the handover until successful decryption and ^decryption ^ The key used in the success is determined as the key after the handover. With this embodiment, the interaction of security information can be successfully implemented. Preferably, in all the foregoing embodiments, the first Node B selects one or more component carriers from the component carriers of the carrier aggregation cell managed by the second Node B by using one of the following manners: B: selecting, by the terminal UE, one or more component carriers having the best signal quality from the measurement information of the component carriers of the carrier aggregation cell managed by the second Node B; or the first node B from the The first component carrier is selected from the working carrier list in the carrier aggregation cell managed by the second node B; or the first node B is selected from the component carrier of the carrier aggregation cell managed by the second node B according to a preset selection policy. Select the first carrier. The implementation process of the embodiment of the present invention will be described in detail below with reference to examples. The embodiment of the present invention is mainly based on the case where the handover target side is a carrier aggregation cell. Specifically, in all the following descriptions, the handover target side eNB2 is an LTE-Advance eNB, that is, the eNB2 supports carrier aggregation, and the same eNB2 manages the cell Cell 2 as a cell using carrier aggregation, and the Cell 2 may have several carriers; Whether to support the source side eNB1 of the handover and its managed cell Cell 1 Carrier aggregation does not require that eNB1 can support carrier aggregation or not, and Cell 1 can use carrier aggregation or not. Specifically, the embodiment according to the embodiment of the present invention may adopt the following manner: Embodiment 1 FIG. 3 is a flowchart of X2 handover according to an embodiment of the present invention. As shown in Figure 3, eNB (evolved

Node B (evolved base station) 1 determines that the target cell for UE handover is the carrier aggregation cell Cell 2 (cell 2) managed by eNB2 according to the UE (terminal) measurement. The eNB1 initiates an X2 handover to the eNB2, and the eNB1 selects one of the component carriers of the target cell Cell2, and uses the PCI and EARFCN-DL information of the component carrier as input parameters to calculate the target side new key KeNB*, that is, the switched key. . For the selected one, the following method can be used to calculate the switched key:

1) KeNB* = KDF (PCI, EARFCN-DL, NH); or

2) KeNB* = KDF (PCI, EARFCN-DL, KeNB); where PCI and EARFCN-DL are the physical cell identifier and downlink frequency point information corresponding to the component carrier selected by eNB1, and NH is the next megabyte stored in eNB1. The KeNB is the current key information used in the eNB1, and the KDF is the currently known Key Derivation Function, which is not described here. Preferably, the condition that the eNB1 chooses to use the calculation mode 1) is that the new {NH, NCC} value that has not been used is stored in the eNB1, otherwise the eNB1 uses the latter. Then, the eNB1 sends the new key and the component carrier information (i.e., PCI and EARFCN-DL) and the NCC information required to calculate the key to the eNB2 through the handover request message. If the eNB2 successfully accepts the handover request, the new key KeNB* is stored, and the eNB1 is responsive to the handover request acknowledgement message, which includes the security information required by the UE to calculate the target-side new key, that is, the NCC and the calculation of the new key. Component carrier information used at the time. After receiving the acknowledgment message of the eNB2, the eNB1 sends an RRC (Radio Resource Control) reconfiguration message to the UE according to the acknowledgement message, where the RRC reconfiguration message includes the security information required by the UE to calculate the target side new key. That is, the NCC and the component carrier information used when calculating the new key. After receiving the RRC reconfiguration message, the UE calculates the UE-side new security key KeNB* according to the NCC and the corresponding component carrier information in the message, and the calculation method may be performed on the eNB side. The calculation method is consistent. Then, the UE returns a handover confirmation message to the target side eNB2, and finally the eNB2 and the UE obtain the same new key KeNB* used after the handover. Further, the foregoing method for selecting one of the component carriers of the target cell may be that the eNB1 selects according to the measurement report of the UE, for example, selecting a carrier with the best measurement signal quality, or the eNB1 may select according to a display or an implicit rule. For example, selecting the anchor carrier of the UE or the first carrier in the working carrier list may also be any other selection manner. Here, the display rule selection refers to selecting a certain component carrier by signaling indication; the implicit selection rule refers to pre-negotiating which component carrier to select. Embodiment 2 As shown in FIG. 3, the eNB1 determines that the target cell of the UE handover is the carrier aggregation cell Cell 2 managed by the eNB2 according to the UE measurement, and then the eNB1 uses one carrier aggregation cell global identifier CA-CGI of the Cell 2. (The global identity may determine the target cell Cell 2 uniquely in the network) Replace the PCI and EARFCN-DL information of the carrier as an input parameter for calculating the new key. Preferably, the switched key can be calculated by the following calculation method: 1) KeNB* = KDF(CA-CGI, NH); or

2) KeNB* = KDF(CA-CGI, KeNB); where CA-CGI is the carrier aggregation cell global identifier selected by eNB1, NH is the next mega-information stored in eNB1, and KeNB is the current key used in eNB1 Information, KDF is the currently known Key Derivation Function, which is not described in jt. Preferably, the condition that the eNB1 chooses to use the calculation mode 1) is that the new {NH, NCC} value that has not been used is stored in the eNB1, otherwise the eNB1 uses the latter. Then, the eNB1 transmits the generated new key KeNB* on the target side and the corresponding NCC and the global identifier CA-CGI of the Cell 2 used in calculating the KeNB* to the eNB 2 through the handover request message. If the eNB2 successfully accepts the handover request, the new key KeNB* is stored, and the eNB1 is responsive to the handover request acknowledgement message, the handover request acknowledgement message includes the security information required by the UE to calculate the target-side new key, that is, the NCC and the new calculation The global standard for Cell 2 used in the key is only CA-CGI. After receiving the acknowledgment message of the eNB2, the eNB1 sends an RRC reconfiguration message to the UE according to the acknowledgment message, where the RRC reconfiguration message includes the security information required by the UE to calculate the target side new key, that is, the NCC and the calculation of the new key. The global identity of the target cell, CA-CGI. After receiving the RRC reconfiguration message, the UE calculates the UE side new security key KeNB* according to the NCC in the message and the global identifier CA-CGI of the corresponding target cell, and the calculation method is consistent with the eNB side calculation method. Then, the UE replies to the target side eNB2 with a handover confirm message, and finally both the eNB2 and the UE obtain the same new key KeNB* used after the handover. As shown in FIG. 3, the eNB1 determines that the target cell for UE handover is the carrier aggregation cell Cell 2 managed by eNB2 according to the UE measurement. Then, the eNB1 respectively calculates the corresponding target side new key KeNB* according to the carrier information of all carriers or a part of carriers of the target cell, that is, the PCI and EARFCN-DL information of the component carrier. Preferably, the KeNB* can be calculated by the same calculation method as in the first embodiment. Then, the eNB1 transmits the calculated new key KeNB* of all the target sides, the NCC corresponding to the new key KeNB*, and the component carrier information used when calculating the corresponding KeNB* to the eNB2 through the handover request message. If the eNB2 successfully accepts the handover request, the UE's eNB2 selects one of the new keys KeNB* provided by the eNB1 as the new key after the handover, and calculates the component carrier information used in the key and the corresponding NCC. The acknowledgment message is sent to the eNB1 through a handover request. After receiving the handover request acknowledgement message of the eNB2, the eNB1 sends an RRC reconfiguration message to the UE according to the acknowledgement message, where the RRC reconfiguration message includes the component carrier information and the new key required for the UE to calculate the target side new key. Corresponding NCC. After receiving the RRC reconfiguration message, the UE calculates a new security key KeNB* on the UE side according to the component carrier information and the NCC information in the message. Preferably, the KeNB* can be calculated by the same calculation method as in the first embodiment. Then, the UE returns a handover confirmation message to the target side eNB2, and finally the eNB2 and the UE obtain the same new key KeNB* used after the handover. Further, the method for selecting the new key by using the eNB2 in the new key provided by the eNB1 may be the load selection of the corresponding carrier of the eNB2, or may be the priority selection of the corresponding carrier, or use the display or Implicit rule selection, such as selecting the anchor carrier of the UE or the key corresponding to the first carrier in the working carrier list, may also be any other choice. Here, the display rule selection refers to selecting a component carrier by signaling indication; the implicit selection rule refers to the advance It is negotiated which component carrier to select. In the fourth embodiment, as shown in FIG. 3, the eNB1 determines that the target cell for UE handover is the carrier aggregation cell Cell 2 managed by the eNB2 according to the UE measurement. Then, the eNB1 respectively calculates the corresponding target side new key KeNB* according to the carrier information of all carriers or a part of carriers of the target cell, that is, the PCI and EARFCN-DL information of the component carrier. Preferably, the KeNB * can be calculated by the same calculation method as in the first embodiment. Then, the eNB1 retrieves the calculated new key KeNB* of all the target sides and the NCC information required for calculating the new key to be sent to the eNB2; if the eNB2 successfully accepts the handover request, all the new keys KeNB* are stored, and then The handover request acknowledgement message is sent to the eNB1 according to the handover request message, where the handover request acknowledgement message includes NCC information and indication information required for the UE to generate the target side new key, and the indication information is used to indicate the switchable component carrier on the target carrier. And the component carrier information corresponding to each of the component carriers, that is, PCI and EARFCN-DL. After receiving the acknowledgment message of the eNB2, the eNB1 sends an RRC reconfiguration message to the UE according to the acknowledgement message, where the RRC reconfiguration message includes the NCC information and the indication information from the eNB2. After receiving the RRC reconfiguration message, the UE selects one component carrier from the component carriers of the switchable target side according to the indication information in the message, and generates the UE according to the component carrier information corresponding to the component carrier and the corresponding NCC. Side new security key KeNB*. Preferably, the KeNB * can be calculated by the same calculation method as in the first embodiment. A handover confirmation message is then sent to eNB2, and the message uses the newly generated key KeNB*. The eNB2 blindly solves the handover confirmation message of the UE by using all the new keys indicated by the stored eNB1. If the blind solution is successful, the "J eNB2 confirms that the currently used key KeNB* is the new key after handover. Finally, the eNB2 and the UE The new key KeNB* used after the same handover is obtained. Here, the blind solution refers to that the eNB2 uses the new carrier key one by one according to all the new carrier keys sent by the eNB1 stored in advance. The handover confirmation message sent by the UE is decrypted, and if the decryption is successful, it indicates that the new key currently used is the key after the handover. Further, the UE selects a carrier selection method from the switched target carrier information, It may be selected according to the measurement result of the UE to the carrier, for example, selecting a carrier with a better measurement result, or using display or implicit rule selection, such as selecting the anchor carrier of the UE or the first carrier in the carrier list, or arbitrarily selecting. Here, the display rule selection refers to selecting a certain component carrier by signaling indication; the implicit selection rule refers to pre-negotiating which component carrier to select. Embodiment 5 FIG. 4 is a flowchart of an X2 handover with a negotiation procedure according to an embodiment of the present invention. As shown in FIG. 4, in step SI, the eNB1 determines that the target cell for UE handover is the carrier aggregation cell Cell 2 managed by the eNB2 according to the UE measurement, and then the eNB1 sends a handover target carrier ten-service request message to the eNB2, where The request message may include information of the target carrier of the Cell 2 handover decided by the eNB1, that is, one or more component carriers that are switchable in the carrier aggregation cell managed by the eNB2, and component carrier information corresponding to the component carriers. Step S2: After receiving the handover target carrier negotiation request message, the eNB2 returns a handover target carrier negotiation response message to the eNB1, where the response message may include the target carrier information of the handover decided by the eNB2, where the information of the target carrier of the handover transmitted by the eNB1 Only the reference of the switched carrier is selected by the eNB2, and the target carrier information of the handover decided by the eNB2 may be selected from the target carrier information of the handover sent by the eNB1, or may be selected according to its own situation. Step S3: The eNB1 selects one carrier from the target component carriers fed back by the Cell 2, and calculates the target side new key KeNB according to the PCI and EARFCN-DL information of the carrier, and the currently used key KeNB or NH. *, the specific KeNB* is calculated in the same manner as in the first embodiment, and the NCC is used to indicate that the KeNB or NH is used to calculate the new key. If the NH is used, the NCC needs to fill in the corresponding NCC value. Otherwise, The NCC needs to fill in the NCC value corresponding to the current KeNB. Then, the eNB1 transmits the target side new key KeNB* and the corresponding NCC and the information of the component carrier selected when the key KeNB* is calculated, to the eNB 2 through the handover request message. Step S4, if the eNB2 successfully accepts the handover request, and responds to the eNB1 with a handover request acknowledgement message, the acknowledgement message may include the security information required by the UE to calculate the target-side new key KeNB*, that is, the corresponding NCC and the calculation of the new key. Component carrier information. Step S5: After receiving the acknowledgment message of the eNB2, the eNB1 sends an RRC reconfiguration message to the UE according to the acknowledgement message, where the RRC reconfiguration message may include the security information required by the UE to calculate the target side new key, that is, the calculation target. The NCC required for the side new key KeNB* and the component carrier information used when calculating the key. Step S6: After receiving the UE, the UE calculates a new security key KeNB* according to the component carrier information in the message, and the calculation manner of the specific KeNB* is the same as that of the first embodiment. Finally, both eNB2 and UE obtain the same new key KeNB* used after handover. Optionally, in the foregoing step S2, the eNB2 may also display or implicitly feed back a designated carrier to the eNB1 for calculating a new security key. Here, explicitly feeding back a specified carrier means passing the signal. To specify a carrier, implicitly feeding back a specified carrier means pre-negotiating the specified carrier. Correspondingly, in the foregoing step S3, the eNB1 can directly calculate a new key according to the carrier information of the specified carrier. Further, the method for selecting one carrier from the target component carriers fed back by the Cell 2 may be selected by the eNB1 according to the measurement report of the UE, for example, selecting a carrier with the best measurement signal quality, or the eNB1 according to the display. Or implicit rule selection, such as selecting the anchor carrier of the UE or the first carrier in the carrier list, may also be any other selection method. In the sixth embodiment, as shown in FIG. 3, the eNB1 determines that the target cell of the UE handover is the carrier aggregation 'J, the cell Cell 2 managed by the eNB2 according to the UE measurement, and then the eNB 1 initiates a handover request message to the eNB2 in the message. Contains the currently used security key KeNB or the next mega-value NH. If the eNB2 successfully accepts the handover request, selecting one carrier from the handover target carrier, and then calculating a new key KeNB* according to the PCI and EARFCN-DL of the carrier, and the currently used security key KeNB or NH information, The calculation mode of the specific KeNB* is the same as that of the first embodiment, and the NCC is used to indicate whether the new key KeNB* is calculated by using the currently used security key KeNB or NH information, and then the eNB1 is replied to the handover request acknowledgement message. The handover request acknowledgement message may include carrier information for calculating a target side new key by the UE and NCC information corresponding to the new key. After the eNB1 receives the acknowledgment message to the eNB2, the RRC reconfiguration message is sent to the UE according to the acknowledgment message, and the RRC reconfiguration message may include the security information required by the UE to calculate the target side new key, that is, the NCC and the calculation. Component carrier information used when the new key is used. After receiving the RRC reconfiguration message, the UE calculates the UE-side new security key KeNB* according to the NCC in the message and the PCI and EARFCN-DL of the corresponding component carrier, and the specific KeNB* is calculated in the same manner as in the first embodiment. The way of calculating. Finally, both _e NB2 and UE obtain the same new key KeNB* used after handover. Further, the method for selecting one carrier from the handover target carrier may be selected by the eNB2 according to the load of the carrier, or may be selected according to the priority of the carrier, or may be selected by using display or implicit rules, such as selecting an anchor of the UE. The first carrier in the carrier or carrier list can also be any other choice. Further, in the first, third, fifth, and sixth embodiments, the component carrier information required to calculate the target side new key KeNB* may be the PCI and EARFCN-DL information of the component carrier, or may be The index information or other identification information of the component carrier, such as the global identifier corresponding to the carrier, and the target side eNB2 or the UE can use the index or the identifier to obtain the PCI and EARFCN-DL information of the carrier. Further, in Embodiments 1, 3, 5, and 6, the method for notifying the component carrier information required to calculate the target side new key KeNB* may be explicit or implicit, such as by signaling. The component carrier information is explicitly specified, or the anchor carrier is used by default, or the first carrier in the handover target carrier list is used. Further, the above embodiments 1 to 6 are all for X2 switching, that is, the corresponding switching process is completed through the X2 port. Embodiment 7 This embodiment is mainly for S1 handover, that is, the corresponding handover procedure is completed through the S1 interface. FIG. 5 is a schematic diagram of an S1 handover procedure according to an embodiment of the present invention. As shown in FIG. 5, the eNB1 determines that the target cell of the UE handover is the carrier aggregation cell Cell 2 managed by the eNB2 according to the UE measurement, and then the eNB1 initiates an S1 handover request message to the eNB2 through the MME (Mobility Management Entity). The message includes the target carrier information to which the UE is to switch. If the eNB2 successfully accepts the handover, a carrier is selected from the handover target carrier, and then the new key of the target side is calculated according to the PCI and EARFCN-DL of the carrier, and the NH and the NCC information corresponding to the NH. The calculation manner is the same as that in the first embodiment, and then the eNB1 is responsive to the handover preparation response message, where the handover preparation response message includes the carrier information for calculating the new key and the corresponding NCC information. After receiving the response message to the eNB2, the eNB1 sends an RRC reconfiguration message to the UE according to the acknowledgement message, where the message includes the security information required by the UE to calculate the target side new key, that is, the NCC and the time used to calculate the new key. Component carrier information. After receiving the RRC (Radio Resource Control) reconfiguration message, the UE calculates the new security key of the UE side according to the NCC in the message and the PCI and EARFCN-DL of the corresponding component carrier, and the specific calculation manner is the same. The calculation method of the first embodiment. Finally, both eNB2 and UE obtain the same new key used after handover. Further, the foregoing eNB2 selects one carrier from the handover target, which may be selected according to the target carrier information in the handover request message, or may be selected from all carriers of the target cell; and the selected method may be that the eNB1 measures according to the UE. The selection of the report, such as selecting the carrier with the best measurement signal quality, may also be selected by the eNB1 according to other display or implicit rules, such as selecting the anchor carrier of the UE or the first carrier in the carrier list, or arbitrarily selecting. Here, the display rule selection refers to selecting a certain component carrier by signaling indication; the implicit selection rule refers to pre-negotiating which component carrier to select. Further, in the above description, the eNB calculates the new key according to the PCI of the carrier and the EARFCN-DL, etc., and may use any specific calculation method in the prior art, which is not mentioned here. In summary, according to the interaction method of the security information according to the embodiment of the present invention, the UE and the eNodeB on the handover target side obtain the same new handover after the interaction of the component carrier information and other parameters (for example, NCC). The security key is compatible with the current LTE handover procedure, facilitating the smooth upgrade of the network, and ensuring the security of handover to the carrier aggregation cell. The present invention also provides a preferred method for interacting security information. As shown in FIG. 6, the method includes the following steps: S602: The first node B sends a handover request message to the second node B, where the handover request message is Carrying parameter information for calculating a key used after handover, the parameter information including key information or a next hop value NH;

S604, the second node B selects information of one or more component carriers from component carriers of the carrier aggregation cell that is managed by the second node, and performs information according to the selected component carrier and parameter information carried in the handover request message. Calculate the key used after the switch;

S606, the second node B sends the information about the selected component carrier and the parameter information to the terminal UE, so that the UE calculates the switch according to the information of the selected component carrier and the parameter information. The key used. According to the embodiment, the UE and the eNodeB on the handover target side are caused by the interaction of the parameter information. Both of them obtain the same security key after handover, which is compatible with the current LTE handover procedure, facilitates smooth upgrade of the network, and ensures the security of handover to the carrier aggregation cell. Preferably, after the UE calculates the key used after the handover according to the information of the selected component carrier and the parameter information, the method further includes: the UE moving to the second on the selected component carrier. The Node B sends a handover confirmation message, where the UE encrypts the handover confirmation message by using the switched key. In this scenario, after receiving the handover confirmation message, the second node B decrypts the used key by using the above-mentioned switched key, thereby realizing the interaction of the security information, and ensuring the aggregation to the carrier aggregation. safety. Preferably, in the embodiment that the second node B selects the information of the multiple component carriers, after the second node B receives the handover confirmation message from the UE, the method further includes: the second node B sequentially Deselecting one of the generated plurality of switched keys decrypts the handover confirmation message until the decryption is successful, and determines the key used when the decryption succeeds as the switched key. With this embodiment, the interaction of security information can be successfully implemented. Preferably, in all the foregoing embodiments, the selecting, by the second Node B, one or more component carriers of the component carrier of the carrier aggregation cell that is managed by the second node B includes: the second Node B slave terminal UE Selecting one or more component carriers with the best signal quality among the measurement information of the component carriers of the carrier aggregation cell managed by the second Node B; or the carrier aggregation cell from which the second Node B is managed The first component carrier is selected in the working carrier list; or the second node B selects the first carrier from the component carriers of the carrier aggregation cell it manages according to the preset selection policy. The device embodiment provides an interaction device for security information, which is located in the first Node B, and is used to implement interaction of security information in the process of handover to a carrier aggregation cell. The interaction device in this embodiment can use the methods in the embodiments of all the interaction methods described above to interact with the security information. As shown in FIG. 7, the security information interaction apparatus includes: a selection module 702, configured to select one or more component carriers from component carriers of a carrier aggregation cell managed by the second Node B; and a processing module 704, configured to The information of the selected component carrier is used as an input parameter to calculate a key after the switching; the first sending module 706 is configured to send a handover request message to the second node B, where the request message carries the switched a second sending module 708, configured to send to the UE Sending information of the selected component carrier, so that the UE calculates the switched key by using the information of the selected component carrier as an input parameter. In the above embodiment, the UE may know and save the above-mentioned switched key in advance. In this embodiment, the interaction between the parameter information enables the UE and the eNodeB on the handover target side to obtain the same switched security key, which is compatible with the current LTE handover procedure, facilitates smooth network upgrade, and ensures carrier aggregation to the carrier. Switching security. Preferably, the interaction device further includes: a third sending module 710, configured to send a handover request message to the second node B, where the handover request message carries parameter information for calculating a key used after the handover, where The parameter information includes key information or a next hop value NH, so that the second Node B can learn information of one or more component carriers in a component carrier of a carrier aggregation cell managed by itself and the handover request message. The carried parameter information calculates the key used after the handover. Preferably, the interaction device further includes: a fourth sending module 712, configured to forward, by the UE, a handover confirmation message sent by the UE on the selected component carrier to the second node B, where the UE passes the The switched key encrypts the handover confirmation message. Preferably, the handover request message includes information of the selected component carrier, where the information of the component carrier includes at least one of the following: a physical cell identifier corresponding to the selected component carrier and a downlink carrier frequency. Preferably, after the second sending module 708 of the first Node B sends the information of the selected component carrier to the terminal UE, the UE calculates the received information of the selected component carrier as an input parameter. The key after the handover; the UE sends a handover confirmation message to the second node B on the selected component carrier, where the UE encrypts the handover confirmation message by using the switched key . In this scenario, after receiving the handover confirmation message, the second node B decrypts the key using the switched key, thereby implementing security information interaction and ensuring security to carrier aggregation and area handover. . Preferably, the handover request message includes a carrier aggregation 'J, a global identifier of a zone managed by the second node B. Preferably, in the foregoing embodiment, when the second sending module 708 of the first node B sends the information of the selected component carrier to the terminal UE, the second sending of the first node B The module 708 sends the global identifier to the terminal UE; the UE calculates the switched key by using the global identifier as an input parameter; the UE sends a solution to the second node B A handover confirmation message of the key encryption after the handover. Preferably, when the selecting module 702 in the first node B selects a plurality of the component carriers, the processing module 704 of the first node B calculates the information of the selected component carrier as an input parameter to obtain the switched component. The key includes: the processing module 704 of the first node B sequentially calculates information of the selected one component carrier as an input parameter to obtain a switched key corresponding to the component carrier. In this scenario, the sending, by the first sending module 706 of the first node B, the handover request message to the second node B includes: the first sending module 706 of the first node B to the second node B And sending a handover request message, where the request message carries the multiple switched keys. Preferably, in the embodiment described in the preceding paragraph, after the first sending module 706 of the first node B sends the handover request message to the second node B, the second node B switches from the multiple The key selects a key as the key used after the handover; the second node B 4 sends the selected key to the first node B; the second sending module 708 of the first node B The information of the component carrier corresponding to the selected key is sent to the UE; the UE calculates the switched key by using the information of the received component carrier as an input parameter; the UE is on the selected component carrier. Sending a handover confirmation message to the second node B, where the UE encrypts the handover confirmation message by using the switched key. Preferably, in the embodiment that the first node B selects the multiple component carriers, after the first node B sends a handover request message to the second node B, the first node B The second sending module 708 sends the information of the selected multiple component carriers to the UE; the UE selects information of one component carrier from the received information of the multiple component carriers, and uses the information of the component carrier as The input parameter is used to calculate the key after the handover; the UE sends a handover confirmation message to the second node B on the selected component carrier, where the UE passes the switched key pair. Switch the confirmation message for encryption. Preferably, in the embodiment described in the preceding paragraph, after the second Node B receives the handover confirmation message from the UE, the second node B selects the plurality of switched keys received in sequence. A key decrypts the handover confirmation message until the decryption is successful, and the key used when the decryption succeeds is determined as the switched key. With this embodiment, the interaction of security information can be successfully implemented. Preferably, in all the foregoing embodiments, the selecting module 702 of the first Node B selects one or more component carriers from the component carriers of the carrier aggregation cell managed by the second Node B in one of the following manners: a carrier managed by the first node B from the terminal UE to the second node B Selecting one or more component carriers with the best signal quality in the measurement reporting information of the component carriers of the aggregated cell; or selecting, by the first Node B, a list of working carriers in the carrier aggregation cell managed by the second Node B a component carrier; or the first node B selects a first carrier from component carriers of the carrier aggregation cell managed by the second node B according to a preset selection policy. The above-mentioned interaction device of the security information can implement the interaction of the security information by using any one of the foregoing method embodiments, and details are not described herein again. In summary, the interaction device of the security information according to the embodiment of the present invention, through the interaction of the component carrier information and other parameters, enables the UE and the eNodeB on the handover target side to obtain the same new security key after handover. It is compatible with the current LTE handover process, facilitating the smooth upgrade of the network and ensuring the security of handover to the carrier aggregation cell. It should be noted that the steps shown in the flowchart of the accompanying drawings may be performed in a computer system such as a set of computer executable instructions, and, although the logical order is shown in the flowchart, in some cases, The steps shown or described may be performed in an order different than that herein. Obviously, those skilled in the art should understand that the above modules or steps of the present invention can be implemented by a general-purpose computing device, which can be concentrated on a single computing device or distributed over a network composed of multiple computing devices. Alternatively, they may be implemented by program code executable by the computing device, such that they may be stored in the storage device by the computing device, or they may be separately fabricated into individual integrated circuit modules, or they may be Multiple modules or steps are made into a single integrated circuit module. Thus, the invention is not limited to any specific combination of hardware and software. The above is only the preferred embodiment of the present invention, and is not intended to limit the present invention, and various modifications and changes can be made to the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the scope of the present invention are intended to be included within the scope of the present invention.

Claims

A method for interacting security information, comprising:

The first node B selects one or more component carriers from component carriers of the carrier aggregation cell managed by the second node B;

The first node B calculates the key after switching by using the information of the selected component carrier as an input parameter;

The first node B sends a handover request message to the second node B, where the request message carries the switched key;

The first node B sends the information of the selected component carrier to the terminal UE, so that the UE calculates the received key by using the received information of the selected component carrier as an input parameter.

The method according to claim 1, wherein the handover request message includes information of the selected component carrier, where the information of the component carrier includes at least one of the following: corresponding to the selected component carrier Physical cell identity and downlink carrier frequency.

The method according to claim 1, wherein after the first node B sends the information of the selected component carrier to the terminal UE, the method further includes:

Determining, by the UE, the received information of the selected component carrier as an input parameter to the switched key;

The UE sends a handover confirmation message to the second node B on the selected component carrier, where the UE encrypts the handover confirmation message by using the switched key.

The method according to claim 1, wherein the handover request message includes a global identifier of a carrier aggregation cell managed by the second node B.

The method according to claim 4, wherein when the first node B sends the information of the selected component carrier to the terminal UE, the method further includes:

The first node B sends the global identifier to the UE;

The UE calculates the key after the handover by using the global identifier as an input parameter; The UE sends a handover confirmation message encrypted by the switched key to the second node B. The method according to claim 1, wherein when the first node B selects a plurality of the component carriers,

The first node B calculates the information of the selected component carrier as an input parameter, and the key after the handover includes:

The first node B sequentially calculates information of the selected one component carrier as an input parameter to obtain a switched key corresponding to the component carrier;

The sending, by the first node B, the handover request message to the second node B includes:

The first node B sends a handover request message to the second node B, where the request message carries the multiple switched keys. The method according to claim 6, wherein the transmitting, by the first Node B, the information of the selected component carrier to the terminal UE comprises:

The second node B selects a key from the plurality of switched keys as a key used after the handover;

The second node B sends the selected key to the first node B;

The first node B sends information about a component carrier corresponding to the selected key to

UE;

The UE calculates the converted key by using the information of the received component carrier as an input parameter;

The UE sends a handover confirmation message to the second node B on the selected component carrier, where the UE encrypts the handover confirmation message by using the switched key. The method according to claim 6, wherein the transmitting, by the first Node B, the information of the selected component carrier to the terminal UE comprises:

The first node B sends information of the selected multiple component carriers to the UE;

The UE selects information of one component carrier from the received information of the multiple component carriers, and calculates information of the component carrier as an input parameter to obtain the switched key; The UE sends a handover confirmation message to the second node B on the selected component carrier, where the UE encrypts the handover confirmation message by using the switched key.

The method according to claim 8, wherein after the second node B receives the handover confirmation message from the UE, the method further includes:

The second node B sequentially selects one of the plurality of switched keys to decrypt the handover confirmation message until the decryption is successful, and determines the key used when the decryption succeeds. The key after the switch.

The method according to claim 1, wherein the first Node B selects one or more component carriers from the component carriers of the carrier aggregation cell managed by the second Node B in one of the following manners, including: :

The first node B selects one or more component carriers with the best signal quality from the measurement information of the component carrier of the carrier aggregation cell managed by the second node B by the UE; or

The first node B selects a first component carrier from a working carrier list in a carrier aggregation cell managed by the second node B; or

The first node B selects a first carrier from component carriers of the carrier aggregation cell managed by the second node B according to a preset selection policy.

11 A method for interacting security information, comprising:

The first node B sends a handover request message to the second node B, where the handover request message carries parameter information for calculating a key used after the handover, where the parameter information includes key information or a next value NH;

The second Node B selects information of one or more component carriers from the component carriers of the carrier aggregation cell that it manages, and calculates the handover according to the information of the selected component carrier and the parameter information carried in the handover request message. Key used later;

The second Node B sends the information of the selected component carrier and the parameter information to the terminal UE, so that the UE calculates the used after the handover according to the information of the selected component carrier and the parameter information. Key.

The method according to claim 11, wherein after the UE calculates the key used after the handover according to the information of the selected component carrier and the parameter information, the method further includes: The UE sends a handover confirmation message to the second node B on the selected component carrier, where the UE encrypts the handover confirmation message by using the switched key.

An interaction device for the security information, is located in the first node B, and is used to implement the interaction of the security information in the process of switching to the carrier aggregation cell, wherein the interaction device includes: a selection module, configured to Selecting one or more component carriers from component carriers of the carrier aggregation cell managed by the second Node B;

a processing module, configured to calculate, by using information of the selected component carrier as an input parameter, a switched key;

a first sending module, configured to send a handover request message to the second node B, where the request message carries the switched key;

And a second sending module, configured to send information of the selected component carrier to the terminal UE, so that the UE calculates the switched key by using the information of the selected component carrier as an input parameter.

The device according to claim 13, further comprising:

a third sending module, configured to send a handover request message to the second node B, where the handover request message carries parameter information used to calculate a key used after the handover, where the parameter information includes key information or next The hop value is NH, so that the information of one or more component carriers in the component carrier of the carrier aggregation cell managed by the second node B and the parameter information carried in the handover request message are used to calculate the key used after the handover.

The device according to claim 13 or 14, further comprising:

a fourth sending module, configured to forward a handover confirmation message sent by the UE on the selected component carrier to the second node B, where the UE confirms the handover by using the switched key The message is encrypted.