WO2011054286A1

WO2011054286A1 - Key generation method, device and system

Info

Publication number: WO2011054286A1
Application number: PCT/CN2010/078359
Authority: WO
Inventors: 毕晓宇; 张冬梅; 马慧; 张爱琴; 王可
Original assignee: 华为技术有限公司
Priority date: 2009-11-03
Filing date: 2010-11-03
Publication date: 2011-05-12
Also published as: CN102056160B; CN102056160A

Abstract

A key generation method is provided. The method is adapted to the scene of the relay station handover, and includes the following steps: the source base station computes a key parameter K1 according to the key K between the source base station and the relay station and the identifier parameter of the destination base station, wherein the identifier parameter of the destination base station is used to uniquely identify the destination base station; the source base station sends the K1 to the destination base station, which is used for the destination base station to get the key K2 between the destination base station and the relay station according to the K1. A key generation system, and the base station and the relay station which are adapted to the scene of the relay station handover, are also provided. With the technical solution provided by each embodiment, the relay station may be enabled to generate the key used with the destination station, or the destination base station generates the key used with the relay station, thus the both sides can be enabled to smoothly communicate, and the safety of the communication is strengthened.

Description

Method, device and system for key generation

This application claims priority to Chinese Patent Application No. 200910110028.X, filed on November 3, 2009, entitled "A Method, Apparatus and System for Key Generation", the entire contents of which are hereby incorporated by reference. The citations are incorporated herein by reference. TECHNICAL FIELD The present invention relates to the field of communications technologies, and in particular, to a technique for key generation. BACKGROUND OF THE INVENTION With the increase in the coverage of wireless communication networks and the improvement in the requirements for the edge and area edges, relay technologies have been introduced in wireless communication systems. The introduction of Relay Nodes (RNs) can increase coverage of high-rate data transmissions, group mobility, temporary network deployment and extension, and enhance coverage at the cell edge. For example, an RN may be provided on a high-speed mobile vehicle, and the RN provides services for user equipment (UE) on a high-speed mobile vehicle, thereby avoiding frequent handover of a large number of UEs. In order to ensure the security of the communication, the message transmitted on the wireless link needs to be encrypted, and the encryption can also be applied to the integrity verification, so as to prevent the message from being illegally falsified or forged to ensure the security of the network. When the UE switches between different cells, the used key needs to be replaced with the key of the target cell, so that the key can be used to communicate with the target cell normally, that is, when the UE switches between different cells, the key needs to be performed. Update. However, after the RN is introduced, when the RN switches between different base stations, there is no RN obtained. The scheme of the key between the RN and the target base station does not have a scheme of how the target base station obtains the key between the RN and the target base station. Therefore, the RN cannot communicate with the target base station by using the key after the handover, thereby causing the RN and the target base station to There is a huge security risk between the inability to communicate or the communication between the RN and the target base station. Summary of the invention

The embodiment of the present invention provides a method for generating a key, which can be applied to a scenario of RN handover, so that when the RN performs handover between different base stations, the RN or the target base station can generate a key.

Embodiments of the present invention also provide a base station, a relay station, and a key generation system.

A method for generating a key according to an embodiment of the present invention is applicable to a scenario in which a relay station switches, and the method includes:

The source base station calculates a key parameter K1 according to the key K between the source base station and the relay station and the identifier parameter of the target base station, where the identifier parameter of the target base station is used to uniquely identify the target base station; the source base station sends the K1 to the a target base station, configured to obtain, by the target base station, a key Κ2 between the target base station and the relay station according to the K1.

Another method for generating a key according to an embodiment of the present invention is applicable to a scenario of a relay station handover, and the method includes:

The target base station receives a key parameter K1 sent by the source base station, where the K1 is obtained by the source base station according to a key 之间 between the source base station and the relay station;

The target base station generates a derivation parameter Ν2;

The target base station calculates a key Κ2 between the relay station and the target base station based on the K1 and the Ν2.

Another method for generating a key, which is provided by the embodiment of the present invention, is applicable to a scene of a relay station handover, and the method includes:

The relay station receives the security synchronization parameter N1, wherein the N1 is received from the target base station or the source base station; The relay station calculates a key K2 between the relay station and the target base station based on the N1.

A method for generating a key according to an embodiment of the present invention is applicable to a scene of a relay station handover, and the method includes:

The target base station receives the intermediate key sent by the target mobility management entity;

The target base station calculates a key Κ2 between the target base station and the relay station according to the ΝΚ and the identification parameter of the target base station, where the identifier parameter of the target base station is used to uniquely identify the target base station.

The relay station generates a parameter Q1, and the Q1 is used by the user equipment under the relay station to generate a key between the relay station and the user equipment according to the Q1;

The relay station sends the Q1 to the user equipment.

A base station is provided in a scenario for a relay station handover, and the base station includes:

a calculation module, configured to calculate a key parameter K1 according to a key 之间 between the base station and the relay station and an identifier parameter of the target base station, where the identifier parameter of the target base station is used to uniquely identify the target base station;

And a first sending module, configured to send K1 obtained by the computing module to the target base station, so that the target base station obtains a key Κ2 between the target base station and the relay station according to the K1.

Another base station provided by the embodiment of the present invention is applicable to a scenario of relay station handover, and the base station includes:

a receiving module, configured to receive a key parameter K1 sent by the source base station, where the K1 is obtained by the source base station according to a key between the source base station and the relay station;

Deriving a parameter module for generating a derivation parameter Ν2;

And a key module, configured to calculate a key 之间2 between the relay station and the base station according to K1 received by the receiving module and Ν2 generated by the retire parameter module. A relay station provided by the embodiment of the present invention is applicable to a scenario of relay station handover, and the relay station includes:

a receiving module, configured to receive a security synchronization parameter N1, where the N1 is sent by the target base station or the source base station to the relay station;

And a calculation module, configured to calculate a key K2 between the relay station and the target base station according to the N1 received by the receiving module.

a receiving module, configured to receive an intermediate key sent by the target mobility management entity;

And a calculation module, configured to calculate a key Κ2 between the base station and the relay station according to the identifier of the eNB and the base station, where the identifier of the base station is used to uniquely identify the base station.

A key generation system is provided in the scenario of a relay station handover, and the system includes:

The relay station is configured to receive a derivation parameter Ν2 sent by the target base station, and a security synchronization parameter N1 sent by the target base station or the source base station, and calculate a key Κ2 between the relay station and the target base station according to the N1 and Ν2.

According to the description of the foregoing technical solution, the embodiments of the present invention generate a key used by the source base station to generate a key used by the RN and the target base station, or enable the RN to obtain the RN and the target base station by sending a security synchronization parameter. The key, therefore, ensures that the RN can communicate with the target base station using the key, reducing the dropped call rate and improving communication security.

BRIEF DESCRIPTION OF THE DRAWINGS In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, a brief description of the drawings used in the embodiments or the prior art description will be briefly described below. The drawings are only some embodiments of the invention, and will be apparent to those of ordinary skill in the art In other words, other drawings can be obtained based on these drawings without paying for creative labor.

FIG. 1 is a schematic flowchart of a key generation method according to an embodiment of the present invention; FIG. 2b is a schematic flowchart of a key generation method according to an embodiment of the present invention; FIG. 2 is a schematic flowchart of a key isolation method according to another embodiment of the present invention; FIG. 2 is a schematic diagram of a key isolation method according to another embodiment of the present invention; FIG. 3 is a schematic flowchart of a key generation method according to another embodiment of the present invention; FIG. 3b is a schematic flowchart of a key generation method according to another embodiment of the present invention; FIG. 3 is a schematic flowchart of a key generation method according to another embodiment of the present invention; FIG. 3 is a schematic flowchart of a key generation method according to another embodiment of the present invention; FIG. 3 is a schematic flowchart of a key generation method according to another embodiment of the present invention; FIG. 3g is a schematic diagram of a key generation method according to another embodiment of the present invention; FIG. 4 is a schematic flowchart of a key generation method according to still another embodiment of the present invention; FIG. 5 is a key generation method according to still another embodiment of the present invention; FIG. 6 is a schematic structural diagram of a base station according to an embodiment of the present invention;

FIG. 7 is a schematic structural diagram of a base station according to an embodiment of the present disclosure;

FIG. 7b is a schematic structural diagram of a base station according to an embodiment of the present disclosure;

FIG. 7c is a schematic structural diagram of a base station according to an embodiment of the present disclosure;

FIG. 8 is a schematic structural diagram of a relay station according to an embodiment of the present invention;

FIG. 8b is a schematic structural diagram of a relay station according to an embodiment of the present disclosure;

FIG. 8c is a schematic structural diagram of a relay station according to an embodiment of the present invention;

FIG. 9 is a schematic structural diagram of a base station according to an embodiment of the present disclosure;

FIG. 10 is a schematic diagram of a key generation system according to an embodiment of the present invention.

detailed description In order to make the objects, the technical solutions, and the advantages of the present invention more comprehensible, the technical solutions provided by the present invention are further described in detail below with reference to the accompanying drawings. It is apparent that the described embodiments are only a part of the embodiments of the invention, and not all of the embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention.

A method for generating a key according to an embodiment of the present invention will be described in detail below with reference to the accompanying drawings. The method for generating a key is applicable to a scenario in which a relay station switches. The method includes the following steps: Step 101: The source base station determines that the relay station switches to the target base station.

The source base station receives the measurement report sent by the relay station, and according to the measurement report, the source base station decides to perform the handover.

In addition, the source base station may also determine that the relay station switches to the target base station according to other conditions.

In this embodiment, step 101 is an optional step, which is not necessarily performed.

Step 102: The source base station calculates a key parameter K1 according to the key K and/or the intermediate key NK between the base station and the relay station, and the identification parameter of the target base station.

The intermediate key 发送 is sent by the mobility management entity to the source base station.

The identification parameter of the target base station is used to uniquely identify the target base station. For example, the identity parameter of the target base station may be the ID of the target base station, and the target base station may be uniquely identified by the ID of the target base station.

The identification parameter of the target base station may also be the certificate of the target base station, or the ID of the target base station and the certificate of the target base station. In addition, in order to better identify the target base station, the identifier parameter of the target base station may include one of the following parameters or any combination thereof, including the ID of the target base station and/or the certificate of the target base station: Universal UMTS (Universal Mobile Telecommunication) System, Universal Mobile Telecommunications System) Land radio access network downlink absolute radio channel number (EARFCN-DL), cell identity (C-RNTI), user equipment ID, relay station and MME (Mobility Management Entity, MME) message count Value ( Message Count ).

After determining that the relay station switches to the target base station, the source base station performs step 102 to calculate K1. Step 103: The source base station sends K1 to the target base station.

The source base station transmits K1 to the target base station, so that the target base station can obtain the key K2 between the target base station and the relay station according to K1.

In step 103 of this embodiment, the source base station may send a handover request to the target base station, and the handover request carries K1 to complete the transmission of K1.

Further, as shown in FIG. 1b, the key generation method provided in this embodiment may further include: Step 104: The source base station sends the security synchronization parameter N1 corresponding to K1 to the target base station. According to K1, the source base station sends the N1 corresponding to the K1 to the target base station for synchronization by the target base station for subsequent calculation.

There is no specific execution order between step 103 and step 104, which may be performed sequentially or simultaneously. In this embodiment, the N1 may be sent to the target base station by using the handover request.

Step 105: The source base station receives N1 sent by the target base station.

After the source base station sends N1 to the target base station, the target base station carries N1 in the handover request response message and sends it to the source base station. The target base station may not change N1, that is, the N1 sent by the source base station is the same as the value of N1 sent by the target base station.

Step 106: The source base station sends N1 to the relay station.

The source base station may send the N1 to the relay station by using a handover command, and the source base station may not change the value of N1 in this step, that is, the N1 sent by the source base station through the handover command is the same as the value of N1 sent by the target base station.

In step 105 and step 106, for example, the source base station may implement the message sent by the target base station and forward the message, that is, the content carried in the message is transparent to the source base station.

Further, in this embodiment, step 104 to step 106 may not be performed, but the source base station directly transmits N1 corresponding to K1 to the relay station.

In this embodiment, the step 104, the step 105, and the step 106 are not necessary. The embodiment may include part or all of the above three steps, for example, only the step 106 is included, and the step 104 and the step 105 are not included. Further, in this embodiment, step 102 may obtain K1 by, for example, K and/or NK, and the identification parameter of the target base station as a parameter.

For example, the source base station obtains K1 according to K1=F[K, the ID of the target base station, EARFCN-DL], where F may be an arbitrary function, preferably an irreversible function.

For example, the source base station obtains according to K1=F[NK, target base station ID, EARFCN-DL]

Kl.

After the source base station calculates K1, the security synchronization parameter N1 corresponding to the K1 can be determined. For example, when the source base station calculates K1 using Κ, N1 corresponding to the K1 is 0. When the source base station calculates K1 using ΝΚ, N1 corresponding to the K1 is 1.

In this embodiment, different bearers on the Uu interface of the UE under the relay station can be aggregated according to different UEs, and the same bearer is transmitted on the Un interface. In this case, the keys used on the Un interface are different. The UEs are different, ie the keys on the Un interface are for each UE. The Un interface is an interface between the relay station and the base station, and the Uu interface is an interface between the relay station and the UE.

In this embodiment, the same QoS bearers of different UEs in the relay station can be aggregated according to the QoS, and the same bearer is transmitted on the Un interface. At this time, the key used on the Un interface has the same The different UEs of the QoS are the same, that is, the key on the Un interface is for all UEs. The “all UEs” described in the embodiments of the present invention refer to the different UEs with the same QoS.

It is also possible to distinguish the key on the Un interface for each UE or all UEs according to other factors. Moreover, the key on the Un interface may also be for each part of the UE for a part of the UE, and for all the UEs of the part for the other part of the UE. For the convenience of description in the following embodiments, only the case for each UE or for all UEs is taken as an example, and the case is partially implemented for each UE part for all UEs.

When the key between the source base station and the relay station is for each UE, the source base station calculates K1 corresponding to each UE according to step 102. Therefore, one source is generated on the source base station side. A list List1 formed by K1 corresponding to one UE. The source base station transmits the List1 to the target base station. In addition, N1 can also be different for different UEs. For the sake of clarity, the following embodiments are described by taking the same case for different UEs and N1 as an example.

Further, the source base station may also save the list List1.

When the key between the source base station and the relay station is for all UEs, the source base station transmits the calculated K1 to the target base station.

In this embodiment, the handover of the RN occurs between two base stations under the same MME, that is, the handover on the X2 interface. Therefore, the source base station and the target base station can be directly transmitted through the X2 interface.

With the key generation method provided in this embodiment, when the relay station performs handover, the source base station separately transmits parameters for calculating the new key to the relay station and the target base station, so that the target base station and the relay station can communicate using the generated key.

Further, when the function F of the calculation key is an irreversible function, key isolation between the target base station and the source base station may be implemented, that is, the target base station does not know the key used between the source base station and the relay station, thereby avoiding the target. When a base station has a security problem, the source base station also has a security risk.

The method for generating a key provided by another embodiment of the present invention is described in detail below with reference to FIG. 2a. The method can be applied to the scenario of the relay station switching. The technical solutions provided in the following embodiments can be applied to the scenario of the relay station switching, and are not described again.

Step 201: The target base station receives the key parameter K1 and the security synchronization parameter sent by the source base station.

Nl.

The target base station can receive K1 and N1 at the same time, and can also receive K1 and N1, respectively. For example, the target base station can obtain K1 and Nl by receiving a handover request.

For example, K1 may be a key parameter calculated by the source base station according to step 102 of the previous embodiment.

Step 202: The target base station determines a key K2 between the relay station and the target base station according to K1. In step 202, the target base station may directly use K1 as the key K between the relay station and the target base station, or may calculate the key Κ2 between the relay station and the target base station according to K1.

Step 203: The target base station sends N1 to the relay station.

After the target base station sends N1 to the relay station, the relay station can calculate Κ2 according to N1. In this embodiment, step 203 is an optional execution step.

In step 202, if the target base station directly uses K1 as the key Κ2 between the relay station and the target base station, the source base station can easily obtain the key used by the target base station, and in order to reduce the risk of security, The key isolation method shown in 2b performs key isolation. Step 204: The target base station receives the fresh parameter sent by the MME. For example, the target base station can receive the fresh parameters sent by the MME in the Path Switch flow. Step 205: The target base station calculates a key K2 between the target base station and the relay station according to the fresh parameter and K1.

Since the fresh parameter is transmitted to the target base station, and the target base station uses the fresh parameter to calculate the key, the source base station cannot know the key Κ2 between the target base station and the relay station. Further, if the key parameter K1 sent by the source base station is not a key between the source base station and the relay station, but the source base station calculates the key Κ and/or the intermediate key 之间 between the source base station and the relay station, and If the calculation function is irreversible, the target base station cannot know the key 之间 between the source base station and the relay station, thereby realizing the key isolation between the source base station and the target base station, so that the source base station/target base station does not affect the security problem when it occurs. Go to the target base station/source base station. Correspondingly, the same fresh parameter is sent to the RN, and the RN calculates the key between the relay station and the target base station according to the fresh parameter. And the MME sends a fresh parameter to the RN to trigger the RN to complete the handover process of the Intra Nonor eNB. In this embodiment, in order to solve the problem of key isolation, the key isolation method shown in FIG. 2c may also be used, that is, the target base station performs a derivation operation according to the key sent by the source base station, and generates a target base station and a relay station. Key between them, so that the source base station cannot know the target base station and relay The key between the stations. Step 206: The target base station generates a derivation parameter N2.

In this embodiment, the derivation parameter N2 is used for key isolation, and thus may be any parameter capable of functioning as a key isolation. For example, the derivation parameter N2 may be a random number generated by the target base station, or may be a combination of one or more of the following parameters: the ID of the C-RNTL UE and the message count value between the RN and the MME, etc. Is a combination of a random number and one or more of the above parameters.

When the key isolation method shown in Figure 2c is applied, there is no specific order between the target base station generating N2 and the target base station receiving K1, which may be performed sequentially or simultaneously.

Step 207: The target base station calculates a key between the target base station and the relay station according to N2 and K1.

K2. The target base station can be calculated according to K2=F, [K1, N2], where F can be the same as or different from the function F for calculating K1. F, can be a reversible function, or an irreversible function. Step 208: The target base station sends N2 to the relay station.

The target base station needs to transmit N2 to the relay station so that the relay station can calculate the key K2 between the target base station and the relay station based on N2.

When the target base station transmits Ν2, it can transmit with N1 or with N1. When the target base station transmits N1 and Ν2, for example, it can be sent by a handover request response. Since the derivation parameter Ν2 is generated by the target base station, the source base station cannot know the derivation parameter, so that the key between the target base station and the relay station cannot be known, and the effect of key isolation is achieved.

In this embodiment, the handover of the RN occurs between the target base station and the source base station under the same frame, so the source base station can directly transmit to the target base station through the Χ2 interface. The key generation method provided in this embodiment can be sent by the target base station to the source base station. The transmitted key generates a key between the target base station and the relay station, so that the target base station and the relay station can communicate using the generated key, avoiding dropped calls and improving call security.

A method for generating a key according to another embodiment of the present invention is described in detail below with reference to FIG. 3a. The method includes:

Step 301: The relay station receives the security synchronization parameter N1; the relay station receives the security synchronization parameter N1, which may be received from the source base station or may be received from the target base station. For example, when the relay station switches between the source base station and the target base station under the same MME, the target base station transmits the security synchronization parameter N1 to the source base station, and the source base station transmits N1 to the relay station, so the relay station receives N1 from the source base station. For example, when the relay station switches between the source base station and the target base station under different MMEs, the target MME sends the security synchronization parameter N1 to the target base station, and the target base station sends the N1 to the relay station, so the relay station receives the N from the target base station. 1. Step 302: The relay station calculates a key K2 between the relay station and the target base station according to N1. In this embodiment, the relay station can calculate the key Κ2 between the relay station and the target base station according to N1, and there may be different methods.

Referring to FIG. 3b, the relay station calculates the key K2 between the relay station and the target base station according to N1, which can be:

Step 3021: The relay station determines, according to N1, that the key K between the current relay station and the source base station is used for calculation, and calculates K2 according to the identification parameter of the target base station and K; or

Step 3022, the relay station calculates the intermediate key NK according to N1, and calculates K2 according to the identification parameter of the target base station and NK. Correspondingly, the target base station directly uses the key parameter K1 sent by the source base station as the key Κ2 between the relay station and the target base station. The method as shown in Figure 3b can be applied to the same RN The scenario of the handover between the eNBs in the MME may also be applicable to the scenario in which the RN switches between the eNBs in different MMEs.

Referring to FIG. 3c, the relay station calculates the key K2 between the relay station and the target base station according to N1, and may also be:

Step 3023, the relay station determines to use the key K between the relay station and the source base station according to N1 to calculate, and calculates the intermediate parameter L according to the identification parameter of the target base station and K, and/or step 3024, the relay station calculates the intermediate key NK according to N1. And calculating the intermediate parameter L according to the identification parameter of the target base station and NK;

In step 3025, the relay station calculates K2 based on the L and the fresh parameters generated by the MME. Correspondingly, the target base station is also calculated by using the key parameter K1 sent by the source base station and the fresh parameter generated by the Κ2, so that the source base station cannot know the key Κ2 used between the target base station and the relay station to implement key isolation.

Referring to FIG. 3d, the relay station calculates a key 中继2 between the relay station and the target base station according to N1, and may also be:

Step 303: The relay station receives a derivation parameter Ν2, where Ν2 is generated by the target base station and sent to the relay station;

Step 3026, the relay station determines to use the key 之间 between the relay station and the source base station according to N1, and calculates an intermediate parameter according to the identification parameter of the target base station and Κ; or, in step 3027, the relay station calculates the intermediate key 根据 according to N1, and Calculating the intermediate parameter according to the identification parameter of the target base station and ΝΚ;

In step 3028, the relay station calculates Κ2 based on Μ and Ν2. In this embodiment, there is no specific execution order between step 301 and step 303, which may be performed sequentially or simultaneously. Correspondingly, the target base station generates the derivation parameter N2, and calculates the intermediate parameter M by using the key parameter K1 sent by the source base station, and then calculates K2 by using M and N2, so that the source base station cannot know the use between the target base station and the relay station. Key Κ 2, implement key isolation. Further, the key generation method provided in this embodiment may further include generating a key between the relay station and the user equipment, that is, generating a key on the Uu interface between the relay station and the user equipment. In this embodiment, the key on the Uu interface may or may not be related to the key between the relay station and the target base station. When relevant, when the key between the relay station and the target base station is generated, that is, when the key on the Un interface is generated, the key on the Uu interface needs to be generated. When it is irrelevant, the key on the Un interface is generated. The key on the Uu interface can be generated without using the original key. Of course, a new key can also be generated. The key generation on the Uu interface when the key on the Uu interface is related to the key on the Un interface in this embodiment is described in detail with reference to FIG. 3e.

Step 304, the relay station generates a parameter Q1. The parameter Q1 is used by the UE under the relay station to generate a key between the relay station and the user equipment, and can also be used by the relay station to generate a key between the relay station and the user equipment. In this embodiment, the manner of generating Q1 is not limited, that is, Q1 may be randomly generated by the relay station, for example, or may be generated according to a function F. Wherein, F" may be an invertible function or an irreversible function. When the function F" is a function of the relationship between the key on the Un interface and the key on the Uu interface, Q 1 may be, for example, Q1=F"[N1]. In this embodiment, other parameters may also be used to generate Q1, such as the ID of the user equipment, the base station ID, the cell ID, or the number of messages. Step 305: The relay station sends the parameter Q1 to the UE.

After the relay station generates the parameter Q1, the Q1 may be sent to the user equipment for the UE to complete the generation of the key on the Uu interface according to Q1. It has been explained in the above embodiments that the key on the Un interface may be for each UE, also It can be for all UEs.

Further, in this embodiment, there are two different implementation manners in step 304 and step 305, which are described in detail below with reference to FIGS. 3f and 3g.

Step 3041, the relay station generates a different parameter Q1 for each UE under the relay station;

The relay station generates different parameters Q1 for each UE, that is, each UE has its own corresponding Q1.

Resource Control, RRC ) Connection reconfiguration message.

The RRC connection reconfiguration message carries the parameter Q1 generated in step 3041. A person skilled in the art can understand that the parameter 3051 does not necessarily carry the parameter Q1 through the RRC connection reconfiguration message, but also carries the parameter Q1 for other messages sent for each UE.

Through the above method, each UE can obtain its own parameter Q1, and generate a key on the Uu interface according to Q1. For example, a new key on the Uu interface is calculated according to F*=[Ku, Q1], where Ku is The original key on the Uu interface, where F* can be either a reversible function or an irreversible function.

Therefore, in the corresponding embodiment, step 3061 may be further included, and the relay station calculates a key between the relay station and each user equipment under the relay station according to the parameter Q1 generated in step 3041.

Step 3042, the relay station generates a parameter Q1, wherein the Q1 is the same for all UEs under the relay station.

In this embodiment, although all UEs correspond to the same Q1, each UE may generate different keys according to the same Q1, for example, the calculated starting parameters are different, or the calculation formulas used are different. Step 3052: The relay station periodically broadcasts a system message. Carry Ql in the system message of the periodic broadcast. In this embodiment, a system for periodic broadcast The message is, for example, an SIB (System Information Block) or an MIB (Master Information Block). This embodiment does not limit periodic broadcast system messages to MIBs, SIBs, but also other periodic broadcast system messages.

For example, if parameter Q 1 is shorter, Q 1 can be placed in the MIB for transmission. Because MIB broadcasts frequently, when Q1 is short, it can be sent in the MIB. If Q1 is long, sending it in the MIB may cause interference or waste of resources. When Q1 is sent in the MIB, for example, two IEs can be added to the MIB. One IE indicates whether the key on the Uu interface is updated (regenerated), and an IE indicates the specific value of Q1. When the UE learns that the key on the Uu interface is updated by the IE indicating whether the key on the Uu interface is updated, the specific value of Q1 is read.

For example, Q1 can be placed in SIB2 for transmission. Similarly, two IEs can be added to the SIB. One IE indicates whether the key on the Uu interface is updated, and the other IE indicates the specific value of Q1. When the UE updates the key on the Uu interface, it reads the specific value of Q1 in SIB2.

For example, you can also put Q1 into the newly created SIBn for transmission. Similarly, two IEs can be added to the SIBn, one IE indicating whether the key on the Uu interface is updated, and the other IE indicating the specific value of Q1. When the UE updates the key on the Uu interface, it reads the specific value of Q1 in SIBn.

For example, an IE may be added to the MIB, and the IE indicates whether the key on the Uu interface is updated, and an IE is added to the SIB2 or SIBn to indicate the specific value of the Q1. In this way, the key can be broadcast to the UE in time when the key is updated on the Uu interface, and the MIB does not carry too many parameters to reduce interference or reduce signaling overhead.

Through the above method, the UE may obtain the parameter Q1, and generate a key on the Uu interface according to Q1, for example, calculate a new key on the Uu interface according to F**=[Ku, Q1], where Ku is on the Uu interface. The original key, where F** can be either a reversible function or an irreversible function.

Therefore, in the corresponding embodiment, step 3062 is further included, and the relay station calculates a key between the relay station and all user equipments under the relay station according to the parameter Q1 generated in step 3042. A method for generating a key according to still another embodiment of the present invention is described in detail below with reference to FIG. The method includes:

Step 401: The target base station receives the intermediate key NK sent by the target MME.

In this embodiment, the relay station switches between base stations under different MMEs. The relay station sends a measurement report to the source base station. The source base station determines that the relay station performs handover according to the measurement report, and sends a handover request to the source MME. The source MME forwards the handover request to the target MME. Upon receiving the handover request, the target MME increments the security synchronization parameter N1 by 1, and generates an intermediate key NK. The target MME sends the N1 to the target base station by using the handover request message. The handover request message may carry not only the NK but also the N1, where N1 is the N1 added by the target MME. That is, the embodiment further includes the target base station receiving the N1 sent by the target MME. The target base station receives N1 or receives NK at the same time, and can also perform sequential execution without specific restrictions.

Step 402: The target base station calculates a key K2 between the target base station and the relay station according to the NK and the identity parameter of the target base station.

For a specific implementation of step 402, reference may be made to the description of the above embodiment. For example, the target base station obtains K2 according to K2 = F[NK, ID of the target base station, EARFCN-DL], where F can be any function, preferably an irreversible function.

Step 403: The target base station sends N1 to the relay station, where the relay station calculates Κ2. Step 403 is an alternative.

In this embodiment, the method of calculating the Κ2 by the relay station is not specifically described. The method for calculating the Κ2 by the relay station can be specifically referred to the description of the above embodiment. There is no specific execution order between step 403 and step 402, which may be performed sequentially or simultaneously.

Further, in this embodiment, the interface switched by the relay station is an S1 interface. With the key generation method provided in this embodiment, the target base station can calculate according to the obtained ΝΚ Obtaining a key on the new Un interface, and transmitting the acquired N1 to the relay station, so that the relay station can also calculate the key on the Un interface according to N1, thereby realizing the generation of a key between the relay station and the target base station, so that the relay station can Smooth communication with the target base station improves call security.

In this embodiment, the identifier of the target base station can be referred to the description of the foregoing embodiment, and details are not described herein.

A key generation method provided by still another embodiment of the present invention will be described in detail below with reference to FIG. The method includes:

Step 501: The relay station generates a parameter Q1.

The parameter Q1 is used by the user equipment under the relay station to generate a key between the relay station and the user equipment.

Step 502: The relay station sends Q1 to the user equipment.

In this embodiment, the generation of the key on the Uu interface by the relay station may be independent of the generation of the key on the Un interface, or may depend on the generation of the key on the Un interface.

In this embodiment, when the key generation on the Uu interface is independent of the key generation on the Un interface, the key generation on the Un interface may depend on the key generation on the Uu interface. That is, the key on the Un interface is derived from the key on the Uu interface.

In this embodiment, when the key generation on the Uu interface is independent of the key generation on the Un interface, the key generation on the Un interface does not affect the key used on the Uu interface, so that when the relay station performs the handover, It does not affect the UE under the relay station, and can better follow the derivation level of the key on the access link, and is better compatible with the user equipment of each version.

In this embodiment, the steps 501 and 502 may also be different for the UE on the Un interface, or for all UEs. The specific implementation may refer to the method described in FIG. 3f, 3g.

Further, in this embodiment, the generation of a key on the Un interface may also be included, and the specific implementation side The method can be referred to the method shown in Figures 3a, 3b, 3c, 3d. With the method for generating a key provided by the embodiment, the relay station can perform key generation autonomously, or generate a key according to parameters provided by the target base station, thereby implementing a smooth connection between the relay station and the user equipment, and between the relay station and the target base station. Secure communication. A base station 60 according to an embodiment of the present invention will be described in detail below with reference to FIG. The base station 60 includes: a handover module 601, configured to determine that the relay station switches to the target base station; and a calculation module 602, configured to: after the handover module 601 determines the handover, according to the key K and/or the intermediate key NK between the base station and the relay station And the identification parameter of the target base station calculates the key parameter K1; the first sending module 603 is configured to send the K1 obtained by the calculation module 602 to the target base station, so that the target base station obtains K2 according to the K1. The switching module 601 can determine, according to the measurement report sent by the relay station, that the relay station switches to the target base station. In this embodiment, the switching module 601 is an optional solution, that is, the base station 60 may include only the computing module 602 and the first sending module 603. At this time, the calculation module 602 is configured to calculate the key parameter K1 according to the key Κ and/or the intermediate key 之间 between the base station and the relay station, and the identification parameter of the target base station. With the base station 60 provided in this embodiment, the key parameter K1 can be calculated when the relay station is switched, and K1 is sent to the target base station, so that the target base station can obtain the key Κ2 between the target base station and the relay station according to the K1 calculation. Generation of the target base station key.

Further, the base station 60 provided by this embodiment further includes: a second sending module 604, configured to send the security synchronization parameter N1 corresponding to K1 to the target base station; and a receiving module 605, configured to receive the N1 sent by the target base station, and third The sending module 606 is configured to send the N1 received by the receiving module 605 to the relay station, so that the relay station calculates the key Κ2 between the relay station and the target base station. In this In the embodiment, the N1 sent by the second sending module 604 and the N1 received by the receiving module 605 are, for example, the same N1.

Further, the base station 60 provided in this embodiment may further include: a generating module 607, configured to generate a security synchronization parameter N1, where the N1 corresponds to K1, and the specific correspondence may refer to the foregoing method embodiment. At this time, the second sending module 604 is configured to send the N1 generated by the generating module 607 to the target base station.

Further, the base station 60 provided in this embodiment may further include: a fourth sending module 608, configured to directly send the N1 corresponding to K1 to the relay station.

Further, in this embodiment, the calculation module 602 includes one or any combination of the following: a first calculation unit 6021, configured to use a key K between the base station 60 and the relay station, and an identifier of the target base station The parameter calculation is performed to obtain the key parameter K1; the second calculating unit 6022 is configured to calculate the key parameter K1 according to the intermediate key ΝΚ and the identification parameter of the target base station; the third calculating unit 6023 is configured to use the base station 60 and The key K, the intermediate key 之间 between the relay stations, and the identification parameter of the target base station are calculated to obtain a key parameter K1;

Further, in this embodiment, when different user equipments of the relay station correspond to different K1, the first sending module 603 is configured to send a list formed by K1 corresponding to each user equipment under the relay station to the target base station. The base station 60 provided in this embodiment may be used, for example, to perform the key generation method provided in the foregoing method embodiments. For the specific implementation, reference may be made to the foregoing method embodiments. Another base station provided by the embodiment of the present invention is described in detail below with reference to FIG. 7a. The base station includes:

The receiving module 701 is configured to receive the key parameter K1 sent by the source base station, and the key module 702 is configured to determine the key K2 between the relay station and the base station according to the K1 received by the receiving module 701. The base station provided in this embodiment may generate the base station according to the parameter sent by the source base station. The key, so that the relay station and the base station can use the generated key for more secure communication. Further, in this embodiment, the receiving module 701 is further configured to receive the N1 sent by the source base station, and the base station further includes a second sending module 703, configured to send the N1 received by the receiving module 701 to the relay station, so that the relay station Calculate K2 according to N1. Further, as shown in FIG. 7b, in this embodiment, the receiving module 701a may be configured to receive the fresh parameters sent by the MME, and K1 and N1. At this time, the key module 702a is configured to calculate K2 according to the fresh parameters received by the receiving module 701a and K1. Further, as shown in FIG. 7c, in this embodiment, the base station may further include a derivation parameter module 704, configured to generate a derivation parameter N2. Correspondingly, the key module 702b is configured to calculate K2 according to N2 generated by the derivation parameter module 704 and K1 received by the receiving module 701. The corresponding base station may further include a first sending module 705, configured to send the Ν2 generated by the retard parameter module 704 to the relay station.

The base station provided by this embodiment can be used, for example, to perform the key generation method provided in the foregoing method embodiment. For the specific implementation, reference may be made to the foregoing method embodiment. A relay station 80 according to an embodiment of the present invention will be described in detail below with reference to FIG. 8a. The relay station 80 includes: a receiving module 801, configured to receive the security synchronization parameter N1; and a calculation module 802, configured to calculate a key K2 between the current relay station and the target base station according to the N1 received by the receiving module 801. The relay station 80 provided in this embodiment can calculate the key between the relay station and the target base station according to the received N1, so that the key can be used to communicate with the target base station, thereby ensuring smooth communication between the relay station and the target base station, and the Communication is safe and reliable. Further, as shown in FIG. 8b, in this embodiment, the relay station 80 may further include: a receiving module 801a for receiving the derivation parameter N2 and the security synchronization parameter N1; and a calculation module 802a for receiving the N1 according to the receiving module 801a. And N2 calculates K2, or according to the receiving module 801a The received N1 calculates K2. Further, as shown in FIG. 8c, in this embodiment, the calculation module 802a may include, for example, a first calculating unit 8021, configured to determine, according to the N1 received by the receiving module 801, a key used between the relay station 80 and the source base station. K calculates and calculates K2 according to the identification parameter of the target base station and K; and/or, the second calculating unit 8022 is configured to calculate the intermediate key NK according to the N1 received by the receiving module 801, and according to the identification parameter of the target base station and the NK Calculate K2. Further, the calculating module 802a may include, for example, a third calculating unit 8023, configured to determine, according to the N1 received by the receiving module 801, using the key K between the relay station 80 and the source base station, and according to the identification parameter of the target base station and K calculates the intermediate parameter L; and/or, the fourth calculating unit 8024 is configured to calculate the intermediate key NK according to the N1 received by the receiving module 801, and calculate the intermediate parameter L according to the identification parameter of the target base station and NK. Moreover, the calculation module 802 may further include: a fifth calculation unit, configured to calculate K2 according to the L calculated by the third calculation unit 8023 or the fourth calculation unit 8024 and the fresh parameter. In this embodiment, the fresh parameters are generated by ΜΜΕ. Further, the calculating module 802a may include, for example, a sixth calculating unit 8026, configured to determine, according to the N1 received by the receiving module 801, using the key K between the relay station 80 and the source base station, and according to the identification parameter of the target base station and K calculates the intermediate parameter M; and/or the seventh calculating unit 8027, for calculating the intermediate key NK according to the N1 received by the receiving module 801, and calculating the intermediate parameter M according to the identification parameter of the target base station and NK. The calculation module 802a may further include: an eighth calculation unit 8028, configured to calculate K2 according to the calculation calculated by the sixth calculation unit 8026 or the seventh calculation unit 8027 and the N2 received by the receiving module 801a. Further, the relay station 80 may further include a generating module 803, configured to generate a parameter Q1, where the Q1 is used by the UE under the relay station 80 to generate a key between the local relay station 80 and the UE, and the sending module 804 is configured to generate a module. The Q1 generated by 803 is sent to the above UE.

Further, in this embodiment, the generating module 803 may include, for example, a first generating unit 8031, configured to generate a parameter Q1 for each UE under the relay station 80, that is, for different The UE generates the parameter Q 1 respectively. The sending module 804 may include, for example, a first sending unit 8041, configured to send Q1 to the user equipment corresponding to the Q1 by using an RRC connection reconfiguration message.

Further, in this embodiment, the generating module 803 may include, for example, a second generating unit.

8032, configured to generate a parameter Q1 for all UEs in the relay station 80, that is, the parameters Q1 of all UEs in the relay station 80 are the same, so a Q1 is generated; the sending module 804 includes, for example, a second sending unit 8042, Q1 is sent to the UE through a system message periodically broadcast.

Further, in this embodiment, the generating module 803 may include, for example, a third generating unit.

8033, configured to randomly generate a parameter Q1; and/or, a fourth generating unit 8034, configured to generate a parameter Q1 according to N1. The relay station 80 provided in this embodiment may be used to switch between different base stations in the same MME, and may also be applied to scenarios in which different base stations switch between different base stations. The relay station 80 provided in this embodiment can be used, for example, to perform the key generation method provided in the foregoing method embodiment. For the specific implementation, reference may be made to the foregoing method embodiment. A base station according to an embodiment of the present invention is described in detail below with reference to FIG. The base station includes: a receiving module 901, configured to receive an intermediate key NK sent by the MME; and a calculating module 902, configured to calculate a key K2 between the base station and the relay station according to the NK received by the receiving module 901 and the identifier parameter of the base station. Further, in this embodiment, the receiving module 901 is further configured to receive the N1 sent by the UI. The corresponding base station further includes a sending module 903, configured to send the N1 received by the receiving module 901 to the relay station, so that the relay station calculates Κ2 according to N1. The base station provided by this embodiment may generate a key between the base station and the relay station according to the intermediate key, and send a security synchronization parameter to the relay station, so that the relay station can also generate a key between the relay station and the base station, thereby The generated key can be used by the relay station and the base station Communication ensures smooth communication between the relay station and the target base station and improves communication security. The base station provided by this embodiment can be used, for example, to perform the key generation method provided in the foregoing method embodiment. For the specific implementation, reference may be made to the foregoing method embodiment. The key generation system provided by the embodiment of the present invention will be described in detail below with reference to FIG. The system includes: a relay station 1001 for receiving a security synchronization parameter N1 transmitted by the target base station 1003 or the source base station 1002, and calculating a key K2 between the relay station 1001 and the target base station 1003 according to N1. The key generation system provided in this embodiment can be applied to a scenario in which a relay station switches between different base stations in the same network, and can also be applied to a scenario in which a relay station switches between different base stations. For example, when the relay station switches between different base stations under the same network, the security synchronization parameter sent by the source base station may be received, and when the relay station switches between different base stations, the security synchronization parameter sent by the target base station may be received.

Further, in this embodiment, the system may further include a target base station 1003 and/or a source base station 1002. The implementation of the target base station 1003 and the source base station 1002 can be referred to the above embodiment.

Further, in this embodiment, the relay station 1001 is further configured to receive the derivation parameter Ν2 sent by the target base station 1003, and calculate a key Κ2 between the relay station 1001 and the target base station 1003 according to the N1 and the Ν2.

Further, in this embodiment, the relay station 1001 is further configured to generate a parameter Q1, and send Q1 to the UE under the relay station 1001, where Q1 is used by the UE to calculate a key between the relay station 1001 and the UE.

Finally, it should be understood that those skilled in the art can understand that all or part of the process of implementing the above embodiments can be completed by a computer program to instruct related hardware, and the program can be stored in a computer readable. In the storage medium, the program, when executed, may include the flow of an embodiment of the methods as described above. The storage medium may be a magnetic disk, an optical disk, a read only memory (ROM) or a random access memory (RAM). Each functional unit in the embodiment of the present invention may be integrated into one processing module, or each unit may exist physically separately, or two or more units may be integrated into one module. The above integrated modules can be implemented in the form of hardware or in the form of software functional modules. The integrated modules, if implemented in the form of software functional modules and sold or used as separate products, may also be stored in a computer readable storage medium. The above-mentioned storage medium may be a read only memory, a magnetic disk or an optical disk or the like. The above specific embodiments are not intended to limit the present invention, and any modifications, equivalents, improvements, etc., which are included in the present invention, should be included in the present invention without departing from the principles of the present invention. Within the scope of protection.

Claims

Rights request

A method for generating a key, suitable for a handover of a relay station, the method comprising: the source base station according to a key K and/or an intermediate key NK between the source base station and the relay station, and The identification parameter of the target base station calculates a key parameter K1, wherein the identification parameter of the target base station is used to uniquely identify the target base station, and the intermediate key acquisition is sent by the mobility management entity; K1 is sent to the target base station, and the target base station obtains a key Κ2 between the target base station and the relay station according to the K1.

The method according to claim 1, wherein the method further comprises: the source base station transmitting a security synchronization parameter N1 corresponding to the K1 to the target base station, and receiving the sending by the target base station The N1, and send the N1 to the relay station, for the relay station to calculate a key Κ2 between the relay station and the target base station according to the N1;

Alternatively, the method further includes: the source base station directly transmitting the security synchronization parameter N1 corresponding to the K1 to the relay station.

The method according to claim 1 or 2, wherein the identifier of the target base station includes: an identifier ID of the target base station and/or a certificate of the target base station; or an identifier of the target base station The parameter includes: an ID of the target base station and/or a certificate of the target base station, and one or any combination of the following: an enhanced universal mobile communication system UMTS terrestrial radio access network downlink absolute radio channel number, cell identity C-RNTI , a user equipment ID, a message count value between the relay station and the mobility management entity.

4. A method for generating a key, which is applicable to a scenario in which a relay station switches, and is characterized in that The method includes: the target base station receives a key parameter K1 sent by the source base station, where the K1 is obtained by the source base station according to a key 之间 between the source base station and the relay station; the target base station generates a derivation parameter Ν2;

The method according to claim 4, after the target base station generates Ν2, the method further comprises: the target base station transmitting the Ν2 to the relay station, where the relay station is configured according to the relay station The Ν2 calculates the Κ2.

The method according to claim 4 or 5, wherein the method further comprises:

Receiving, by the target base station, a security synchronization parameter N1 sent by the source base station; the target base station sending the N1 to the relay station, where the relay station calculates the

Κ 2.

A method for generating a key, which is applicable to a scenario of relay station handover, wherein the method includes: the relay station receives a security synchronization parameter N1, wherein the N1 is received from a target base station or a source base station;

The relay station calculates a key between the relay station and the target base station according to the N1

Κ 2.

The method according to claim 7, wherein the method further comprises: the relay station receiving a derivation parameter Ν2, wherein the Ν2 is The target base station generates and sends to the relay station;

And calculating, by the relay station, the K2 according to the N1, comprising: the relay station calculating the Κ2 according to the N1 and the Ν2.

The method according to claim 8, wherein the relay station calculates a key Κ2 between the relay station and the target base station according to the N1 and the Ν2, including:

The relay station determines, according to the N1, that a key 之间 between the relay station and the source base station is used, and calculates an intermediate parameter 根据 according to the identifier parameter of the target base station and the 基站, or the relay station according to the N1 calculates an intermediate key ΝΚ, and calculates an intermediate parameter 根据 according to the identification parameter of the target base station and the ΝΚ;

The relay station calculates the Κ2 according to the Μ and the Ν2; wherein the identifier parameter of the target base station is used to uniquely identify the target base station.

The method according to any one of claims 7 to 9, wherein the method further comprises:

The relay station generates a parameter Q1, where the Q1 is used by the user equipment under the relay station to generate a key between the relay station and the user equipment according to the Q1;

The relay station transmits the Q1 to the user equipment.

A method for generating a key, suitable for a relay station handover scenario, the method comprising: the target base station receiving an intermediate key NK sent by the target mobility management entity;

The target base station calculates a key K2 between the target base station and the relay station according to the NK and the identifier parameter of the target base station, where the identifier parameter of the target base station is used to uniquely identify the target base station.

The method according to claim 11, wherein the method further comprises: The target base station receives the security synchronization parameter N1 sent by the target mobility management entity; the target base station sends the N1 to the relay station, and the relay station calculates the K2 according to the N1.

The method according to claim 11 or 12, wherein the identifier of the target base station includes: an identifier ID of the target base station and/or a certificate of the target base station; or, the target base station The identification parameter includes: an ID of the target base station and/or a certificate of the target base station, and one or any combination of the following: an enhanced universal mobile communication system UMTS terrestrial radio access network downlink absolute radio channel number, cell identifier C- The RNTI, user equipment ID, message count value between the relay station and the mobility management entity.

A method for generating a key, which is applicable to a scenario in which a relay station is switched, and the method includes:

The relay station generates a parameter Q1, where the Q1 is used by the user equipment under the relay station to generate a key between the relay station and the user equipment according to the Q1; the relay station sends the Q1 to the user equipment .

The method according to claim 14, wherein the relay station generates the parameter Q1, including:

The relay station randomly generates a parameter Q1; or the relay station generates a parameter Q1 according to the safety synchronization parameter N1, wherein the N1 is received from a source base station or a target base station.

16. The method of claim 14 wherein:

The relay station generates the parameter Q1, including: the relay station generates Q1 corresponding to each user equipment for each user equipment under the relay station; and the relay station sends the Q1 to the user equipment, including The relay station sends the Q1 corresponding to each user equipment to each user equipment by using a radio resource control connection reconfiguration message; Or the relay station generates the parameter Q1, including: the relay station generates a parameter Q1 for all user equipments under the relay station, where the Q1 is the same for all the user equipments; and the relay station uses the Q1 The sending to the user equipment includes: the relay station transmitting the Q1 to the all user equipments by periodically broadcasting a system message.

A scenario of a base station, suitable for relay station handover, wherein the base station comprises:

a calculation module, configured to calculate a key parameter K1 according to a key K and/or an intermediate key NK between the base station and the relay station, and an identifier parameter of the target base station, where the identifier parameter of the target base station is used for the unique identifier The target base station, the intermediate key 发送 is sent by the mobility management entity to the local base station; the first sending module is configured to send K1 obtained by the computing module to the target base station, so that the target base station is configured according to the target base station The K1 obtains a key Κ2 between the target base station and the relay station.

The base station according to claim 17, wherein the base station further comprises:

a second sending module, configured to send the security synchronization parameter N1 corresponding to the K1 to the target base station, the receiving module, configured to receive the N1 sent by the target base station, and a third sending module, configured to: The N1 received by the receiving module is sent to the relay station, so that the relay station calculates the key Κ2 between the relay station and the target base station; or the base station further includes:

And a fourth sending module, configured to directly send the security synchronization parameter N1 corresponding to the K1 to the target base station.

A base station, applicable to a relay station handover scenario, the base station includes: a receiving module, configured to receive a key parameter K1 sent by a source base station, where the K1 is The source base station is obtained according to the key K between the source base station and the relay station;

Deriving a parameter module for generating a derivation parameter N2;

And a key module, configured to calculate a key K2 between the relay station and the base station according to K1 received by the receiving module and N2 generated by the derivation parameter module.

The base station according to claim 19, wherein the base station further comprises: a first sending module, configured to send the Ν2 obtained by the retort parameter module to the relay station, so that the relay station is configured according to The Ν 2 gets the Κ 2

The base station according to claim 19 or 20, wherein the receiving module is further configured to receive the security synchronization parameter N1 sent by the source base station; and the base station further includes: a second sending module, And transmitting N1 received by the receiving module to the relay station, so that the relay station obtains the UI2 according to the N1.

A relay station, suitable for a relay station handover scenario, wherein the relay station includes: a receiving module, configured to receive a security synchronization parameter N1, where the N1 is sent by the target base station or the source base station to the relay station;

And a calculation module, configured to calculate a key Κ2 between the relay station and the target base station according to the N1 received by the receiving module.

The relay station according to claim 22, wherein the receiving module is further configured to receive a derivation parameter Ν2, wherein the Ν2 is generated by the target base station and sent to the relay station;

The calculating module is configured to calculate the Κ2 according to N1 and Ν2 received by the receiving module.

The relay station according to claim 22 or 23, wherein the relay station The method further includes: a generating module, configured to generate a parameter Q1, where the Q1 is used by the user equipment under the relay station to generate a key between the current relay station and the user equipment; and the sending module is configured to send the Q1 to the User equipment.

25, a base station, suitable for relay station switching scenarios, wherein the base station comprises: a receiving module, configured to receive an intermediate key NK sent by the target mobility management entity;

And a calculation module, configured to calculate a key K2 between the base station and the relay station according to the identifier of the NK and the base station, where the identifier of the local base station is used to uniquely identify the base station.

The base station according to claim 25, wherein the receiving module is further configured to receive a security synchronization parameter N1 sent by the target mobility management entity; and the base station further includes: a sending module, The N1 is sent to the relay station, so that the relay station calculates the Κ2 according to the N1.

A key generation system, which is applicable to a relay station handover scenario, the system includes: a relay station, configured to receive a derivation parameter Ν2 sent by the target base station, and send by the target base station or the source base station The security synchronization parameter N1 is calculated, and the key Κ2 between the present relay station and the target base station is calculated according to the N1 and the Ν2.

The system according to claim 27, wherein the relay station is further configured to generate a parameter Q1, and send the Q1 to a user equipment under the relay station, where the Q1 is used by the user equipment according to The Q1 generates a key between the relay station and the user equipment.