WO2011142568A2 - Method and system for positioning mobile station in handover procedure - Google Patents
Method and system for positioning mobile station in handover procedure Download PDFInfo
- Publication number
- WO2011142568A2 WO2011142568A2 PCT/KR2011/003440 KR2011003440W WO2011142568A2 WO 2011142568 A2 WO2011142568 A2 WO 2011142568A2 KR 2011003440 W KR2011003440 W KR 2011003440W WO 2011142568 A2 WO2011142568 A2 WO 2011142568A2
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- gateway
- henb
- target
- sends
- ncc
- Prior art date
Links
- 238000000034 method Methods 0.000 title claims abstract description 133
- 230000008569 process Effects 0.000 claims abstract description 61
- 230000008859 change Effects 0.000 claims description 9
- 230000004048 modification Effects 0.000 claims description 9
- 238000012986 modification Methods 0.000 claims description 9
- 238000004891 communication Methods 0.000 claims description 4
- 210000004027 cell Anatomy 0.000 description 48
- 238000007796 conventional method Methods 0.000 description 9
- 238000010586 diagram Methods 0.000 description 8
- 230000007246 mechanism Effects 0.000 description 7
- 238000010295 mobile communication Methods 0.000 description 6
- 230000004044 response Effects 0.000 description 6
- 210000004754 hybrid cell Anatomy 0.000 description 5
- 230000011664 signaling Effects 0.000 description 2
- 101100059553 Caenorhabditis elegans cdk-1 gene Proteins 0.000 description 1
- GVQYIMKPSDOTAH-UHFFFAOYSA-N NCC 1 Natural products CC1=C(C=C)C(=O)NC1CC1=C(C)C(CCC(O)=O)=C(C2C=3NC(CC4=C(C(C)=C(C=O)N4)CCOC(=O)CC(O)=O)=C(C)C=3C(=O)C2C(O)=O)N1 GVQYIMKPSDOTAH-UHFFFAOYSA-N 0.000 description 1
- 238000010276 construction Methods 0.000 description 1
- 230000000694 effects Effects 0.000 description 1
- 238000005516 engineering process Methods 0.000 description 1
- VJYFKVYYMZPMAB-UHFFFAOYSA-N ethoprophos Chemical compound CCCSP(=O)(OCC)SCCC VJYFKVYYMZPMAB-UHFFFAOYSA-N 0.000 description 1
- 230000007774 longterm Effects 0.000 description 1
- 238000012544 monitoring process Methods 0.000 description 1
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
- H04W12/041—Key generation or derivation
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
- H04W12/043—Key management, e.g. using generic bootstrapping architecture [GBA] using a trusted network node as an anchor
- H04W12/0431—Key distribution or pre-distribution; Key agreement
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W36/00—Hand-off or reselection arrangements
- H04W36/24—Reselection being triggered by specific parameters
- H04W36/32—Reselection being triggered by specific parameters by location or mobility data, e.g. speed data
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W36/00—Hand-off or reselection arrangements
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W84/00—Network topologies
- H04W84/02—Hierarchically pre-organised networks, e.g. paging networks, cellular networks, WLAN [Wireless Local Area Network] or WLL [Wireless Local Loop]
- H04W84/04—Large scale networks; Deep hierarchical networks
- H04W84/042—Public Land Mobile systems, e.g. cellular systems
- H04W84/045—Public Land Mobile systems, e.g. cellular systems using private Base Stations, e.g. femto Base Stations, home Node B
Definitions
- the present invention relates to mobile communication technologies. More particularly, the present invention relates to a method for obtaining a secure key.
- a Closed Subscriber Group should be formed with multiple wireless resource management entities for a specific user group.
- the wireless resource entities may include network entities in the wireless access network for managing wireless resources and access of the User Equipment (UE) and the network entities may include base stations or cells in various mobile communication systems. For instance, all users of a corporation or a school belong to a specific user group, and for the user group, a CSG is formed with multiple wireless resource management entities for providing special access services. For a specific user group, it is a common that the CSG is formed with multiple wireless resource management entities.
- LTE Long Term Evolution
- SAE System Architecture Evolution
- FIG. 1 is a schematic diagram illustrating a structure of an LTE system according to the related art.
- wireless resource management entities include Evolved NodeBs (eNBs) 102 and Home Evolved NodeBs (HeNBs) 103, and may further include a HeNB Gateway (HeNB GW) 104, as required.
- the eNB may directly connect with the Mobility Management Entity (MME) 105 in a core network.
- MME Mobility Management Entity
- the wireless resource management entity includes a HeNB GW 104
- the HeNB 103 should connect with the MME 105 through the HeNB GW 104.
- the wireless resource management entity does not include the HeNB GW 104, the HeNB 103 may directly connect from the MME 105.
- HeNBs In order to provide more access services in conventional mobile communication systems, various types of HeNBs, such as open HeNBs, hybrid HeNBs, and CSG HeNBs are provided.
- the open HeNBs do not have a specific user group which accesses the open HeNBs, and thus, any UE can access to the open HeNBs.
- the CSG HeNBs are used by a specific user group, such as all users in the above noted corporation and school.
- the CSG HeNBs are accessed by the UEs of the specific user group, which are referred to as CSG UEs, wherein the specific user group is served by the CSG HeNBs.
- the hybrid HeNB forms itself and other HeNBs into a CSG user group in order to provide access to the CSG UEs served by itself in order to provide better access services to the CSG UEs. Additionally, the hybrid HeNBs also allow the access of other non-CSG UEs, which are UEs not belonging to the CSG.
- the conventional mobile communication system includes a CSG formed with multiple wireless resource management entities for providing CSG wireless resource management entities, such as CSG HeNB.
- the conventional mobile communication system also includes hybrid wireless resource management entities, such as hybrid HeNBs, for providing more access services.
- the eNB may also support the functions of the CSG, or may be used as a hybrid eNB while supporting the CSG functions.
- FIG. 2 is a schematic diagram illustrating a handover process for a UE moving between HeNBs or eNBs according to the related art.
- the S1 handover process mainly includes the fowling processes.
- a Source?(H)eNB S-(H)eNB
- the HeNB GW sends the handover required message to the MME in step 202.
- the MME sends a handover request message to the HeNB GW
- the HeNB GW sends the handover request message to a Target?(H)eNB (T-(H)eNB) in step 203.
- the T-(H)eNB allocates resources, sends a handover request acknowledgement message to the HeNB GW, and the HeNB GW sends the handover request acknowledgement message to the MME.
- step 205 the MME sends a handover command message to the HeNB GW, and the HeNB GW sends the handover command message to the S-(H)eNB.
- the S-(H)eNB sends the handover command message to the UE in step 206.
- step 207 the UE synchronizes itself to a target cell, and sends a handover acknowledgement message to the T-(H)eNB.
- the T-(H)eNB sends a handover notification message to the HeNB GW, and the HeNB GW sends the handover notification message to the MME in step 208.
- the MME sends an update bearer request message to a Service-Gateway (S-GW)/Packet Data Network Gateway (PDN GW) in step 209.
- S-GW Service-Gateway
- PDN GW Packet Data Network Gateway
- the S-GW mainly provides a function of a user plane and the PDN GW is responsible for the charging, legal monitoring, and other similar functions.
- the MME carries information elements of the UE location and user CSG information in the update bearer request message.
- the S-GW/PDN GW sends the update bearer response message to the MME.
- the UE initiates the Tuning and Analysis Utility (TAU) process in step 211.
- the MME sends a UE context release command message to the HeNB GW, and the HeNB GW sends the UE context release command message to the S-(H)eNB.
- the S-(H)eNB sends a UE context release completion message to the HeNB GW, and the HeNB GW sends the UE context release completion message to the MME.
- the S-(H)eNB and the T-(H)eNB in FIG. 2 may be a HeNB or an eNB because the above process also applies in the S1 handover when the UE moves between the eNBs.
- S-eNB denotes a Source-eNB
- T-eNB denotes a Target-eNB
- S-HeNB denotes the Source-HeNB
- T-HeNB denotes the Target-HeNB.
- FIG. 3 is a schematic diagram illustrating a structure of encryption secure levels in an Evolved-Universal Mobile Telecommunication Systems (UMTS) Terrestrial Radio Access Network E-UTRAN according to the related art.
- UMTS Evolved-Universal Mobile Telecommunication Systems
- K is a permanent key of a universal integrated circuit card on a Universal Subscriber Identity Module (USIM) and an Authentication Center (AuC).
- a Cipher Key (CK) and an Integrity Key (IK) are generated by the AuC and the USIM in a process of Authentication and Key Agreement (AKA).
- the CK and IK are processed differently in an Evolved Packet System (EPS) services and the legacy secure contexts.
- EPS Evolved Packet System
- K ASME An Access Safety Management Entity Key
- K ASME is an intermediate key generated by the UE and MME after the AKA.
- the UE and MME further generate the key for the Non-Access Stratum (NAS) Layer Encryption (K NASenc ) and NAS Integrity Protection (K NASint ) according to the K ASME .
- the Evolution Node Key (K eNB ) is a key obtained by the UE and the MME or by the UE and the eNB.
- a Next Hop (NH) is a key for the forward secure derived by the UE and the MME.
- a key K UPenc for encrypting an air interface access layer user plane, a key K RRCenc for controlling a plane encryption, and a key K RRCint for controlling a plane integrity protection are further derived according to the K eNB .
- FIG. 4 is a schematic diagram illustrating the principle for generating the key during the handover process according to the related art.
- the initial K eNB is calculated according to the K ASME and a NAS uplink COUNT.
- AS Access Stratum
- the K eNB and the NH are derived by the MME and UE.
- the K eNB and NH are derived from the K ASME .
- a NH Changing Counter (NCC) of the NH is associated with each K eNB and NH.
- NCC NH Changing Counter
- Each K eNB is associated with the NCC corresponding to the NH, and from which the K eNB is derived.
- the K eNB is directly derived from the K ASME .
- the K eNB is associated with a virtual NH, and the NCC, to which the NH corresponds, is 0.
- the derived NH corresponds to the NCC 1.
- the initial NCC is 0 when the eNB receives the initial contexts establishment request.
- the eNB key used between the UE and the target eNB is derived from the current eNB or NH.
- the former is recorded as K eNB
- the latter is recorded as the K eNB *.
- a method for deriving the key according to the current K eNB is called the horizontal key generation mechanism
- a method for deriving the key according to the NH is called the vertical key generation mechanism.
- the gateway does not have the ability of computing the current NH.
- the gateway cannot obtain the current NH.
- the conventional method of communication discussed above has many disadvantages in security.
- the conventional method does not solve the problem of ensuring the working of a secure key chain when the handover terminates at the gateway.
- an aspect of the present invention is to provide a secure key obtaining method, which may ensure the working of the secure key chain when the handover process is terminated at the gateway.
- a method for obtaining a secure key includes sending an Access Safety Management Entity Key (K ASME ) to a gateway after finishing authentication and security process by a Mobility Management Entity (MME) in a core network; and computing, by the gateway, a Next Hop (NH) according to the K ASME .
- K ASME Access Safety Management Entity Key
- MME Mobility Management Entity
- NH Next Hop
- the method further includes receiving, by the gateway, a handover message which is a handover required message or a path switch request message from a Base Station (BS), obtaining, by the gateway, a new NH through the computing of the NH, and sending the new NH and a NH Change Counter (NCC) corresponding to the new NH to the BS.
- a handover message which is a handover required message or a path switch request message from a Base Station (BS)
- BS Base Station
- NCC NH Change Counter
- the method further includes sending, by the MME, an updated K ASME and an Evolved NodeB Key (K eNB ) to the gateway; and saving, by the gateway, the updated K ASME and K eNB , and sending the updated K eNB to a Home Evolved NodeB (HeNB).
- K eNB Evolved NodeB Key
- the MME sends the K ASME and K eNB to the gateway through an initial context establishment request message or a User Equipment (UE) context modification request message.
- UE User Equipment
- the method when the UE handover occurs between a source BS and a target BS, the method further includes sending, by the gateway, a most current NH and a NCC to the MME in the core network; and computing, by the MME in the core network, a new NH according to the most current NH, and sending the new NH and the corresponding NCC to the target BS.
- the gateway sends the most current NH and the corresponding NCC to the MME in the core network through a handover required message.
- the method when the UE moves from a source gateway to one of a target gateway and a target BS, the method further includes sending, by the source gateway, the K ASME , the most current NH and a NCC to the target gateway or the target BS; sending, by the target gateway or target BS, the most current NH and the NCC to the MME in the core network; and computing, by the MME in the core network, a new NH according to the most current NH.
- the source gateway sends the KASME, the new NH and the NCC to the target gateway or target BS through a handover request message of an X2 interface.
- the target network sends the new NH and the NCC to the MME in the core network through a path handover request message of an S1 interface.
- a method for obtaining a secure key includes sending, by a source Base Station (BS), a handover required message which comprises an Evolved NodeB Key (K eNB *) and NCC of the Next Hop (NH) computed by the source BS, to a gateway, sending, by the gateway, a handover request message which comprises K eNB * and corresponding NCC to a target BS, and taking, by the target BS, the K eNB * as a new key used between the target BS and the UE.
- BS Base Station
- K eNB * Evolved NodeB Key
- NH Next Hop
- the secure key obtaining method gives a method for ensuring the working of secure key chain when the handover process terminated at the HeNB GW.
- the key information cannot be lost when the handover process terminated at the HeNB GW, the effect of the handover process on the core network is reduced, and the efficiency of the UE handover is improved.
- FIG. 1 is a schematic diagram illustrating a structure of a conventional LTE system according to the related art
- FIG. 2 is a schematic diagram illustrating a handover process that an UE moves between a HeNBs according to the related art
- FIG. 3 is a schematic diagram illustrating structure of encryption security levels in a conventional E-UTRAN according to the related art
- FIG. 4 is a schematic diagram illustrating a principle for generating a key during a handover process according to the related art
- FIG. 5 is a flowchart illustrating an embodiment that the gateway has a function of deriving a key in accordance with an exemplary embodiment of the present invention
- FIG. 6 is a flowchart illustrating an embodiment that the gateway has the function of deriving a key and obtains updated corresponding security information from the MME;
- FIG. 7 is a flowchart illustrating a first embodiment that the gateway has the function of deriving a key and supports the handover process
- FIG. 8 is a flowchart illustrating a second embodiment that the gateway has a function of deriving a key and supports the handover process
- FIG. 9 is a flowchart illustrating a method for ensuring the working of a key chain when the UE moves from a HeNB GW to another HeNB GW or an eNB in accordance with a first exemplary embodiment of the present invention
- FIG. 10 is a flowchart illustrating a method for ensuring the working of a key chain when the UE moves from the HeNB GW to another HeNB GW or an eNB in accordance with a second exemplary embodiment of the present invention
- FIG. 11 is a flowchart illustrating a second method for solving the security problem when the handover process ends at the gateway in accordance with a first exemplary embodiment of the present invention
- FIG. 12 is a flowchart illustrating a second method for solving the security problem when the handover process ends at the gateway in accordance with a second exemplary embodiment of the present invention
- FIG. 13 is a flowchart illustrating a third method for solving the security problem when the handover process ends at the gateway in accordance with an exemplary embodiment of the present invention.
- FIG. 14 is a flowchart illustrating a method that a BS notifies the core network of the type of itself in accordance with an exemplary embodiment of the present invention.
- an exemplary embodiment of the present invention describes a method for addressing a security problem when handover signaling terminates at a HeNB Gateway (HeNB GW) if a User Equipment (UE) moves from one HeNB to another.
- HeNB GW HeNB Gateway
- UE User Equipment
- eNB Evolved NodeB
- MME Mobility Management Entity
- GW Gateway
- a method of exemplary embodiments of the present invention is also applicable.
- an S1 interface using an S1 Access Protocol (S1AP) protocol between the HeNB and the HeNB GW, and an X2 interface using an X2 Access Protocol (X2AP) protocol between the HeNBs are provided.
- S1AP S1 Access Protocol
- X2AP X2 Access Protocol
- a first exemplary method of the present invention is described in the embodiments of FIGs. 5 to 10.
- FIG. 5 is a flowchart illustrating an embodiment in which the gateway has a function of deriving a key and obtains corresponding security information from an MME in accordance with an exemplary embodiment of the present invention.
- a UE sends a Non-Access Stratum (NAS) message, for instance an Attach or a service request, to a HeNB.
- NAS Non-Access Stratum
- the HeNB sends a NAS message to the HeNB GW via an S1 Access Protocol (S1AP) message initial UE message in step 502.
- S1AP S1 Access Protocol
- the HeNB GW sends the S1AP message initial UE message to the MME. If the cell to which the UE seeks access is the CSG cell or the hybrid cell, then the message carries the CSG ID.
- step 503 which is an optional step, an authentication/security process is executed.
- the executed security process may be identical with that of a conventional method, such as TS23.401, and thus, a detailed technical description is omitted.
- the MME determines that a downlink node is an HeNB GW.
- a method for the MME determining that the downlink node is the HeNB GW includes the following four methods.
- the MME may distinguish the type of the entity according to a coding of the Identification (ID) of a downlink node entity, such as an ID of the eNB, an ID of the HeNB, or an ID of the HeNB GW.
- ID the Identification
- the ID of the eNB begins at 00
- the ID of the HeNB begins at 01
- the ID of the HeNB GW begins at 10.
- TA Tracking Area
- the S1 establishment message sent from the HeNB GW to the MME includes a BS type indication for indicating that the downlink node is the HeNB GW.
- a detailed description of method three is shown in FIG. 14.
- the initial UE message sent from the HeNB GW in step 502 (see FIG. 5) to the MME carries a Base Station (BS) type indication for indicating that the downlink node is the HeNB GW.
- the indication is further used for indicating that the downlink node is the HeNB or the eNB.
- the method for the MME determining that the downlink node is the HeNB GW may be any one of the above four methods. However, the present invention is not limited thereto, and other suitable implementation methods that do not affect the main contents of the embodiments of the present invention may be used. Additionally, step 504 is an optional step.
- the MME sends an initial context establishment request message to the HeNB GW.
- the message includes information elements K ASME and K eNB .
- the HeNB GW computes the NH according to a conventional method and saves the NH in the UE contexts and also saves the K ASME and K eNB .
- the HeNB GW sends an initial context establishment request message to the HeNB in step 507.
- the message includes an information element K eNB .
- the HeNB establishes a radio bearer between the UE and itself.
- the HeNB sends an initial context establishment response message to the HeNB GW.
- the HeNB GW sends the initial context establishment response message to the MME in step 510.
- FIG. 6 is a flowchart illustrating an embodiment wherein the gateway has a function of deriving a key and obtaining updated security information from the MME in accordance with an exemplary embodiment of the present invention.
- a new authentication process is performed between a network and a UE.
- a MME sends a UE context modification request message to a HeNB GW.
- the UE context modification request message includes the K ASME and K eNB , and the HeNB GW saves the updated K ASME and KeNB.
- the HeNB GW sends the UE context modification request message, including the updated K eNB , to the HeNB.
- the HeNB sends a UE context modification response message to the HeNB GW in step 604.
- the HeNB GW sends the UE context modification response message to the MME.
- the HeNB GW computes and saves the NH according to the new K ASME and K eNB in step 606.
- the update of the NCC is identical with that in a conventional method. Additionally, there is no fixed or absolute sequence between the steps 603 and 606.
- FIG. 7 is flowchart illustrating a first embodiment wherein the gateway has a function of deriving a key and supports a handover process in accordance with an exemplary embodiment of the present invention.
- a target cell is a CSG cell, in a process in which a UE switches to the target cell, access control needs to be performed on the UE in order to determine whether the UE may access the target cell. If the UE cannot access the target cell, the handover process fails. If the target cell is a hybrid cell, then whether the UE is a member of the target cell should be determined.
- the target cell may provide different Quality of Services (QoS) according to whether the UE is a member of the target cell.
- QoS Quality of Services
- An entity executes the access control according to whether a Closed Subscriber Group (CSG) ID of the target cell is in a CSG list to which has UE access.
- the access control may be performed by a source HeNB, a HeNB GW or a target HeNB. Alternatively, if a source cell and the target cell are located at the same CSG, the access control may be omitted. Since the access control is not the focus of the present exemplary embodiment, a detailed description of the access control method is omitted for ease of description.
- a source HeNB sends a handover required message to a HeNB GW.
- the handover required message includes indication information indicating whether the UE is a member of the target cell, or in other words, whether the UE is a subscribed member of the target cell. Due to the indication information being included in the handover required message, the HeNB GW notifies the target HeNB of the information indicating whether the UE is a member in step 702, as discussed below.
- the target HeNB may provide different QoSs according to information indicating whether the UE is a member of the target cell.
- the indication information is an optional information element and is not required in all embodiments of the present invention.
- the indication information may be not used in an embodiment wherein the handover process terminates at the HeNB GW in a scenario having the UE move in a same HeNB GW and with a same CSG ID, or in other words, a CSG with the same CSG ID, or a HeNB of a hybrid cell with the same CSG ID.
- the HeNB GW need not have the access control function, and the HeNB GW should only send a member ID received from a source end to a target end.
- step 702 the HeNB GW determines that the handover process terminates at the HeNB GW.
- the HeNB GW adds a NCC value saved by the HeNB GW and computes a new NH according to the saved NCC value.
- the method for computing the NH is identical with that of a conventional method.
- the HeNB GW sends a handover request message to a T-HeNB.
- the message includes the newly computed NH and a current NCC value, which is the value obtained after adding 1 to a previous NCC.
- the T-HeNB computes a KeNB used between itself and the UE using the NH and the NCC as a pair and a Physical Cell Identity (PCI) and a frequency (EARFCN-D) of the target cell.
- PCI Physical Cell Identity
- ERFFCN-D frequency
- a method of computing the KeNB is well known to one of ordinary skill in the art, and thus, detailed computation descriptions thereof are omitted.
- the target HeNB associates the received NCC and KeNB.
- the target HeNB carries the NCC of the NH-NCC pair in a handover command message sent to the UE, and deletes the old and invalid NH-NCC pair. Continuing with step 704, the target HeNB sends a handover request acknowledgement message to the HeNB GW.
- the HeNB GW sends a handover command message, which is also called a Radio Resource Control (RRC) connection reconfiguration message, to an S-HeNB.
- RRC Radio Resource Control
- the source HeNB sends the handover command message to the UE.
- the UE sends a handover acknowledgement is also call a RRC connection re-configuration completion, message to the target HeNB.
- the target HeNB sends a handover notification message to the HeNB GW.
- the HeNB GW sends a UE context release command message to the source HeNB, and in step 710, the source HeNB sends a UE context release completion message to the HeNB GW.
- FIG. 8 is a second embodiment that the gateway has the function of deriving the key and supporting the handover process in accordance with an exemplary embodiment of the present invention.
- access control may be performed by an S-HeNB, HeNB GW or a T-HeNB.
- S-HeNB S-HeNB
- HeNB GW HeNB GW
- T-HeNB T-HeNB
- FIG. 8 detailed descriptions of the access control method are omitted for convenience of description.
- the S-HeNB sends a handover request message to the T-HeNB.
- the message includes a CSG ID of the target cell, as well as an ID list of the CSGs to which the UE may access.
- the T-HeNB allocates resources and sends a handover request acknowledgement message to the source HeNB.
- the S-HeNB sends a handover command message to the UE in step 803.
- the UE sends a handover acknowledgement message to the T-HeNB.
- the T-HeNB sends a path handover request message to the HeNB GW.
- the HeNB GW increments a NCC value saved by itself, and computes a new NH using the K ASME and a saved NH.
- the method for computing the new NH is similar to the conventional method.
- the HeNB GW sends a path handover request acknowledgement message to the T-HeNB.
- the path handover request acknowledgement message includes the newly-computed NH and NCC.
- the T-HeNB saves the received NH-NCC pair for a next handover, and deletes previously saved NH-NCC pairs.
- the target HeNB sends a resource release message to the source HeNB.
- FIG. 9 is a flowchart illustrating a method for ensuring a working of a key chain when a UE moves from a HeNB GW to another HeNB GW or an eNB in accordance with an exemplary embodiment of the present invention.
- an S-HeNB sends a handover required message to a HeNB GW.
- the HeNB GW sends a handover required message to a MME.
- the handover required message includes a current NH and a NCC.
- the HeNB GW delegates an operation for deriving the key to the MME.
- the MME adds the received NCC value, and computes a new NH according to a KASME and the received NH.
- An algorithm for computing the new NH and NCC may be similar to that of a conventional method.
- a MME sends a handover request message to a target HeNB GW/eNB, and the message carries the newly computed NH and NCC.
- step 905 if a UE moves to the HeNB of another HeNB GW, the target HeNB GW sends the handover request message to the T-HeNB.
- the handover request message includes the NH and NCC received from the MME.
- the target eNB/HeNB computes a KeNB used between itself and the UE using the NH-NCC pair and a PCI and an EARFCN-D of the target cell. A method of computing the KeNB is well known, thus a detailed description is omitted herein.
- the T-HeNB associates the received NCC and KeNB.
- the T-HeNB carries the NCC of the NH-NCC pair in a handover command message sent to the UE, and deletes an old invalid NH-NCC pair.
- the T-HeNB sends a handover request acknowledgement message to the HeNB GW.
- the T-HeNB GW/eNB sends the handover request acknowledgement message to the MME.
- the MME sends a handover command message to the source HeNB GW.
- the source HeNB GW sends the handover command message to the S-HeNB
- the S-HeNB sends the handover command message to the UE.
- the UE sends a handover acknowledgement message to the target HeNB GW/ eNB. If the UE moves to the HeNB of another HeNB GW, the UE sends a handover acknowledgement message to the T-HeNB.
- the T-HeNB sends the handover acknowledgement message to the target HeNB GW.
- step 910 the target HeNB GW/eNB sends a handover notification message to the MME.
- the MME sends a UE context release command message to the source HeNB GW
- the source HeNB GW sends the UE context release command message to the S-HeNB.
- the S-HeNB sends the UE context release completion message to the source HeNB GW.
- the S-HeNB GW sends the UE context release completion message to the MME.
- FIG. 10 is a flowchart illustrating a method for ensuring a working of a key chain when a UE moves from a HeNB GW to another HeNB GW or an eNB in accordance with an exemplary embodiment of the present invention.
- an S-HeNB sends a handover required message to the HeNB GW.
- a source HeNB GW sends an X2AP handover request message to the target HeNB GW/eNB.
- the X2AP handover request message includes a NH and a NCC currently saved by the HeNB GW.
- the X2AP handover request message includes a K ASME and a K eNB *.
- the target HeNB GW/eNB uses the K eNB * as a new encryption key between itself and a UE.
- step 1003 if the UE moves to the HeNB of another HeNB GW, the HeNB GW adds the received NCC value, and the target HeNB GW computes a new NH according to the KASME and the newly-received NH.
- the target HeNB GW sends the S1AP handover request message to the T-HeNB.
- the S1AP handover request message includes the new NH and NCC obtained by the computation.
- the T-HeNB allocates resources and sends a handover request acknowledgement message to the target HeNB GW.
- the target HeNB GW/eNB sends an X2AP handover request acknowledgement message to the S-HeNB GW.
- the source HeNB GW sends a handover command message to the S-HeNB.
- the S-HeNB sends the handover command message to the UE.
- the UE sends a handover acknowledgement message to the target HeNB GW/eNB. If the UE switches to the HeNB of another HeNB GW, the UE sends the handover acknowledgement message to the target HeNB.
- the target HeNB sends the handover acknowledgement message to the target HeNB GW.
- the target HeNB GW/eNB sends a path handover request message to the MME.
- the message includes the current NH and NCC.
- the HeNB GW allocates an operation for deriving the key to the MME.
- the MME adds the received NCC value, and the MME computes a new NH according to the K ASME and the newly-received NH.
- the MME sends a path handover request acknowledgement message to the target HeNB GW/eNB.
- the path handover request acknowledgement message includes the new NH and NCC.
- the target HeNB GW/eNB sends an X2AP resource release message to the source HeNB GW.
- the source HeNB GW sends a UE context release command message to the source HeNB.
- the S-HeNB sends the UE context release completion message to the source HeNB GW.
- FIGs. 11 and 12 A second exemplary method of an exemplary embodiment of the present invention is illustrated in FIGs. 11 and 12.
- FIG. 11 is a flowchart illustrating a second method for solving a security problem when a handover process terminated at a gateway in accordance with an exemplary embodiment of the present invention.
- an S-HeNB makes a handover decision, and the S-HeNB sends a handover required message to a HeNB GW.
- the handover required message includes a K eNB * and NCC.
- the S-HeNB computes a new K eNB * according to the current K eNB or a new NH, a physical cell ID of the target cell, and frequency, and other information elements used to compute the new K eNB *.
- the information elements of K eNB * and NCC are optional.
- the source HeNB only include the information elements when a target HeNB and a source HeNB connect to a same HeNB GW.
- the handover required message of step 1101 includes indication information, indicating whether the UE is a member of a target cell, or in other words, whether the UE is a subscribed member of the cell or not.
- the HeNB GW notifies the T-HeNB of the information indicating whether the UE is a member of the target cell.
- the target HeNB may provide different QoSs according to the information indicating whether the UE is the member of the target cell.
- the indication information is an optional information element. For instance, for an exemplary embodiment having the handover process terminated at the HeNB GW only applies to a scenario wherein the UE moves in the same HeNB GW and with the same CSG ID (i.e.
- the HeNB GW needs not have the access control function, and the HeNB GW only needs to send a membership indication received from the S-HeNB to the T-HeNB.
- the HeNB GW sends a handover request message to the T-HeNB.
- the handover request message includes a K eNB * and NCC received from the S-HeNB.
- the HeNB GW sets the NH in the handover request message as an invalid value or any value.
- the T-HeNB allocates resources, and the T-HeNB takes the KeNB* as a new encryption key KeNB between itself and the UE.
- the T-HeNB associates the received NCC and KeNB.
- the T-HeNB carries the received NCC in the handover command message sent to the UE.
- the T-HeNB omits a value of the NH received in the handover request message.
- the T-HeNB sends a handover request acknowledgement message to the HeNB GW.
- the HeNB GW sends a handover command message to the S-HeNB.
- the S-HeNB sends the handover command message to the UE.
- the UE sends a handover acknowledgement message to the target HeNB.
- the T-HeNB sends a handover notification message to the HeNB GW.
- the HeNB GW sends a UE context release command message to the source HeNB.
- the S-HeNB sends a UE context release completion message to the HeNB GW.
- FIG. 12 is a second embodiment illustrating the second method for solving the security problem when the handover process ends at the gateway in accordance with an exemplary embodiment of the present invention.
- an S-HeNB makes a handover decision and the S-HeNB sends an X2AP handover request message to a HeNB GW.
- the X2AP handover request message includes a K eNB * and NCC.
- the S-HeNB computes a new K eNB * according to a current K eNB or a new NH, a physical cell ID of the target cell, and frequency, or other information.
- the HeNB GW sends the X2AP handover request message to a T-HeNB.
- the X2AP handover request message includes the K eNB * and NCC received from the S-HeNB.
- the T-HeNB allocates resources and sends an X2AP handover request acknowledgement message to the HeNB GW.
- the HeNB GW sends the X2AP handover request acknowledgement message to the S-HeNB.
- the S-HeNB sends a handover command message to the UE.
- the UE sends a handover acknowledgement message to the T-HeNB.
- the T-HeNB sends an S1AP handover notification message to the HeNB GW.
- the HeNB GW sends an S1AP UE context release command message to the source HeNB.
- the S-HeNB sends an S1AP UE context release completion message to the HeNB GW.
- the functions of steps 1207 to 1209 also can be implemented with the following steps.
- the T- HeNB receives the handover acknowledgement message sent from the UE, and the T-HeNB sends a path switch request message to the HeNB GW. Then, the HeNB GW sends the path switch request acknowledgement message to the target HeNB.
- the path switch request acknowledgement message includes invalid security contexts, such as an invalid NH and NCC pair, or invalid security information indication information.
- the T-HeNB does not save the received invalid NH and NCC pair according to the invalid security context information, such as the invalid NH and NCC pair, or invalid security context indication information.
- the K eNB * is generated with a horizontal key generation mechanism, or in other words, the K eNB * is computed with a PCI of a target cell, an EARFCN-DL of the target cell and the current active K eNB .
- the K eNB * is generated with a vertical key generation mechanism, or in other words, the K eNB * is computed with the PCI of the target cell, the EARFCN-DL of the target cell and the existing NH.
- the T-HeNB sends an X2AP resource release message to the HeNB GW.
- the HeNB GW sends the X2AP resource release message to the S-HeNB.
- FIG. 13 is a flowchart illustrating a third exemplary method for addressing a security problem when a handover process is terminated at a gateway in accordance with an exemplary embodiment of the present invention.
- access control may be performed by an S-HeNB, HeNB GW or T-HeNB.
- S-HeNB S-HeNB
- HeNB GW HeNB GW
- T-HeNB T-HeNB
- an S-HeNB sends a handover request message to a T-HeNB.
- the handover request message includes a CSG ID of a target cell, an ID list of CSGs to which the UE can access, and the K eNB * and NCC pair.
- a method for computing the K eNB * and NCC is similar to that of a conventional method, and thus, a description thereof will be omitted for convenience of description.
- the T-HeNB directly takes the K eNB * as a new encryption key KeNB for use between itself and the UE.
- the T-HeNB associates the K eNB and the received NCC.
- the T-HeNB carries the NCC value received from the S-HeNB in a handover command message in a transparent container from the T-HeNB to the S-HeNB, and the S-HeNB sends the NCC value to the UE.
- the T-HeNB sends a handover request acknowledgement message to the S-HeNB.
- the S-HeNB sends a handover command message to the UE.
- the UE sends a handover acknowledgement message to the T-HeNB.
- the T-HeNB sends a path switch request message to the HeNB GW.
- the HeNB GW sends a path switch request acknowledgement message to the T-HeNB.
- the path switch request acknowledgement message includes an invalid security context, such as an invalid NH and NCC pair or invalid security information indication information.
- the T-HeNB does not save the received invalid NH and NCC according to the invalid security context information.
- the K eNB * is generated with a horizontal key generation mechanism, or in other words, the K eNB * is computed according to a PCI of the target cell, an EARFCN-DL of the target cell, and the current active KeNB.
- the K eNB * is generated with a vertical key generation mechanism, or in other words, the K eNB * is computed with the PCI of the target cell, the EARFCN-DL of the target cell and an existing NH.
- the T-HeNB sends a resource release message to the S-HeNB.
- FIG. 14 is a flowchart illustrating a method that a BS notifies a core network of a type of itself in accordance with an embodiment of the present invention.
- the HeNB, HeNB GW, or eNB sends an S1 establishment request message to the MME, and the S1 establishment request message includes a BS type indication, which is an information element for indicating that the downlink node is the HeNB GW. The information element is further used for indicating whether the downlink node is the HeNB or eNB.
- the MME sends an S1 establishment response message to the HeNB, HeNB GW, or eNB.
- exemplary embodiments of the present invention provide a method for ensuring a working of a security key chain when a handover process is terminated at a HeNB GW.
- the handover process is terminated at the HeNB GW, the key information will not be lost, which reduces the impact of the handover process on the core network, and improves the efficiency of the UE handover.
Landscapes
- Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computer Security & Cryptography (AREA)
- Mobile Radio Communication Systems (AREA)
Abstract
A method for obtaining a secure key is provided. The method includes sending an Access Safety Management Entity Key (KASME) to a gateway after finishing authentication and security process by a Mobility Management Entity (MME) in a core network; and computing, by the gateway, a Next Hop (NH) according to the KASME. The method provides a method for ensuring a working of a secure key chain when a handover process is terminated at a Hybrid Evolved NodeB Gateway (HeNB GW). Thus, key information cannot be lost when the handover process is terminated at the HeNB GW, and an impact of the handover process on a core network is reduced, and the efficiency of a User Equipment (UE) handover is improved.
Description
The present invention relates to mobile communication technologies. More particularly, the present invention relates to a method for obtaining a secure key.
In conventional mobile communication systems, in order to provide better services to a user group, a Closed Subscriber Group (CSG) should be formed with multiple wireless resource management entities for a specific user group. The wireless resource entities may include network entities in the wireless access network for managing wireless resources and access of the User Equipment (UE) and the network entities may include base stations or cells in various mobile communication systems. For instance, all users of a corporation or a school belong to a specific user group, and for the user group, a CSG is formed with multiple wireless resource management entities for providing special access services. For a specific user group, it is a common that the CSG is formed with multiple wireless resource management entities. A description is given hereafter using a Long Term Evolution (LTE) system of a System Architecture Evolution (SAE) as an example.
FIG. 1 is a schematic diagram illustrating a structure of an LTE system according to the related art.
Referring to FIG. 1, in a wireless access network of the LTE system, wireless resource management entities include Evolved NodeBs (eNBs) 102 and Home Evolved NodeBs (HeNBs) 103, and may further include a HeNB Gateway (HeNB GW) 104, as required. The eNB may directly connect with the Mobility Management Entity (MME) 105 in a core network. When the wireless resource management entity includes a HeNB GW 104, the HeNB 103 should connect with the MME 105 through the HeNB GW 104. When the wireless resource management entity does not include the HeNB GW 104, the HeNB 103 may directly connect from the MME 105.
In order to provide more access services in conventional mobile communication systems, various types of HeNBs, such as open HeNBs, hybrid HeNBs, and CSG HeNBs are provided. The open HeNBs do not have a specific user group which accesses the open HeNBs, and thus, any UE can access to the open HeNBs. The CSG HeNBs are used by a specific user group, such as all users in the above noted corporation and school. The CSG HeNBs are accessed by the UEs of the specific user group, which are referred to as CSG UEs, wherein the specific user group is served by the CSG HeNBs. The hybrid HeNB forms itself and other HeNBs into a CSG user group in order to provide access to the CSG UEs served by itself in order to provide better access services to the CSG UEs. Additionally, the hybrid HeNBs also allow the access of other non-CSG UEs, which are UEs not belonging to the CSG.
According to the above description, the conventional mobile communication system includes a CSG formed with multiple wireless resource management entities for providing CSG wireless resource management entities, such as CSG HeNB. The conventional mobile communication system also includes hybrid wireless resource management entities, such as hybrid HeNBs, for providing more access services. At the same time, the eNB may also support the functions of the CSG, or may be used as a hybrid eNB while supporting the CSG functions.
FIG. 2 is a schematic diagram illustrating a handover process for a UE moving between HeNBs or eNBs according to the related art.
Referring to FIG. 2, the movement of the UE is implemented through an S1 handover process. As shown in FIG. 2, optional descriptions of the S1 handover process which are well known to those skilled in the art are omitted in the following descriptions. The S1 handover process mainly includes the fowling processes. In step 201, a Source?(H)eNB (S-(H)eNB) sends a handover required message to a HeNB GW. The HeNB GW sends the handover required message to the MME in step 202. Next, the MME sends a handover request message to the HeNB GW, and the HeNB GW sends the handover request message to a Target?(H)eNB (T-(H)eNB) in step 203. In step 204, the T-(H)eNB allocates resources, sends a handover request acknowledgement message to the HeNB GW, and the HeNB GW sends the handover request acknowledgement message to the MME.
In step 205, the MME sends a handover command message to the HeNB GW, and the HeNB GW sends the handover command message to the S-(H)eNB. The S-(H)eNB sends the handover command message to the UE in step 206. In step 207, the UE synchronizes itself to a target cell, and sends a handover acknowledgement message to the T-(H)eNB. Next, the T-(H)eNB sends a handover notification message to the HeNB GW, and the HeNB GW sends the handover notification message to the MME in step 208. Then, the MME sends an update bearer request message to a Service-Gateway (S-GW)/Packet Data Network Gateway (PDN GW) in step 209. For convenience of description, the signaling processes between the S-GW and the PDN GW are omitted. The S-GW mainly provides a function of a user plane and the PDN GW is responsible for the charging, legal monitoring, and other similar functions. According to information of the UE’s contexts, if the PDN GW has requested for the UE location and/or user CSG information, the MME carries information elements of the UE location and user CSG information in the update bearer request message.
Next, in step 210, the S-GW/PDN GW sends the update bearer response message to the MME. The UE initiates the Tuning and Analysis Utility (TAU) process in step 211. In step 212, the MME sends a UE context release command message to the HeNB GW, and the HeNB GW sends the UE context release command message to the S-(H)eNB. In step 213, the S-(H)eNB sends a UE context release completion message to the HeNB GW, and the HeNB GW sends the UE context release completion message to the MME.
It should be noted that the S-(H)eNB and the T-(H)eNB in FIG. 2 may be a HeNB or an eNB because the above process also applies in the S1 handover when the UE moves between the eNBs. Thus, S-eNB denotes a Source-eNB, T-eNB denotes a Target-eNB, S-HeNB denotes the Source-HeNB, and T-HeNB denotes the Target-HeNB.
It can be seen that when there are many HeNBs or eNBs, if the above handover method is adopted and each time the UE switches between the HeNB and eNB through the S1 handover, there is a very heavy load on the core network, and the many HeNBs or eNBs reduce an efficiency of the handover made by the UE under the same HeNB GW. Under this circumstance, if the handover process of the UE terminates at the gateway, the load brought on the core network by the handover may be reduced greatly. However, the communication protocol in the conventional standard does not advance a detailed solution wherein the handover process ends at the gateway. On the other hand, a security mechanism in the conventional standard also cannot allow the handover which terminates at the gateway.
FIG. 3 is a schematic diagram illustrating a structure of encryption secure levels in an Evolved-Universal Mobile Telecommunication Systems (UMTS) Terrestrial Radio Access Network E-UTRAN according to the related art.
Referring to FIG. 3, K is a permanent key of a universal integrated circuit card on a Universal Subscriber Identity Module (USIM) and an Authentication Center (AuC). A Cipher Key (CK) and an Integrity Key (IK) are generated by the AuC and the USIM in a process of Authentication and Key Agreement (AKA). The CK and IK are processed differently in an Evolved Packet System (EPS) services and the legacy secure contexts.
An Access Safety Management Entity Key (KASME) is an intermediate key generated by the UE and MME after the AKA. The UE and MME further generate the key for the Non-Access Stratum (NAS) Layer Encryption (KNASenc) and NAS Integrity Protection (KNASint) according to the KASME. The Evolution Node Key (KeNB) is a key obtained by the UE and the MME or by the UE and the eNB. A Next Hop (NH) is a key for the forward secure derived by the UE and the MME. A key KUPenc for encrypting an air interface access layer user plane, a key KRRCenc for controlling a plane encryption, and a key KRRCint for controlling a plane integrity protection are further derived according to the KeNB.
FIG. 4 is a schematic diagram illustrating the principle for generating the key during the handover process according to the related art.
Referring to FIG. 4, the initial KeNB is calculated according to the KASME and a NAS uplink COUNT. When the UE and eNB need to establish the initial Access Stratum (AS) secure contexts, the KeNB and the NH are derived by the MME and UE. The KeNB and NH are derived from the KASME. A NH Changing Counter (NCC) of the NH is associated with each KeNB and NH. Each KeNB is associated with the NCC corresponding to the NH, and from which the KeNB is derived. At the beginning, the KeNB is directly derived from the KASME. Thus, the KeNB is associated with a virtual NH, and the NCC, to which the NH corresponds, is 0. At the beginning of the establishment, the derived NH corresponds to the NCC 1. The initial NCC is 0 when the eNB receives the initial contexts establishment request.
In the process of a handover, the eNB key used between the UE and the target eNB is derived from the current eNB or NH. In order to distinguish the eNB key used between the UE and the source NB and the eNB key used between the UE and the target NB, the former is recorded as KeNB, and the latter is recorded as the KeNB*. A method for deriving the key according to the current KeNB is called the horizontal key generation mechanism, and a method for deriving the key according to the NH is called the vertical key generation mechanism. When the KeNB* is generated according to the KeNB or NH, the Physical Cell Identity (PCI) and frequency (EARFCN-DL) of the target cell should be bound.
It can be seen that only the UE and the MME can compute the current NH, and the gateway does not have the ability of computing the current NH. Thus, if the handover terminates at the gateway, the gateway cannot obtain the current NH. Accordingly, the conventional method of communication discussed above has many disadvantages in security. Thus, the conventional method does not solve the problem of ensuring the working of a secure key chain when the handover terminates at the gateway.
Aspects of the present invention are to address at least the above-mentioned problems and/or disadvantages and to provide at least the advantages described below. Accordingly, an aspect of the present invention is to provide a secure key obtaining method, which may ensure the working of the secure key chain when the handover process is terminated at the gateway.
In accordance with an aspect of the present invention, a method for obtaining a secure key is provided. The method includes sending an Access Safety Management Entity Key (KASME) to a gateway after finishing authentication and security process by a Mobility Management Entity (MME) in a core network; and computing, by the gateway, a Next Hop (NH) according to the KASME.
According to another aspect of the present invention, the method further includes receiving, by the gateway, a handover message which is a handover required message or a path switch request message from a Base Station (BS), obtaining, by the gateway, a new NH through the computing of the NH, and sending the new NH and a NH Change Counter (NCC) corresponding to the new NH to the BS.
According to another aspect of the present invention, the method further includes sending, by the MME, an updated KASME and an Evolved NodeB Key (KeNB) to the gateway; and saving, by the gateway, the updated KASME and KeNB, and sending the updated KeNB to a Home Evolved NodeB (HeNB).
According to another aspect of the present invention, the MME sends the KASME and KeNB to the gateway through an initial context establishment request message or a User Equipment (UE) context modification request message.
According to another aspect of the present invention, when the UE handover occurs between a source BS and a target BS, the method further includes sending, by the gateway, a most current NH and a NCC to the MME in the core network; and computing, by the MME in the core network, a new NH according to the most current NH, and sending the new NH and the corresponding NCC to the target BS.
According to another aspect of the present invention, the gateway sends the most current NH and the corresponding NCC to the MME in the core network through a handover required message.
According to another aspect of the present invention, when the UE moves from a source gateway to one of a target gateway and a target BS, the method further includes sending, by the source gateway, the KASME, the most current NH and a NCC to the target gateway or the target BS; sending, by the target gateway or target BS, the most current NH and the NCC to the MME in the core network; and computing, by the MME in the core network, a new NH according to the most current NH.
According to another aspect of the present invention, the source gateway sends the KASME, the new NH and the NCC to the target gateway or target BS through a handover request message of an X2 interface.
According to another aspect of the present invention, the target network sends the new NH and the NCC to the MME in the core network through a path handover request message of an S1 interface.
In accordance with an aspect of the present invention, a method for obtaining a secure key is provided. The method includes sending, by a source Base Station (BS), a handover required message which comprises an Evolved NodeB Key (KeNB*) and NCC of the Next Hop (NH) computed by the source BS, to a gateway, sending, by the gateway, a handover request message which comprises KeNB* and corresponding NCC to a target BS, and taking, by the target BS, the KeNB* as a new key used between the target BS and the UE.
It can be seen from the above technical scheme that the secure key obtaining method provided by embodiments of the present invention gives a method for ensuring the working of secure key chain when the handover process terminated at the HeNB GW. Thus, the key information cannot be lost when the handover process terminated at the HeNB GW, the effect of the handover process on the core network is reduced, and the efficiency of the UE handover is improved.
Other aspects, advantages, and salient features of the invention will become apparent to those skilled in the art from the following detailed description, which, taken in conjunction with the annexed drawings, discloses exemplary embodiments of the invention.
The above and other aspects, features, and advantages of certain exemplary embodiments of the present invention will be more apparent from the following description taken in conjunction with the accompanying drawings, in which:
FIG. 1 is a schematic diagram illustrating a structure of a conventional LTE system according to the related art;
FIG. 2 is a schematic diagram illustrating a handover process that an UE moves between a HeNBs according to the related art;
FIG. 3 is a schematic diagram illustrating structure of encryption security levels in a conventional E-UTRAN according to the related art;
FIG. 4 is a schematic diagram illustrating a principle for generating a key during a handover process according to the related art;
FIG. 5 is a flowchart illustrating an embodiment that the gateway has a function of deriving a key in accordance with an exemplary embodiment of the present invention;
FIG. 6 is a flowchart illustrating an embodiment that the gateway has the function of deriving a key and obtains updated corresponding security information from the MME;
FIG. 7 is a flowchart illustrating a first embodiment that the gateway has the function of deriving a key and supports the handover process;
FIG. 8 is a flowchart illustrating a second embodiment that the gateway has a function of deriving a key and supports the handover process;
FIG. 9 is a flowchart illustrating a method for ensuring the working of a key chain when the UE moves from a HeNB GW to another HeNB GW or an eNB in accordance with a first exemplary embodiment of the present invention;
FIG. 10 is a flowchart illustrating a method for ensuring the working of a key chain when the UE moves from the HeNB GW to another HeNB GW or an eNB in accordance with a second exemplary embodiment of the present invention;
FIG. 11 is a flowchart illustrating a second method for solving the security problem when the handover process ends at the gateway in accordance with a first exemplary embodiment of the present invention;
FIG. 12 is a flowchart illustrating a second method for solving the security problem when the handover process ends at the gateway in accordance with a second exemplary embodiment of the present invention;
FIG. 13 is a flowchart illustrating a third method for solving the security problem when the handover process ends at the gateway in accordance with an exemplary embodiment of the present invention; and
FIG. 14 is a flowchart illustrating a method that a BS notifies the core network of the type of itself in accordance with an exemplary embodiment of the present invention.
Throughout the drawings, it should be noted that like reference numbers are used to depict the same or similar elements, features, and structures.
The following description with reference to the accompanying drawings is provided to assist in a comprehensive understanding of exemplary embodiments of the invention as defined by the claims and their equivalents. It includes various specific details to assist in that understanding, but these are to be regarded as merely exemplary. Accordingly, those of ordinary skill in the art will recognize that various changes and modifications of the embodiments described herein can be made without departing from the scope and spirit of the invention. In addition, descriptions of well-known functions and constructions may be omitted for clarity and conciseness.
The terms and words used in the following description and claims are not limited to the bibliographical meanings, but are merely used by the inventor to enable a clear and consistent understanding of the invention. Accordingly, it should be apparent to those skilled in the art that the following description of exemplary embodiments of the present invention is provided for illustration purposes only and not for the purpose of limiting the invention as defined by the appended claims and their equivalents.
It is to be understood that the singular forms “a,” “an,” and “the” include plural referents unless the context clearly dictates otherwise. Thus, for example, reference to “a component surface” includes reference to one or more of such surfaces.
The present invention is further described in detail hereinafter with reference to the accompanying drawings to make the objective and technical solution thereof more apparent.
In comparison to a conventional Home Evolved NodeB (HeNB) architecture as an example, an exemplary embodiment of the present invention describes a method for addressing a security problem when handover signaling terminates at a HeNB Gateway (HeNB GW) if a User Equipment (UE) moves from one HeNB to another. When an Evolved NodeB (eNB) accesses a Mobility Management Entity (MME) through the gateway (GW), or other wireless resource management entities access the core network through the GW, a method of exemplary embodiments of the present invention is also applicable.
In the present exemplary embodiment of the present invention, an S1 interface using an S1 Access Protocol (S1AP) protocol between the HeNB and the HeNB GW, and an X2 interface using an X2 Access Protocol (X2AP) protocol between the HeNBs are provided.
A first exemplary method of the present invention is described in the embodiments of FIGs. 5 to 10.
FIG. 5 is a flowchart illustrating an embodiment in which the gateway has a function of deriving a key and obtains corresponding security information from an MME in accordance with an exemplary embodiment of the present invention.
Referring to FIG. 5, the present exemplary embodiment is described hereafter in detail. Some optional processes and processes unrelated to the present invention are omitted.
In step 501, a UE sends a Non-Access Stratum (NAS) message, for instance an Attach or a service request, to a HeNB. Next, the HeNB sends a NAS message to the HeNB GW via an S1 Access Protocol (S1AP) message initial UE message in step 502. If a cell to which the UE seeks access is a CSG cell or hybrid cell, then the message carries a CSG ID. Continuing with step 502, the HeNB GW sends the S1AP message initial UE message to the MME. If the cell to which the UE seeks access is the CSG cell or the hybrid cell, then the message carries the CSG ID.
Next, in step 503, which is an optional step, an authentication/security process is executed. The executed security process may be identical with that of a conventional method, such as TS23.401, and thus, a detailed technical description is omitted. In step 504, the MME determines that a downlink node is an HeNB GW. A method for the MME determining that the downlink node is the HeNB GW includes the following four methods.
According to method one, the MME may distinguish the type of the entity according to a coding of the Identification (ID) of a downlink node entity, such as an ID of the eNB, an ID of the HeNB, or an ID of the HeNB GW. For instance, the ID of the eNB begins at 00, the ID of the HeNB begins at 01, and the ID of the HeNB GW begins at 10. According to method two, during an establishment of S1, an S1 establishment request message received by the MME from the downlink node carries a Tracking Area (TA) list supported by itself. The HeNB GW supports a specific TA list, and the MME knows that the downlink node is the HeNB GW according to the specific TA list. According to method three, during the establishment of S1, the S1 establishment message sent from the HeNB GW to the MME includes a BS type indication for indicating that the downlink node is the HeNB GW. A detailed description of method three is shown in FIG. 14. According to method four, the initial UE message sent from the HeNB GW in step 502 (see FIG. 5) to the MME carries a Base Station (BS) type indication for indicating that the downlink node is the HeNB GW. The indication is further used for indicating that the downlink node is the HeNB or the eNB. The method for the MME determining that the downlink node is the HeNB GW may be any one of the above four methods. However, the present invention is not limited thereto, and other suitable implementation methods that do not affect the main contents of the embodiments of the present invention may be used. Additionally, step 504 is an optional step.
Next, in step 505, the MME sends an initial context establishment request message to the HeNB GW. The message includes information elements KASME and KeNB. In step 506, the HeNB GW computes the NH according to a conventional method and saves the NH in the UE contexts and also saves the KASME and KeNB. Next, the HeNB GW sends an initial context establishment request message to the HeNB in step 507. The message includes an information element KeNB. Next, in step 508, the HeNB establishes a radio bearer between the UE and itself. In step 509, the HeNB sends an initial context establishment response message to the HeNB GW. Next, the HeNB GW sends the initial context establishment response message to the MME in step 510.
FIG. 6 is a flowchart illustrating an embodiment wherein the gateway has a function of deriving a key and obtaining updated security information from the MME in accordance with an exemplary embodiment of the present invention.
A detailed description of the embodiment is given hereafter, and optional processes and steps unrelated to the embodiment are omitted for ease of description.
Referring to FIG. 6, in step 601, a new authentication process is performed between a network and a UE. Next, in step 602, a MME sends a UE context modification request message to a HeNB GW. The UE context modification request message includes the KASME and KeNB, and the HeNB GW saves the updated KASME and KeNB. In step 603, the HeNB GW sends the UE context modification request message, including the updated KeNB, to the HeNB.
Next, the HeNB sends a UE context modification response message to the HeNB GW in step 604. In step 605, the HeNB GW sends the UE context modification response message to the MME. Next, the HeNB GW computes and saves the NH according to the new KASME and KeNB in step 606. The update of the NCC is identical with that in a conventional method. Additionally, there is no fixed or absolute sequence between the steps 603 and 606.
FIG. 7 is flowchart illustrating a first embodiment wherein the gateway has a function of deriving a key and supports a handover process in accordance with an exemplary embodiment of the present invention.
A detailed description is given hereafter and some optional processes and steps unrelated to the present invention are omitted for convenience of description.
If a target cell is a CSG cell, in a process in which a UE switches to the target cell, access control needs to be performed on the UE in order to determine whether the UE may access the target cell. If the UE cannot access the target cell, the handover process fails. If the target cell is a hybrid cell, then whether the UE is a member of the target cell should be determined. The target cell may provide different Quality of Services (QoS) according to whether the UE is a member of the target cell.
An entity executes the access control according to whether a Closed Subscriber Group (CSG) ID of the target cell is in a CSG list to which has UE access. The access control may be performed by a source HeNB, a HeNB GW or a target HeNB. Alternatively, if a source cell and the target cell are located at the same CSG, the access control may be omitted. Since the access control is not the focus of the present exemplary embodiment, a detailed description of the access control method is omitted for ease of description.
Referring to FIG. 7, in step 701, a source HeNB sends a handover required message to a HeNB GW. The handover required message includes indication information indicating whether the UE is a member of the target cell, or in other words, whether the UE is a subscribed member of the target cell. Due to the indication information being included in the handover required message, the HeNB GW notifies the target HeNB of the information indicating whether the UE is a member in step 702, as discussed below. The target HeNB may provide different QoSs according to information indicating whether the UE is a member of the target cell. However, the indication information is an optional information element and is not required in all embodiments of the present invention. For instance, the indication information may be not used in an embodiment wherein the handover process terminates at the HeNB GW in a scenario having the UE move in a same HeNB GW and with a same CSG ID, or in other words, a CSG with the same CSG ID, or a HeNB of a hybrid cell with the same CSG ID. In this scenario, the HeNB GW need not have the access control function, and the HeNB GW should only send a member ID received from a source end to a target end.
Next, in step 702, the HeNB GW determines that the handover process terminates at the HeNB GW. However, because the present exemplary embodiment does not focus on how to determine that the handover process ends at the HeNB GW, detailed descriptions thereof is omitted. Continuing with step 702, the HeNB GW adds a NCC value saved by the HeNB GW and computes a new NH according to the saved NCC value. The method for computing the NH is identical with that of a conventional method.
In step 703, the HeNB GW sends a handover request message to a T-HeNB. The message includes the newly computed NH and a current NCC value, which is the value obtained after adding 1 to a previous NCC. Next, in step 704, the T-HeNB computes a KeNB used between itself and the UE using the NH and the NCC as a pair and a Physical Cell Identity (PCI) and a frequency (EARFCN-D) of the target cell. A method of computing the KeNB is well known to one of ordinary skill in the art, and thus, detailed computation descriptions thereof are omitted. The target HeNB associates the received NCC and KeNB. The target HeNB carries the NCC of the NH-NCC pair in a handover command message sent to the UE, and deletes the old and invalid NH-NCC pair. Continuing with step 704, the target HeNB sends a handover request acknowledgement message to the HeNB GW.
In step 705, the HeNB GW sends a handover command message, which is also called a Radio Resource Control (RRC) connection reconfiguration message, to an S-HeNB. Next, in step 706, the source HeNB sends the handover command message to the UE. In step 707, the UE sends a handover acknowledgement is also call a RRC connection re-configuration completion, message to the target HeNB. Next, in step 708, the target HeNB sends a handover notification message to the HeNB GW. In step 709, the HeNB GW sends a UE context release command message to the source HeNB, and in step 710, the source HeNB sends a UE context release completion message to the HeNB GW.
FIG. 8 is a second embodiment that the gateway has the function of deriving the key and supporting the handover process in accordance with an exemplary embodiment of the present invention.
A detailed description of the present exemplary embodiment is given hereafter. Some optional processes and steps unrelated to the present exemplary embodiment are omitted for convenience of description. Similar to the description of FIG. 7, access control may be performed by an S-HeNB, HeNB GW or a T-HeNB. Alternatively, if a source cell and a target cell are located at the same CSG, the access control may be omitted. With respect to FIG. 8, detailed descriptions of the access control method are omitted for convenience of description.
Referring to FIG. 8, in step 801, the S-HeNB sends a handover request message to the T-HeNB. Although not required in all embodiments of the present invention, the message includes a CSG ID of the target cell, as well as an ID list of the CSGs to which the UE may access. Next, in step 802, the T-HeNB allocates resources and sends a handover request acknowledgement message to the source HeNB. The S-HeNB sends a handover command message to the UE in step 803. In step 804, the UE sends a handover acknowledgement message to the T-HeNB. Next, in step 805 the T-HeNB sends a path handover request message to the HeNB GW.
In step 806, the HeNB GW increments a NCC value saved by itself, and computes a new NH using the KASME and a saved NH. The method for computing the new NH is similar to the conventional method. Next, in step 807, the HeNB GW sends a path handover request acknowledgement message to the T-HeNB. The path handover request acknowledgement message includes the newly-computed NH and NCC. The T-HeNB saves the received NH-NCC pair for a next handover, and deletes previously saved NH-NCC pairs. In step 808, the target HeNB sends a resource release message to the source HeNB.
FIG. 9 is a flowchart illustrating a method for ensuring a working of a key chain when a UE moves from a HeNB GW to another HeNB GW or an eNB in accordance with an exemplary embodiment of the present invention.
Detailed descriptions of the present exemplary embodiment are given hereafter. Some optional processes and steps unrelated to the present invention are omitted for convenience of description. For example, detailed descriptions of an access control method are omitted.
Referring to FIG. 9, in step 901, an S-HeNB sends a handover required message to a HeNB GW. Next, in step 902, the HeNB GW sends a handover required message to a MME. The handover required message includes a current NH and a NCC. The HeNB GW delegates an operation for deriving the key to the MME. In step 903, the MME adds the received NCC value, and computes a new NH according to a KASME and the received NH. An algorithm for computing the new NH and NCC may be similar to that of a conventional method. Next, in step 904 a MME sends a handover request message to a target HeNB GW/eNB, and the message carries the newly computed NH and NCC.
In step 905, if a UE moves to the HeNB of another HeNB GW, the target HeNB GW sends the handover request message to the T-HeNB. The handover request message includes the NH and NCC received from the MME. The target eNB/HeNB computes a KeNB used between itself and the UE using the NH-NCC pair and a PCI and an EARFCN-D of the target cell. A method of computing the KeNB is well known, thus a detailed description is omitted herein. The T-HeNB associates the received NCC and KeNB. The T-HeNB carries the NCC of the NH-NCC pair in a handover command message sent to the UE, and deletes an old invalid NH-NCC pair. Continuing with step 905, the T-HeNB sends a handover request acknowledgement message to the HeNB GW.
In step 906, the T-HeNB GW/eNB sends the handover request acknowledgement message to the MME. Next, in step 907, the MME sends a handover command message to the source HeNB GW. The source HeNB GW sends the handover command message to the S-HeNB, and in step 908, the S-HeNB sends the handover command message to the UE. Next, in step 909, the UE sends a handover acknowledgement message to the target HeNB GW/ eNB. If the UE moves to the HeNB of another HeNB GW, the UE sends a handover acknowledgement message to the T-HeNB. The T-HeNB sends the handover acknowledgement message to the target HeNB GW.
In step 910, the target HeNB GW/eNB sends a handover notification message to the MME. Next, in step 911, the MME sends a UE context release command message to the source HeNB GW, and in step 912, the source HeNB GW sends the UE context release command message to the S-HeNB. In step 913, the S-HeNB sends the UE context release completion message to the source HeNB GW. In Step 914, the S-HeNB GW sends the UE context release completion message to the MME.
FIG. 10 is a flowchart illustrating a method for ensuring a working of a key chain when a UE moves from a HeNB GW to another HeNB GW or an eNB in accordance with an exemplary embodiment of the present invention.
Detailed descriptions of the embodiment are given hereafter. However, some optional processes and steps unrelated to the present invention are omitted for convenience of description. Similar to FIG. 9, since access control is not a focus of the present exemplary embodiment, detailed descriptions of the access control method are omitted.
Referring to FIG. 10, in step 1001, an S-HeNB sends a handover required message to the HeNB GW. Next, in step 1002, a source HeNB GW sends an X2AP handover request message to the target HeNB GW/eNB. The X2AP handover request message includes a NH and a NCC currently saved by the HeNB GW. The X2AP handover request message includes a KASME and a KeNB*. The target HeNB GW/eNB uses the KeNB* as a new encryption key between itself and a UE.
In step 1003, if the UE moves to the HeNB of another HeNB GW, the HeNB GW adds the received NCC value, and the target HeNB GW computes a new NH according to the KASME and the newly-received NH. The target HeNB GW sends the S1AP handover request message to the T-HeNB. The S1AP handover request message includes the new NH and NCC obtained by the computation. The T-HeNB allocates resources and sends a handover request acknowledgement message to the target HeNB GW.
In step 1004, the target HeNB GW/eNB sends an X2AP handover request acknowledgement message to the S-HeNB GW. In step 1005, the source HeNB GW sends a handover command message to the S-HeNB. In step 1006, the S-HeNB sends the handover command message to the UE. In step 1007, the UE sends a handover acknowledgement message to the target HeNB GW/eNB. If the UE switches to the HeNB of another HeNB GW, the UE sends the handover acknowledgement message to the target HeNB. The target HeNB sends the handover acknowledgement message to the target HeNB GW. Next, in step 1008, the target HeNB GW/eNB sends a path handover request message to the MME. The message includes the current NH and NCC. The HeNB GW allocates an operation for deriving the key to the MME.
In step 1009, the MME adds the received NCC value, and the MME computes a new NH according to the KASME and the newly-received NH. Next, in step 1010, the MME sends a path handover request acknowledgement message to the target HeNB GW/eNB. The path handover request acknowledgement message includes the new NH and NCC. In step 1011, the target HeNB GW/eNB sends an X2AP resource release message to the source HeNB GW. Next, in step 1012, the source HeNB GW sends a UE context release command message to the source HeNB. In step 1013, the S-HeNB sends the UE context release completion message to the source HeNB GW.
A second exemplary method of an exemplary embodiment of the present invention is illustrated in FIGs. 11 and 12.
FIG. 11 is a flowchart illustrating a second method for solving a security problem when a handover process terminated at a gateway in accordance with an exemplary embodiment of the present invention.
Detailed descriptions of the exemplary embodiment are given hereafter. However, some optional processes and steps unrelated to the present invention are omitted for convenience of description.
Referring to FIG. 11, in step 1101, an S-HeNB makes a handover decision, and the S-HeNB sends a handover required message to a HeNB GW. The handover required message includes a KeNB* and NCC. The S-HeNB computes a new KeNB* according to the current KeNB or a new NH, a physical cell ID of the target cell, and frequency, and other information elements used to compute the new KeNB*. The information elements of KeNB* and NCC are optional. For instance, the source HeNB only include the information elements when a target HeNB and a source HeNB connect to a same HeNB GW.
The handover required message of step 1101 includes indication information, indicating whether the UE is a member of a target cell, or in other words, whether the UE is a subscribed member of the cell or not. When the indication information is present, in step 1102, the HeNB GW notifies the T-HeNB of the information indicating whether the UE is a member of the target cell. The target HeNB may provide different QoSs according to the information indicating whether the UE is the member of the target cell. The indication information is an optional information element. For instance, for an exemplary embodiment having the handover process terminated at the HeNB GW only applies to a scenario wherein the UE moves in the same HeNB GW and with the same CSG ID (i.e. a CSG with the same CSG ID, or the hybrid cells with the same CSG ID). In this scenario, the HeNB GW needs not have the access control function, and the HeNB GW only needs to send a membership indication received from the S-HeNB to the T-HeNB.
In step 1102, the HeNB GW sends a handover request message to the T-HeNB. The handover request message includes a KeNB* and NCC received from the S-HeNB. The HeNB GW sets the NH in the handover request message as an invalid value or any value. Next, in step 1103, the T-HeNB allocates resources, and the T-HeNB takes the KeNB* as a new encryption key KeNB between itself and the UE. The T-HeNB associates the received NCC and KeNB. The T-HeNB carries the received NCC in the handover command message sent to the UE. The T-HeNB omits a value of the NH received in the handover request message. Then, continuing with step 1103, the T-HeNB sends a handover request acknowledgement message to the HeNB GW.
In step 1104, the HeNB GW sends a handover command message to the S-HeNB. In step 1105, the S-HeNB sends the handover command message to the UE. In step 1106, the UE sends a handover acknowledgement message to the target HeNB. In step 1107, the T-HeNB sends a handover notification message to the HeNB GW. Next, in step 1108, the HeNB GW sends a UE context release command message to the source HeNB. In step 1109, the S-HeNB sends a UE context release completion message to the HeNB GW.
FIG. 12 is a second embodiment illustrating the second method for solving the security problem when the handover process ends at the gateway in accordance with an exemplary embodiment of the present invention.
Detailed descriptions of the present exemplary embodiment are given hereafter. However, some optional processes and steps unrelated to the present invention are omitted for convenience of description.
Referring to FIG. 12, in step 1201, an S-HeNB makes a handover decision and the S-HeNB sends an X2AP handover request message to a HeNB GW. The X2AP handover request message includes a KeNB* and NCC. The S-HeNB computes a new KeNB* according to a current KeNB or a new NH, a physical cell ID of the target cell, and frequency, or other information. In step 1202, the HeNB GW sends the X2AP handover request message to a T-HeNB. The X2AP handover request message includes the KeNB* and NCC received from the S-HeNB.
In step 1203, the T-HeNB allocates resources and sends an X2AP handover request acknowledgement message to the HeNB GW. Next, in step 1204, the HeNB GW sends the X2AP handover request acknowledgement message to the S-HeNB. In step 1205, the S-HeNB sends a handover command message to the UE. In step 1206, the UE sends a handover acknowledgement message to the T-HeNB. In step 1207, the T-HeNB sends an S1AP handover notification message to the HeNB GW. Next, in step 1208, the HeNB GW sends an S1AP UE context release command message to the source HeNB. In step 1209, the S-HeNB sends an S1AP UE context release completion message to the HeNB GW.
The functions of steps 1207 to 1209 also can be implemented with the following steps. The T- HeNB receives the handover acknowledgement message sent from the UE, and the T-HeNB sends a path switch request message to the HeNB GW. Then, the HeNB GW sends the path switch request acknowledgement message to the target HeNB. The path switch request acknowledgement message includes invalid security contexts, such as an invalid NH and NCC pair, or invalid security information indication information. The T-HeNB does not save the received invalid NH and NCC pair according to the invalid security context information, such as the invalid NH and NCC pair, or invalid security context indication information.
In the next X2 handover process, the KeNB* is generated with a horizontal key generation mechanism, or in other words, the KeNB* is computed with a PCI of a target cell, an EARFCN-DL of the target cell and the current active KeNB. Alternatively, in the next X2 handover process, the KeNB* is generated with a vertical key generation mechanism, or in other words, the KeNB* is computed with the PCI of the target cell, the EARFCN-DL of the target cell and the existing NH. The T-HeNB sends an X2AP resource release message to the HeNB GW. The HeNB GW sends the X2AP resource release message to the S-HeNB.
FIG. 13 is a flowchart illustrating a third exemplary method for addressing a security problem when a handover process is terminated at a gateway in accordance with an exemplary embodiment of the present invention.
Detailed descriptions of the exemplary embodiment are given hereafter. However, some optional processes and steps unrelated to the present exemplary embodiment are omitted for convenience of description. As described in FIG. 12, access control may be performed by an S-HeNB, HeNB GW or T-HeNB. Alternatively, if a source cell and a target cell are located at a same CSG, the access control may be omitted. Additionally, since the access control is not the focus of the present exemplary embodiment, detailed descriptions of the access control method are omitted.
Referring to FIG. 13, in step 1301, an S-HeNB sends a handover request message to a T-HeNB. Although not required in all embodiments of the present invention, the handover request message includes a CSG ID of a target cell, an ID list of CSGs to which the UE can access, and the KeNB* and NCC pair. A method for computing the KeNB* and NCC is similar to that of a conventional method, and thus, a description thereof will be omitted for convenience of description.
In step 1302, the T-HeNB directly takes the KeNB* as a new encryption key KeNB for use between itself and the UE. The T-HeNB associates the KeNB and the received NCC. The T-HeNB carries the NCC value received from the S-HeNB in a handover command message in a transparent container from the T-HeNB to the S-HeNB, and the S-HeNB sends the NCC value to the UE. The T-HeNB sends a handover request acknowledgement message to the S-HeNB.
In step 1303. the S-HeNB sends a handover command message to the UE. Next, in step 1304, the UE sends a handover acknowledgement message to the T-HeNB. In step 1305, the T-HeNB sends a path switch request message to the HeNB GW. In step 1306, the HeNB GW sends a path switch request acknowledgement message to the T-HeNB. The path switch request acknowledgement message includes an invalid security context, such as an invalid NH and NCC pair or invalid security information indication information. Thus, the T-HeNB does not save the received invalid NH and NCC according to the invalid security context information.
In a subsequent X2 handover process, the KeNB* is generated with a horizontal key generation mechanism, or in other words, the KeNB* is computed according to a PCI of the target cell, an EARFCN-DL of the target cell, and the current active KeNB. Alternatively, in the subsequent X2 handover process, the KeNB* is generated with a vertical key generation mechanism, or in other words, the KeNB* is computed with the PCI of the target cell, the EARFCN-DL of the target cell and an existing NH. Next, in step 1307, the T-HeNB sends a resource release message to the S-HeNB.
FIG. 14 is a flowchart illustrating a method that a BS notifies a core network of a type of itself in accordance with an embodiment of the present invention.
Referring to FIG. 14, in step 1401, the HeNB, HeNB GW, or eNB sends an S1 establishment request message to the MME, and the S1 establishment request message includes a BS type indication, which is an information element for indicating that the downlink node is the HeNB GW. The information element is further used for indicating whether the downlink node is the HeNB or eNB. Next in step 1402, the MME sends an S1 establishment response message to the HeNB, HeNB GW, or eNB.
As described above and shown in corresponding figures, exemplary embodiments of the present invention provide a method for ensuring a working of a security key chain when a handover process is terminated at a HeNB GW. Thus, when the handover process is terminated at the HeNB GW, the key information will not be lost, which reduces the impact of the handover process on the core network, and improves the efficiency of the UE handover.
While the invention has been shown and described with reference to certain exemplary embodiments thereof, it will be understood by those skilled in the art that various changes in form and details may be made therein without departing from the spirit and scope of the invention as defined by the appended claims and their equivalents.
Claims (14)
- A method for obtaining a secure key, the method comprising:sending an Access Safety Management Entity Key (KASME) to a gateway after finishing authentication and security process by a Mobility Management Entity (MME) in a core network; andcomputing, by the gateway, a Next Hop (NH) according to the KASME.
- The method of claim 1, further comprising:receiving, by the gateway, a handover message which is a handover required message or a path switch request message from a Base Station (BS);obtaining, by the gateway, a new NH through the computing of the NH; andsending the new NH and a NH Change Counter (NCC) corresponding to the new NH to the BS.
- The method of claim 1, further comprising:sending, by the MME, of updated KASME and an Evolved NodeB (KeNB) to the gateway; andsaving, by the gateway, the updated KASME and KeNB, and sending the updated KeNB to the Home Evolved NodeB (HeNB).
- The method of claim 3, wherein the MME sends the KASME and KeNB to the gateway through an initial context establishment request message or a User Equipment (UE) context modification request message.
- The method of claim 1, when a User Equipment (UE) handover occurs between a source BS and a target BS, the method further comprises:sending, by the gateway, a most current NH and a NH Change Counter (NCC) corresponding to the most current NH to the MME in the core network; andcomputing, by the MME in the core network, a new NH according to the received NH, and sending the new NH and the corresponding NCC to the target BS.
- The method of claim 5, wherein the gateway sends the most current NH and NCC to the MME in the core network through a handover required message.
- The method of claim 1, wherein when a User Equipment (UE) moves from a source gateway to one of a target gateway and a target BS, the method further comprises:sending, by the source gateway, the KASME, a most current NH and a NH Change Counter (NCC) to the target gateway or the target BS;sending, by the target gateway or target BS, the most current NH and the NCC to the MME in the core network; andcomputing, by the MME in the core network, a new NH according to the most current NH,wherein the source gateway sends the KASME, the new NH and the NCC to the target gateway or target BS through a handover request message of an X2 interface, andwherein the target network sends the new NH and the NCC to the MME in the core network through a path handover request message of an S1 interface.
- A method for obtaining a secure key, the method comprising:sending, by a source Base Station (BS), a handover required message which includes an Evolved NodeB Key (KeNB*) and a corresponding Next Hop (NH) Change Counter NCC of the NH computed by the source BS, to a gateway;sending, by the gateway, a handover request message which includes the KeNB* and the corresponding NCC to a target BS; andtaking, by the target BS, the KeNB* as a new key used between the target BS and a User Equipment UE.
- A communication system for obtaining a secure key, the system comprising:a Mobility Management Entity (MME) for sending an Access Safety Management Entity Key (KASME) to a gateway after completing an authentication and security process in a core network,wherein the gateway computes a Next Hop (NH) according to the KASME.
- The system of claim 9, wherein the gateway receives a handover message that is one of a handover required message and a path switch request message from a Base Station (BS),wherein the gateway obtains a new NH through the computing of the NH, andwherein the gateway sends the new NH and a NH Change Counter (NCC) corresponding to the new NH to the BS.
- The system of claim 9, wherein the MME sends an updated KASME and an Evolved NodeB Key (KeNB) to the gateway,wherein the gateway saves the updated KASME and KeNB,wherein the gateway sends the updated KeNB to a Home Evolved NodeB (HeNB), andwherein the MME sends the KASME and the KeNB to the gateway through one of an initial context establishment request message and a User Equipment (UE) context modification request message.
- The system of claim 9, wherein when a User Equipment (UE) handover between a source Base Station (BS) and a target BS occurs, the gateway sends a current NH and a current NH Change Counter (NCC) to the MME in the core network, andthe MME computes a new NH according to the a current NH, and sends the new NH and a corresponding NCC to the target BS,wherein the gateway sends the new NH and the corresponding NCC to the MME in the core network through a handover required message.
- The system of claim 9, wherein when a User Equipment (UE) moves from a source gateway to a target gateway or a target Base Station (BS),the source gateway sends the KASME, the current NH and a corresponding NH Change Counter (NCC) to the target gateway or the target BS;the target gateway or target BS sends the newest NH and NCC to the MME in the core network; andthe MME in the core network computes a newest NH according to the current NH,wherein the source gateway sends the KASME, the new NH and the corresponding NCC to the target gateway or the target BS through a handover request message of an X2 interface,wherein the target network sends the new NH and the corresponding NCC to the MME in the core network through a path handover request message of an S1 interface.
- A communication system for obtaining a secure key, the system comprising:a source Base Station (BS) for sending a handover required message including an Evolved NodeB Key (KeNB*) and a Next Hop (NH) Change Counter (NCC) corresponding to the NH computed by the source BS, to a gateway,wherein the gateway sends a handover request message including the KeNB* and the corresponding NCC to a target BS, and wherein the target BS takes the KeNB* as a new key used between the target BS and a User Equipment (UE).
Priority Applications (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
EP11780785.9A EP2569894B1 (en) | 2010-05-10 | 2011-05-09 | Method and system for positioning mobile station in handover procedure |
AU2011251106A AU2011251106B2 (en) | 2010-05-10 | 2011-05-09 | Method and system for positioning mobile station in handover procedure |
Applications Claiming Priority (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
CN2010101792936A CN102244862A (en) | 2010-05-10 | 2010-05-10 | Method for acquiring security key |
CN201010179293.6 | 2010-05-10 |
Publications (2)
Publication Number | Publication Date |
---|---|
WO2011142568A2 true WO2011142568A2 (en) | 2011-11-17 |
WO2011142568A3 WO2011142568A3 (en) | 2012-03-01 |
Family
ID=44901941
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
PCT/KR2011/003440 WO2011142568A2 (en) | 2010-05-10 | 2011-05-09 | Method and system for positioning mobile station in handover procedure |
Country Status (6)
Country | Link |
---|---|
US (1) | US9237442B2 (en) |
EP (1) | EP2569894B1 (en) |
KR (1) | KR101813602B1 (en) |
CN (1) | CN102244862A (en) |
AU (1) | AU2011251106B2 (en) |
WO (1) | WO2011142568A2 (en) |
Families Citing this family (23)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN101400071A (en) * | 2007-09-29 | 2009-04-01 | 北京三星通信技术研究有限公司 | Method for configuring MME |
US8699461B2 (en) * | 2011-08-19 | 2014-04-15 | Hitachi, Ltd. | Optimized home evolved NodeB (eNB) handover in an LTE network |
CN103139771B (en) * | 2011-11-25 | 2018-03-30 | 中兴通讯股份有限公司 | Key generation method and system in handoff procedure |
US9276810B2 (en) * | 2011-12-16 | 2016-03-01 | Futurewei Technologies, Inc. | System and method of radio bearer management for multiple point transmission |
CN103188663B (en) | 2011-12-27 | 2016-08-03 | 华为技术有限公司 | The safe communication method of carrier aggregation and equipment between base station |
WO2013137461A1 (en) * | 2012-03-16 | 2013-09-19 | 京セラ株式会社 | Communication control method, base station, home base station, and gateway device |
CN103379564B (en) * | 2012-04-20 | 2016-08-03 | 电信科学技术研究院 | A kind of Intra-cell handover method and device |
US9538450B2 (en) * | 2012-08-03 | 2017-01-03 | Futurewei Technologies, Inc. | System and method for mobile relay packet gateway relocation for path optimization |
EP2896233A4 (en) * | 2012-09-12 | 2016-05-11 | Nokia Technologies Oy | Method and apparatus for mobility control in a heterogenous network |
EP2912867A1 (en) | 2012-10-29 | 2015-09-02 | Nokia Solutions and Networks Oy | Methods, apparatuses and computer program products enabling to improve handover security in mobile communication networks |
CN110290523B (en) | 2012-12-28 | 2022-12-27 | 北京三星通信技术研究有限公司 | Method for configuring and transmitting encryption keys |
CN104919834B (en) | 2013-01-11 | 2018-10-19 | Lg 电子株式会社 | Method and apparatus for applying security information in a wireless communication system |
CN103929740B (en) * | 2013-01-15 | 2017-05-10 | 中兴通讯股份有限公司 | Safe data transmission method and LTE access network system |
GB2509937A (en) | 2013-01-17 | 2014-07-23 | Nec Corp | Providing security information to a mobile device in which user plane data and control plane signalling are communicated via different base stations |
WO2014156121A1 (en) * | 2013-03-29 | 2014-10-02 | 日本電気株式会社 | Communication device and handover control method in radio communication system |
CN104349309B (en) * | 2013-07-25 | 2019-11-12 | 北京三星通信技术研究有限公司 | Using NH, NCC to the method for solving safety problem in a kind of mobile communication system |
EP2965554B1 (en) * | 2013-09-11 | 2019-07-24 | Samsung Electronics Co., Ltd. | Method and system to enable secure communication for inter-enb transmission |
KR102092739B1 (en) * | 2013-09-27 | 2020-03-24 | 삼성전자 주식회사 | Method and apparatus to establish efficiently security association between small cell enb and ue in the mobile communication system |
CN105850167B (en) * | 2013-12-24 | 2019-07-23 | 日本电气株式会社 | Equipment, system and method used in SCE |
US9467910B2 (en) * | 2014-07-11 | 2016-10-11 | Luminate Wireless, Inc. | Handover methods and apparatus |
CN108270560B (en) * | 2017-01-03 | 2023-06-09 | 中兴通讯股份有限公司 | Key transmission method and device |
CN109511113B (en) | 2017-07-28 | 2020-04-14 | 华为技术有限公司 | Security implementation method, related device and system |
CN110913438B (en) * | 2018-09-15 | 2021-09-21 | 华为技术有限公司 | Wireless communication method and device |
Family Cites Families (17)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20020146127A1 (en) * | 2001-04-05 | 2002-10-10 | Marcus Wong | System and method for providing secure communications between wireless units using a common key |
JP4466434B2 (en) * | 2005-03-30 | 2010-05-26 | パナソニック株式会社 | Routing method and home agent |
US7734052B2 (en) * | 2006-09-07 | 2010-06-08 | Motorola, Inc. | Method and system for secure processing of authentication key material in an ad hoc wireless network |
US9049592B2 (en) * | 2006-09-18 | 2015-06-02 | Intel Corporation | Techniques for key derivation for secure communication in wireless mesh networks |
US20080089519A1 (en) * | 2006-10-12 | 2008-04-17 | Nokia Corporation | Secure key exchange algorithm for wireless protocols |
US8718646B2 (en) * | 2006-12-21 | 2014-05-06 | Alcatel Lucent | Methods and apparatus for distributed multimedia content supporting user mobility |
FI20070157A0 (en) | 2007-02-23 | 2007-02-23 | Nokia Corp | Fast authentication of update messages with key differentiation on mobile IP systems |
CN101309500B (en) * | 2007-05-15 | 2011-07-20 | 华为技术有限公司 | Security negotiation method and apparatus when switching between different wireless access technologies |
CN101378591B (en) * | 2007-08-31 | 2010-10-27 | 华为技术有限公司 | Method, system and device for negotiating safety capability when terminal is moving |
US7957533B2 (en) * | 2007-10-02 | 2011-06-07 | Alcatel-Lucent Usa Inc. | Method of establishing authentication keys and secure wireless communication |
JP4977665B2 (en) * | 2007-10-26 | 2012-07-18 | 株式会社日立製作所 | Communication system and gateway device |
EP2053886A3 (en) | 2007-10-26 | 2015-03-25 | Hitachi, Ltd. | Communication system and gateway apparatus |
US8208635B2 (en) * | 2007-11-13 | 2012-06-26 | Rosemount Inc. | Wireless mesh network with secure automatic key loads to wireless devices |
MX2010010184A (en) * | 2008-04-04 | 2010-11-05 | Nokia Corp | Methods, apparatuses, and computer program products for providing multi-hop cryptographic separation for handovers. |
CN101267668B (en) | 2008-04-16 | 2015-11-25 | 中兴通讯股份有限公司 | Key generation method, Apparatus and system |
US9706395B2 (en) * | 2008-04-28 | 2017-07-11 | Nokia Technologies Oy | Intersystem mobility security context handling between different radio access networks |
WO2010120689A2 (en) * | 2009-04-14 | 2010-10-21 | Interdigital Patent Holdings, Inc. | Method and apparatus for processing emergency calls |
-
2010
- 2010-05-10 CN CN2010101792936A patent/CN102244862A/en active Pending
-
2011
- 2011-05-09 WO PCT/KR2011/003440 patent/WO2011142568A2/en active Application Filing
- 2011-05-09 AU AU2011251106A patent/AU2011251106B2/en not_active Ceased
- 2011-05-09 KR KR1020110043593A patent/KR101813602B1/en active IP Right Grant
- 2011-05-09 EP EP11780785.9A patent/EP2569894B1/en not_active Not-in-force
- 2011-05-09 US US13/103,333 patent/US9237442B2/en not_active Expired - Fee Related
Non-Patent Citations (3)
Title |
---|
"3rd Generation Partnership Project; Technical Specification Group Radio Access Network; Evolved Universal Terrestrial Radio Access (E-UTRA) and Evolved Universal Terrestrial Radio Access Network (E-UTRAN", OVERALL DESCRIPTION, 20 April 2010 (2010-04-20), pages 1 - 149 |
"Solution discussion for optimized (H)eNB-to-HeNB mobility", 3GPP DRAFT; R3-101473, 30 April 2010 (2010-04-30) |
See also references of EP2569894A4 |
Also Published As
Publication number | Publication date |
---|---|
US9237442B2 (en) | 2016-01-12 |
AU2011251106B2 (en) | 2015-01-15 |
KR101813602B1 (en) | 2017-12-29 |
AU2011251106A1 (en) | 2012-11-08 |
EP2569894A2 (en) | 2013-03-20 |
WO2011142568A3 (en) | 2012-03-01 |
KR20110124162A (en) | 2011-11-16 |
EP2569894B1 (en) | 2019-01-09 |
EP2569894A4 (en) | 2017-01-11 |
US20110274276A1 (en) | 2011-11-10 |
CN102244862A (en) | 2011-11-16 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
WO2011142568A2 (en) | Method and system for positioning mobile station in handover procedure | |
WO2016114623A1 (en) | Handover method and apparatus | |
WO2015115761A1 (en) | Method and apparatus for ue mobility in a small cell system | |
WO2015108389A1 (en) | Dual connectivity mode of operation of a user equipment in a wireless communication network | |
WO2011136534A2 (en) | A handover method and apparatus in a mobile communication system | |
WO2011136530A2 (en) | Apparatus and method for x2 interface setup and cell switching in mobile communication system | |
WO2011021889A2 (en) | Method for transmitting and receiving information of relation between home base stations | |
WO2012002709A2 (en) | Wireless communication system and method for performing handover in such a system | |
WO2014129783A1 (en) | Method and system for providing simultaneous connectivity between multiple e-nodebs and user equipment | |
WO2014098470A1 (en) | Method and apparatus for configuring aggregate maximum bit rate | |
WO2011136529A2 (en) | Apparatus and method for supporting gateway node reselection in communication system | |
WO2010101442A2 (en) | Group handover method and apparatus in broadband wireless communication system that supports mobile relay station | |
WO2012093905A2 (en) | Method and apparatus for supporting user equipment mobility in a wireless communication system | |
WO2009107950A2 (en) | Method for supporting ue mobility between macro cell and hnb cell | |
WO2015037947A1 (en) | Method and device for setting up local breakout bearers | |
WO2014051379A1 (en) | Method and apparatus for performing a handover in a wireless communication system | |
WO2015020366A1 (en) | Methods, systems and devices for supporting local breakout in small cell architecture | |
WO2014051402A1 (en) | A method and apparatus for setting up an x2 connection through a gateway | |
WO2011074785A2 (en) | Method and apparatus for performing handover in consideration of authentication procedure | |
WO2013137684A1 (en) | Apparatus and method for supporting handover to csg cell or hybrid cell | |
WO2015111978A1 (en) | Method for controlling, charging, and positioning a ue in a small cell system | |
WO2014104853A1 (en) | Method for synchronizing encryption information between scell and ue | |
WO2014148762A1 (en) | Switch supporting method | |
WO2014104849A1 (en) | Method for configuring and transmitting key | |
WO2010064859A2 (en) | Method for changing gan controller with which a terminal is registered based on location of the terminal which is moving |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
121 | Ep: the epo has been informed by wipo that ep was designated in this application |
Ref document number: 11780785 Country of ref document: EP Kind code of ref document: A2 |
|
ENP | Entry into the national phase |
Ref document number: 2011251106 Country of ref document: AU Date of ref document: 20110509 Kind code of ref document: A |
|
WWE | Wipo information: entry into national phase |
Ref document number: 2011780785 Country of ref document: EP |
|
NENP | Non-entry into the national phase |
Ref country code: DE |