WO2013075417A1

WO2013075417A1 - Method and system for generating key during handover

Info

Publication number: WO2013075417A1
Application number: PCT/CN2012/071474
Authority: WO
Inventors: 曹岚健; 余万涛
Original assignee: 中兴通讯股份有限公司
Priority date: 2011-11-25
Filing date: 2012-02-22
Publication date: 2013-05-30
Also published as: CN103139771A; CN103139771B

Abstract

Disclosed are a method and system for generating a key during handover. The method comprises: during UE handover, a network side using a next hop parameter NH to generate a next hop key KeNB, the NH generated by the network side being not notified to a base station; the network side and the UE side each using the value of a next hop counter NCC notified by a target base station to synchronize the next hop key KeNB; the network side notifying the generated next hop key KeNB to the target base station. The base station cannot obtain any NH, and therefore cannot generate the next hop key KeNB, so as to eliminate the possibility of illegally obtaining the next hop key KeNB, thereby ensuring forward security. The present invention significantly improves the security of a communications system.

Description

Key generation method and system in handover process

The present invention relates to a key generation technique, and in particular, to a key generation method and system in a handover process. Background technique

The 3rd Generation Partnership Project (EPS) evolved packet system (EPS, Evolved Packet System) is an Evolved Universal Terrestrial Radio Access Network (E-UTRAN) and EPS core. Evolved Packet Core. E-UTRAN base station apparatus an evolved Node B (eNB, Evolved Node B) composition, EPS core network including a mobility management entity (MME, Mobility Management Entity) ₀ user equipment (UE, User Equipment) through the wireless air interface and eNB Communication, and communication with the MME through the eNB.

In the communication protocol architecture of the Long Term Evolution (LTE) system, the protocol layer is divided into an access layer (AS, Access Stratum) and a non-access stratum (NAS, Non Access Stratum). The EPS system is designed with a two-layer security protection mechanism, that is, the EPS system requires AS and NAS to use different security keys respectively.

After the authentication and key agreement (AKA) process between the UE and the MME, the root key Kasme is negotiated. The UE and the MME respectively save the root key Kasme and evolve the AS security key and the NAS security key respectively through Kasme.

The handover procedure of E-UTRAN supports handover between inter-eNB (Inter-eNB) and radio access (Inter-RAT). Inter-RAT handover is supported by the S1 interface handover signaling procedure; Inter-eNB handover is supported by the S1 or X2 interface handover signaling procedure. Usually the system performs handover between eNBs using the X2 interface. The key generation and distribution process in the current latest handover process is as follows:

During the initial process, the UE sends an initial NAS message to the MME to initiate the conversion from the ECM-IDLE state to the ECM-CON ECTED state. The MME initial NAS message includes the updated NAS COUNT and the key KeNB generated according to its own Kasme.

The MME initializes the next hop chaining counter (NCC, Next hop Chaining Counter) value.

0.

The MME generates the next hop It (NH, Next Hop Parameter) using the initially generated KeNB and its own saved Kasme, and updates the NCC value to 1. The MME binds the generated NH and the updated NCC value to {NH, NCC=1 } pairs and saves { NH, NCC=1}.

The MME transmits the KeNB to the eNB, and the eNB uses the KeNB received from the MME as the initial key. The eNB sends an AS security mode command to the UE, and the UE derives the KeNB using the NAS uplink COUNT value and its own saved Kasme.

At the first X2 handover, the source eNB calculates KeNB* according to the KeNB and transmits {KeNB*, NCC=0} to the target eNB. The target eNB sends NCC=0 to the UE, and the UE compares its own NCC value with the NCC value of the target eNB to ensure that the updated KeNB and the target eNB remain consistent. The MME updates the NCC value and uses the old NH and Kasme to calculate the new NH, updating the {NH, NCC=1 } pair to the {NH, NCC=2} pair. The MME sends a { NH, NCC=2} pair to the target eNB, and the target eNB saves the received { NH, NCC} pair.

In the second X2 handover, the source eNB calculates KeNB* according to its saved NH and transmits {KeNB*, NCC=2} to the target eNB. The target eNB sends NCC=2 to the UE, and the UE compares its own NCC value with the NCC value of the target eNB to ensure that the updated KeNB and the target eNB are consistent. The MME updates the NCC value and uses the old NH and Kasme to calculate the new NH, updating the {NH, NCC=2} pair to the {NH, NCC=3} pair. The MME transmits a { NH, NCC=3} pair to the target eNB, and the target eNB holds the received { NH , NCC} pair.

The key generation and distribution process during the first X2 handover in the above scheme is not the first X2 cut Inconsistent key generation and distribution processes result in additional resource consumption.

In the above solution, the source eNB derives the key KeNB of the target eNB and sends it to the target eNB. The source eNB may derive the key KeNB when the UE next hops, which may be utilized, thereby causing security risks of the communication system. Summary of the invention

In view of this, the main object of the present invention is to provide a key generation method and system in a handover process, which can avoid the key KeNB determined by the base station to determine the next hop in the UE handover process, and ensure the security of the communication system.

In order to achieve the above object, the technical solution of the present invention is achieved as follows:

A key generation method in a handover process, comprising:

During the UE handover process, the network side uses the NH to generate a next hop key KeNB; wherein the NH generated by the network side does not notify the base station.

Preferably, the method further includes:

The network side and the UE side respectively synchronize the next hop key KeNB with the next hop counter NCC value notified by the target base station; the network side notifies the generated next hop key KeNB Target base station.

Preferably, the using the NH to generate a next hop key KeNB is:

The next hop key KeNB is generated using the NH, the cell identity of the target base station, and the target universal terrestrial radio access UTRA downlink carrier frequency number.

Preferably, the method further includes:

The initial next hopping key KeNB is generated by the network side based on the root key Kasme and the non-access stratum uplink counter NAS UL COUNT value; the network side initializes the NH according to the root keys Kasme and KeNB.

Preferably, the method further includes:

The target base station will receive the next hop counter NCC value from the source base station and the target base station The selected encryption and integrity protection algorithm notifies the UE by the source base station;

Determining, by the UE, the NH corresponding to the currently received NCC value, and generating a new next hopping key KeNB according to the determined NH, and generating a user plane according to the new next hopping key KeNB And the encryption and decryption key and integrity key of the signaling plane.

Preferably, the method further includes:

After receiving the handover confirmation of the UE, the target base station notifies the network side of the NCC value received from the source base station;

Determining, by the network side, NH corresponding to the currently received NCC value, and generating a new next hopping key KeNB according to the determined NH, and notifying the target node of the new next hopping key KeNB ;

The target base station generates an encryption and decryption key and an integrity key for the user plane and the message plane, respectively, based on the received next hop key KeNB.

Preferably, the network side is a mobility management unit MME.

Preferably, the method further includes:

The source MME determines the NH corresponding to the NCC value received from the source base station, and sends the received NCC value and its corresponding NH to the target MME;

The target MME generates a next hop key KeNB according to the received NH, and increments the NCC value by one, and notifies the target base station of the next hop key KeNB and the added NCC value; the target base station selects encryption. And an integrity algorithm, and notifying the UE by the encryption and integrity algorithm and the received NCC value through the target MME, the source MME, and the source base station;

The UE determines an NH corresponding to the currently received NCC value, and generates a new next hop key KeNB according to the determined NH.

A key generation system in a handover process, including an MME, a base station, and a UE, where: in the UE handover process, the MME uses the NH to generate a next hop key KeNB; wherein the NH generated by the MME does not notify the base station. Preferably, the MME and the UE side respectively synchronize the next hop key KeNB with the NCC value notified by the target base station; and the MME notifies the generated next hop key KeNB to the target base station. .

Preferably, the UE and the MME generate a next hop key KeNB by using the NH, the cell identifier of the target base station, and the target UTRA downlink carrier frequency number.

Preferably, the MME is further configured to: generate an initial next hop key KeNB according to the root key Kasme and NAS UL COUNT values; and the root keys Kasme and KeNB initialize the NH.

Preferably, the target base station is configured to notify the UE by the source base station by using an NCC value received from the source base station and an encryption and integrity protection algorithm selected by the target base station;

The UE is configured to determine an NH corresponding to the currently received NCC value, generate a new KeNB according to the determined NH, and generate an encryption and decryption key and an integrity key according to the new KeNB.

Preferably, the target base station is configured to: after receiving the handover confirmation of the UE, notify the MME of the NCC value received from the source base station; and generate an encryption and decryption key and an integrity key according to the KeNB received from the MME. Key

The MME is configured to determine an NH corresponding to the currently received NCC value, generate a new KeNB according to the determined NH, and notify the target KeNB of the new KeNB.

Preferably, the source MME is configured to determine an NH corresponding to the NCC value received from the source base station, and send the received NCC value and its corresponding NH to the target MME;

The target MME is configured to generate a KeNB according to the received NH, and increase the NCC value by one, and notify the target base station of the KeNB and the added NCC value;

The target base station is configured to: select an encryption and integrity algorithm, and notify the UE of the encryption and integrity algorithm and the received NCC value by the target MME, the source MME, and the source base station;

The UE is configured to determine an NH corresponding to the currently received NCC value, and generate a new KeNB according to the determined NH. In the present invention, in the UE handover process, the UE and the MME use the NH to generate the next hop key KeNB; and the NH generated by the MME is not notified to the base station. In this way, since the base station cannot acquire the NH, the next hop key KeNB cannot be generated, and the possibility of illegally acquiring the next hop key KeNB is avoided, and forward security is ensured. The invention greatly enhances the security of the communication system. DRAWINGS

1 is a flowchart of key generation in an X2 handover process between eNBs in a long term evolution system according to an embodiment of the present invention;

2 is a flowchart of key generation for the first handover to the X2 handover procedure according to an embodiment of the present invention; FIG. 3 is a key generation process during an X2 handover procedure in a case where a UE, an eNB, and an MME have a security context according to an embodiment of the present invention; Flow chart

FIG. 4 is a flowchart of key generation in S1 handover according to an embodiment of the present invention. detailed description

The basic idea of the present invention is: In the X2 handover process, the source eNB no longer derives the next hop key for the target eNB, and the source eNB only provides the target eNB with the next hop counter NCC value. The target eNB uses the NCC value to keep the NHs in the UE and the MME in synchronization, so that the same KeNB is stored in the UE and the MME. The target eNB applies for the same KeNB as the UE to the MME by using the NCC value, so that the KeNB of the UE and the KeNB of the UE are kept consistent. During the handover, the NH does not leave the MME, the eNB cannot obtain the NH, and the eNB does not have the ability to derive the NH (the calculation NH must have the Kasme). Therefore, the source eNB cannot obtain the KeNB of the target eNB in the next hop, and solves the forward security. problem.

The present invention will be further described in detail below with reference to the accompanying drawings.

1 is a dense process in an X2 handover process between eNBs in a long term evolution system according to an embodiment of the present invention; The key generation flowchart is as shown in FIG. 1. In the embodiment of the present invention, the key generation and distribution process in the X2 handover process between the LTE base station eNBs specifically includes the following steps:

Step 101: In the initial process, the MME does not send the NH to the source eNB, and the MME only sends the NCC value to the source e

Here, the initial procedure refers to the process of establishing an AS security context in the source eNB before the X2 handover occurs. The AS security context already exists in the source eNB before the X2 handover occurs on the source eNB. The process of establishing the security context may be an initial connection request (such as an attach request, a Tracking Area Update (TAU) request, etc.), Intra. - eNB handover, X2 handover, S1 handover or Inter-RAT handover, and the like. In these processes, the MSC sends an NCC value to the source eNB in the AS security context sent to the eNB.

Step 102: The source eNB sends an X2 handover request to the target eNB, that is, the source eNB sends an X2 handover request message to the target eNB, where the X2 handover request message includes an NCC value. Here, the NCC value is the NCC value that the MME sends to the source eNB in step 101.

Step 103: The target eNB sends the NCC value to the UE and the MME, and the UE and the MME synchronize the NH by using the NCC value, and use the NH to generate the same KeNB.

The target eNB notifies the UE of the NCC value in the handover command by the source eNB, and the UE compares the NCC value obtained from the target eNB with the NCC value saved by itself, and uses the NCC value obtained from the target eNB and the NCC value saved by itself. The difference between the NHs is synchronized. Here, the so-called synchronization means that the NCC value stored in the general UE is smaller than the NCC value notified by the network side, and the KeNB needs to be generated using the NCC value notified by the network side.

The target eNB notifies the MME of the NCC value in the path switch request, and the MME compares the NCC value obtained from the target eNB with the NCC value saved by itself, using the NCC value obtained from the target eNB and the NCC value saved by itself. The difference is NH synchronized. In general, the NCC values stored in the MME and the NCC values obtained from the target eNB in the present invention should be equal. This step can ensure that the same {NH, NCC} pair is present at the UE and the MME. After generating the KeNB, the UE uses the KeNB to generate an RRC/UP encryption and decryption key and an integrity key for data and signaling, respectively.

Step 104: The MME will generate a KeNB by using the synchronized NH, and the KeNB is consistent with the KeNB saved in the UE.

The MME carries the KeNB in the path switch request response message and sends the KeNB to the target eNB. The target eNB uses the KeNB to generate an RRC/UP encryption/decryption key and a integrity key for data and signaling, respectively. The RRC/UP encryption and decryption key and the integrity key are consistent with the RRC/UP plus decryption key and integrity key derived in the UE.

2 is a flow chart of key generation for the first handover to the X2 handover procedure according to an embodiment of the present invention, and FIG. 2 is a first handover initiated by an eNB that establishes a connection with the UE after establishing an initial connection, where The first switching process is the X2 switching process. As shown in FIG. 2, this embodiment is a complete process of key generation and key distribution in the X2 handover process, and specifically includes the following steps: Step 200: Establish an initialization AS security context in the UE and the MME, and the purpose is to initialize NH. The MME transmits the NCC value to the source eNB through the SI AP Initialization Context Setup Request message; the UE initializes the {NH, NCC} pair and initializes the KeNB.

In step 200, initial AS security is established in the MME. Specifically, the MME derives KeNB, KeNB=KDF (Kasme, NAS UL COUNT ) according to the Kasme and NAS uplink counters. The NAS UL COUNT is the NAS uplink counter in the initial connection request; if there is an Authentication Key Agreement (AKA) procedure before the AS SMC procedure, the NAS UL COUNT is the NAS uplink counter in the AKA procedure. KDF represents a key algorithm. Specifically, the information corresponding to Kasme and NAS UL COUNT is sequentially arranged as a key.

In step 200, NH is initialized. Specifically, after obtaining the KeNB, the MME calculates NH according to Kasme and KeNB, and adds 1 to the NCC value, and then NCC=1. The MME saves the latest {Li, NCC} pairs. In the step 200, the NCC value is sent to the eNB. Specifically, the eNB sends an SI AP initial context setup request message to the eNB, where the NCC value is carried in the SI AP initial context setup request message, and is sent by the MME to the eNB. The eNB is the source eNB in the X2 handover procedure.

The MME does not send NH to the eNB.

In step 200, the MME sends the NCC value to the eNB. Specifically, after receiving the NCC value sent by the MME, the eNB saves the NCC value.

In step 200, the UE initializes the {NH, NCC} pair and initializes the KeNB. Specifically, the radio bearer is established between the eNB and the UE, and the UE initializes NCC=0; the initial hop key is initialized to NH=void; The Kasme and NAS uplink counters derive KeNB, KeNB = KDF (Kasme, NAS UL COUNT ).

Step 201: The UE sends a measurement report to the source eNB. The source eNB decides to initiate an X2 handover to the target eNB through the measurement report.

Step 202: The source eNB sends a handover request to the target eNB, and the source eNB sends the next hop counter NCC value saved by itself to the target eNB in the handover request. In this embodiment, the source eNB holds NCC=1. In this step, the source eNB also forwards the current AS security context of the source eNB and the security capability of the UE to the target eNB.

Step 203: After receiving the handover request message of the source eNB, the target eNB saves the received NCC value. NCC=1. The target eNB also selects an RRC/UP encryption and integrity protection algorithm based on the received UE security capabilities.

Step 204: The target eNB performs a handover request response message to the source eNB. The handover request response message includes a transmission container, where the transmission container includes an NCC value saved by the target eNB, and an encryption and integrity protection algorithm identifier selected by the target eNB (EIA). , EEA), etc.

Step 205: The source eNB sends a handover command to the UE, where the handover command includes the transmission container received from the target eNB in step 204. The source eNB encrypts and integrity protects the message using the current AS security context. Step 206: After receiving the handover command sent by the source eNB, the UE decrypts and completes the message using the current AS security context.

The UE extracts the NCC value therein. The UE compares the NCC value received from the source eNB with the NCC value it holds. The UE synchronizes its own {NH, NCC} pair to the {NH, NCC} pair corresponding to the received NCC value according to the difference between the NCC value received from the source eNB and the NCC value saved by itself. The UE saves the {NH, NCC} pair generated by this synchronization.

Step 207: After the UE synchronizes the NH, the UE calculates the KeNB by using the NH. The calculation method is KeNB*=KDF (NH, PCI, EARFCN DL), PCI is the cell identifier of the target eNB, EARFCN-DL target E-UTRA downlink carrier frequency number, the UE can measure the target PCI and the target EARFCN DL; then use KeNB * Update KeNB, KeNB = KeNB *.

The UE calculates an RRC/UP encryption/decryption key and an integrity key for data and signaling according to the received EEA, EIA, and the KeNB updated by itself, and replaces the current AS security context.

Step 208: The UE sends a handover confirmation message to the target eNB. This message is protected by the current AS security context of the UE, and the current AS security context of the UE has been updated in step 207.

Step 209: The target eNB sends a path switch request message to the MME. The target eNB notifies the MME of the NCC value saved by itself. The NCC value is the same as the NCC value received by the UE in step 206; the target eNB also sends its PCI and EARFCN_DL to the MME for deriving KeNB*.

Step 210: After receiving the path switch message from the target eNB, the MME extracts the NCC value. The MME compares the received NCC value with the NCC value saved by itself. If the MME is the same, the MME will take out the NH in the {NH, NCC} pair associated with the NCC value; if different, the MME will calculate and receive the received The NH associated with the NCC value.

In the present invention, it can be ensured that the NCC value stored in the MME is greater than or equal to the NCC value received from the target eNB, and the MME stores the NH associated with the NCC value.

Step 211: After the MME is synchronized, the MME obtains the KeNB by using the NH calculation. Calculation The method is KeNB*=KDF (NH, PCI, EARFCN DL), where PCI and EARFCN-DL are the PCI and EARFCN-DL of the target eNB; then KeNB* is used to update KeNB, KeNB=KeNB*.

Step 212: After calculating the KeNB, the MME calculates a {NH, NCC} pair of the next hop. First, the NCC value is increased by 1; secondly, NH, NH = KDF (NH old, Kasme ) is calculated, where NH_old is the previous NH stored in the MME. This newly calculated {NH, NCC} pair will be used for the next hop key update.

Step 213: The MME sends a path switch request response message to the target eNB, where the path switch request response message carries a new NCC value and the KeNB calculated in step 211. The NCC value will be used for the NH synchronization between the UE and the MME of the next hop; the KeNB is consistent with the KeNB held in the UE. The KeNB will be used by the target eNB to generate RRC/UP encryption and decryption keys and integrity keys for data and signaling.

Step 214, the target eNB will save the new NCC value, and calculate the RRC/UP encryption and decryption key and the integrity key using the KeNB and the EEA and EIA selected by the KeNB. The target eNB will decrypt and verify the handover acknowledgment message received in step 208 using the newly generated AS security context.

Step 215: The target eNB sends a release resource message to the source eNB. After receiving the release resource message from the target eNB, the source eNB deletes all AS-related security contexts associated with the UE.

FIG. 3 is a flowchart of key generation in an X2 handover process in a case where a UE, an eNB, and an MME have a security context according to an embodiment of the present invention, and FIG. 3 is that an AS security context is already present between the UE and the source eNB before the X2 handover is performed. The MME also has a partial AS security context. These security contexts are generated by signaling interactions between previous UEs, eNBs, and MMEs. These signaling interactions may be previous initial connection procedures, handover procedures, and the like. This embodiment is a complete flow of key generation and key distribution in the X2 handover process in the case where the UE, the eNB, and the MME have a security context. The process includes the following steps:

Before the UE initiates the measurement report, the UE holds the {NH, NCC} pair, which is denoted as NCCJJE; the source eNB has an NCC value, which is denoted as NCC_eNB; and the MME holds the {NH, NCC} pair, which is denoted as NCC-MME. The previous signaling interaction process can ensure that the NCC-UE is less than or equal to the NCC-eNB; and the NCC-eNB is less than or equal to the NCC-MME.

Step 301: The UE sends a measurement report to the source eNB. The source eNB decides to initiate an X2 handover to the target eNB through the measurement report.

Step 302, the source eNB requests the target eNB sends a handover message to the handover request message carries an active saved _e NB _NCC- eNB. In this step, the source eNB also forwards the current AS security context of the source eNB and the security capability of the UE to the target eNB.

Step 303: After receiving the handover request message of the source eNB, the target eNB saves the received NCC-eNB. The target eNB also selects an RRC/UP encryption and integrity protection algorithm based on the received UE security capabilities.

Step 304: The target eNB sends a handover request response message to the source eNB, where the handover request response message includes a transmission container, where the transmission container includes the target NCC-eNB, the encryption and integrity protection algorithm identifier (EIA, EEA) selected by the target eNB. Wait.

Step 305: The source eNB sends a handover command to the UE, where the handover command includes the transmission container received from the target eNB in step 304.

Step 306: After receiving the handover command sent by the source eNB, the UE decrypts and completes the message using the current AS security context.

Step 307: After the UE synchronizes the NH, the UE calculates the KeNB by using the NH. Computing side The method is KeNB*=KDF(NH, PCI, EARFCN-DL); then KeNB is updated with KeNB*, KeNB=KeNB*.

Step 308: The UE sends a handover confirmation message to the target eNB.

Step 309: The target eNB sends a path switch request message to the MME. The target eNB notifies the MME of the NCC-eNB that it holds, and the target eNB notifies the MME of its PCI and EARFCN_DL.

Step 310: After receiving the path switch message from the target eNB, the MME extracts the NCC-eNB carried in the path switch message. The MME compares the NCC_eNB with the NCC_MME stored by itself, and if the same, the MME extracts the NH in the {NH, NCC} pair associated with the NCC_MME; if different, the MME calculates the association with the received NCC_eNB. Li.

Step 311: After the MME synchronizes the NH, the MME calculates the KeNB by using the NH. The calculation method is KeNB*=KDF (NH, PCI, EARFCN-DL;), where PCI and EARFCN-DL are the PCI and EARFCN-DL of the target eNB; then KeNB* is used to update KeNB, KeNB=KeNB*.

Step 312: After calculating the KeNB, the MME calculates a {NH, NCC} pair of the next hop. First increase the NCC value by 1; then calculate NH, NH = KDF (NH old, Kasme ). This newly calculated {NH, NCC} pair will be used for the key update for the next hop.

Step 313: The MME sends a path switch request response message to the target eNB, where the new NCC value and the KeNB calculated in step 311 are attached. The NCC value will be used for the NH synchronization between the UE and the MME of the next hop; the KeNB and the KeNB held in the UE are consistent. The KeNB will be used by the target eNB to generate RRC/UP encryption and decryption keys and integrity keys for data and signaling.

In step 314, the target eNB will save the new NCC value, and use the KeNB and its selected EEA, EIA to calculate the RRC/UP encryption and decryption key and integrity key for data and signaling. The target eNB will use the newly generated AS security context for the handover received in step 308. The message is decrypted and integrity verified.

Step 315: The target eNB sends a release resource message to the source eNB. After receiving the release resource message from the target eNB, the source eNB deletes all AS-related security contexts associated with the UE.

As can be seen from the above description, the key generation process shown in FIG. 2 is only a special case of the process shown in FIG. 3, whether the first handover is the X2 handover process, or the X2 handover occurs in the UE and the eNB. In the case where there is an AS security context, the present invention can keep the flow of the X2 handover process consistent and ensure forward security.

4 is a flowchart of key generation in S1 handover according to an embodiment of the present invention, and FIG. 4 is a key generation and key distribution process in an S1 handover, wherein, in order to ensure forward security in the X2 handover process, the handover process is performed in S1. It is also necessary to make the eNB unable to obtain the NH, so that the source eNB does not have the capability of deriving the KeNB of the target eNB, and specifically includes the following steps:

Step 401: The UE sends a measurement report to the source eNB. At this time, the UE, the source eNB, and the source MME maintain the AS security context of the UE.

Step 402: The source eNB initiates a handover request to the source MME, where the handover requirement related message includes an NCC value saved by the source eNB.

Step 403: The source MME synchronizes the {NH, NCC} pair according to the NCC value received from the source eNB. The source MME sends a Forwarding Relocation Request message to the target MME to send the synchronized {NH, NCC} pair and the Kasme and eKSI to the target MME.

Step 404: The target MME first calculates the KeNB according to the received {NH, NCC} pair, and then adds 1 to the NCC value to calculate a new {NH, NCC} pair. The new {NH, NCC} pair is used for the generation of the next hop key.

Step 405: The target MME sends a handover request message to the target eNB. The handover request message includes the KeNB and the new NCC value calculated in step 404. The target MME does not send 丽 to the target e phoenix Step 406: The target eNB selects an encryption and integrity protection algorithm, and the selected encryption and integrity protection algorithm identifier and the NCC value are carried in the handover request response message, and are sent to the target MME.

Step 407: The target MME forwards the relocation response message to the source MME, where the relocation response message includes the NCC value, the encryption and the integrity protection algorithm identifier saved in the target eNB.

Step 408: The source MME sends a handover command to the source eNB, where the NCC value, the encryption and the integrity protection algorithm identifier saved in the target eNB are included.

Step 409: The source eNB sends a handover command to the UE, where the NCC value, the encryption and the integrity protection algorithm identifier saved in the target eNB are included.

Step 410: The UE synchronizes the {NH, NCC} pair according to the NCC value received from the source eNB, and calculates the KeNB by using the synchronized NH. The UE calculates the encryption and decryption key and the integrity key for data and signaling based on the received encryption and integrity protection algorithm identification and the KeNB.

Step 411: The UE sends a handover confirmation message to the target eNB. AS security is established between the UE and the target eNB.

The present invention also describes a key generation system in a handover process, including an MME, a base station, and a UE, where:

During the UE handover process, the MME uses the NH to generate a next hop key KeNB; wherein the NH generated by the MME does not notify the base station.

The MME and the UE side respectively use the NCC value notified by the target base station to synchronize the next hop key KeNB; and the MME notifies the generated next hop key KeNB to the target base station.

The UE and the MME generate a next hop key KeNB by using the NH, the cell identifier of the target base station, and the target universal terrestrial radio access UTRA downlink carrier frequency.

The MME is further configured to generate an initial next hop key KeNB according to the root key Kasme and the NAS UL COUNT value; and the root keys Kasme and KeNB initialize the NH. Preferably, the target base station is configured to: notify, by the source base station, the NCC value received from the source base station and the encryption and integrity protection algorithm selected by the target base station;

Or, preferably, the source MME is configured to: determine an NH corresponding to the NCC value received from the source base station, and send the received NCC value and its corresponding NH to the target MME;

The UE is configured to determine an NH corresponding to the currently received NCC value, and generate a new KeNB according to the determined NH.

Those skilled in the art should understand that the functions of the network elements in the key generation system in the example switching process can be understood by referring to the related descriptions of the foregoing FIGS. 1 to 4. In the handover process of the present invention, the key generation system is based on the existing network structure, and only the corresponding network element function has been modified. The network structure can still be understood by referring to the existing network structure.

The above is only the preferred embodiment of the present invention and is not intended to limit the scope of the present invention.

Industrial applicability In the X2 handover process, the source eNB no longer derives the next hop key for the target eNB, and the source eNB only provides the next hop variable counter NCC value for the target eNB. The target eNB uses the NCC value to keep the NHs in the UE and the MME in synchronization, so that the same KeNB is stored in the UE and the MME. The target eNB applies for the same KeNB as the UE to the MME using the NCC value, thereby keeping its own KeNB and the KeNB of the UE consistent. During the handover, the NH does not leave the MME, the eNB cannot obtain the NH, and the eNB does not have the ability to derive the NH (the calculation NH must have the Kasme). Therefore, the source eNB cannot obtain the KeNB of the target eNB in the next hop, and solves the forward security. problem.

Claims

Claim

A key generation method in a handover process, wherein the method includes: in a handover process of a user equipment UE, the network side generates a next hop key KeNB by using a next hopping parameter NH; The NH generated by the network side does not notify the base station.

2. The method according to claim 1, wherein the method further comprises: the network side and the UE side each using a next hopping counter notified by the target base station

The NCC value synchronizes the next hop key KeNB; the network side notifies the target base station of the generated next hop key KeNB.

The method according to claim 1, wherein the using the NH to generate a next hop key KeNB is:

The method according to any one of claims 1 to 3, wherein the method further comprises:

The initial next hopping key KeNB is generated by the network side based on the root key Kasme and the non-access stratum uplink counter NAS UL COUNT value; the network side initializes the MN according to the root keys Kasme and KeNB.

The target base station notifies the UE by the source base station of the next hopping counter NCC value received from the source base station and the encryption and integrity protection algorithm selected by the target base station;

The method according to claim 5, wherein the method further comprises: After receiving the handover acknowledgement of the UE, the target base station notifies the network side of the NCC value received from the source base station;

The method according to any one of claims 1 to 6, wherein the network side is a mobility management unit MME.

9. A key generation system in a handover process, comprising an MME, a base station, and a UE, wherein:

10. The system of claim 9 wherein:

The MME and the UE side respectively synchronize with the NCC value notified by the target base station. a hopping key KeNB; and the MME notifying the target base station of the generated next hop key KeNB.

The system according to claim 10, wherein the UE and the MME generate a next hop key KeNB ₀ using the NH, the cell identifier of the target base station, and the target UTRA downlink carrier frequency number.

The system according to any one of claims 9 to 11, wherein: the MME is further configured to generate an initial next hop key KeNB according to the root key Kasme and the NAS UL COUNT value; The root keys Kasme and KeNB initialize NH.

The system according to any one of claims 9 to 11, wherein: the target base station is configured to: pass the NCC value received from the source base station and the encryption and integrity protection algorithm selected by the target base station to the source base station Notifying the UE;

14. The system of claim 13 wherein:

The target base station is configured to: after receiving the handover acknowledgement of the UE, notify the MME of the NCC value received from the source base station; and generate an encryption and decryption key and an integrity key according to the KeNB received from the MME;

The system according to any one of claims 9 to 11, wherein the source MME is configured to determine the NH corresponding to the NCC value received from the source base station, and send the received NCC value to the target MME and Corresponding NH;

The target MME is configured to generate a KeNB according to the received NH, and increase the NCC value by one, and notify the target base station of the KeNB and the added NCC value; The target base station is configured to: select an encryption and integrity algorithm, and notify the UE of the encryption and integrity algorithm and the received NCC value by the target MME, the source MME, and the source base station; the UE is configured to determine, with the currently received The NCC value corresponds to NH, and a new KeNB is generated according to the determined NH.