WO2014075238A1 - Procédé de traitement de sécurité pour des communications mobiles, macro-station de base, micro-station de base et équipement d'utilisateur - Google Patents

Procédé de traitement de sécurité pour des communications mobiles, macro-station de base, micro-station de base et équipement d'utilisateur Download PDF

Info

Publication number
WO2014075238A1
WO2014075238A1 PCT/CN2012/084586 CN2012084586W WO2014075238A1 WO 2014075238 A1 WO2014075238 A1 WO 2014075238A1 CN 2012084586 W CN2012084586 W CN 2012084586W WO 2014075238 A1 WO2014075238 A1 WO 2014075238A1
Authority
WO
WIPO (PCT)
Prior art keywords
base station
macro base
security algorithm
micro base
security
Prior art date
Application number
PCT/CN2012/084586
Other languages
English (en)
Chinese (zh)
Inventor
彭炎
刘菁
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to PCT/CN2012/084586 priority Critical patent/WO2014075238A1/fr
Priority to CN201280002618.0A priority patent/CN103959833B/zh
Publication of WO2014075238A1 publication Critical patent/WO2014075238A1/fr

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04B—TRANSMISSION
    • H04B7/00—Radio transmission systems, i.e. using radiation field
    • H04B7/02—Diversity systems; Multi-antenna system, i.e. transmission or reception using multiple antennas
    • H04B7/022—Site diversity; Macro-diversity
    • H04B7/024—Co-operative use of antennas of several sites, e.g. in co-ordinated multipoint or co-operative multiple-input multiple-output [MIMO] systems
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
    • H04L63/205—Network architectures or network communication protocols for network security for managing network security; network security policies in general involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/041—Key generation or derivation
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/043—Key management, e.g. using generic bootstrapping architecture [GBA] using a trusted network node as an anchor
    • H04W12/0431—Key distribution or pre-distribution; Key agreement
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/043—Key management, e.g. using generic bootstrapping architecture [GBA] using a trusted network node as an anchor
    • H04W12/0433—Key management protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W28/00—Network traffic management; Network resource management
    • H04W28/16—Central resource management; Negotiation of resources or communication parameters, e.g. negotiating bandwidth or QoS [Quality of Service]
    • H04W28/24—Negotiating SLA [Service Level Agreement]; Negotiating QoS [Quality of Service]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L5/00—Arrangements affording multiple use of the transmission path
    • H04L5/0001—Arrangements for dividing the transmission path
    • H04L5/0003—Two-dimensional division
    • H04L5/0005—Time-frequency
    • H04L5/0007—Time-frequency the frequencies being orthogonal, e.g. OFDM(A), DMT
    • H04L5/001—Time-frequency the frequencies being orthogonal, e.g. OFDM(A), DMT the frequencies being arranged in component carriers
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L5/00—Arrangements affording multiple use of the transmission path
    • H04L5/003—Arrangements for allocating sub-channels of the transmission path
    • H04L5/0032—Distributed allocation, i.e. involving a plurality of allocating devices, each making partial allocation
    • H04L5/0035—Resource allocation in a cooperative multipoint environment
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W84/00—Network topologies
    • H04W84/02—Hierarchically pre-organised networks, e.g. paging networks, cellular networks, WLAN [Wireless Local Area Network] or WLL [Wireless Local Loop]
    • H04W84/04—Large scale networks; Deep hierarchical networks
    • H04W84/042—Public Land Mobile systems, e.g. cellular systems
    • H04W84/045—Public Land Mobile systems, e.g. cellular systems using private Base Stations, e.g. femto Base Stations, home Node B
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W92/00—Interfaces specially adapted for wireless communication networks
    • H04W92/16—Interfaces between hierarchically similar devices
    • H04W92/20—Interfaces between hierarchically similar devices between access points

Definitions

  • the present invention relates to a security processing method for a mobile communication, a macro base station, a micro base station, and a user equipment.
  • the security algorithms supported by the user equipment UE User Equipment
  • the evolved network base station eNB evolved Node B
  • the security algorithms supported by the user equipment UE User Equipment
  • the evolved network base station eNB evolved Node B
  • the security algorithm negotiation of the two needs to be performed before the communication between the UE and the eNB, but also the derivation of the air interface security key is required.
  • the macro base station and the base station perform Carrier Aggregation (CA) communication for the purpose of improving the network capacity.
  • CA Carrier Aggregation
  • the macro base station and the micro base station perform multi-point cooperation CoMP (Coordinated). Multi-Point) communication is designed to improve the performance of edge users.
  • the UE needs to maintain communication with the macro base station and the micro base station at the same time.
  • Embodiments of the present invention provide a security processing method for a mobile communication, a macro base station, a micro base station, and a user equipment, where the UE, the macro base station, and the micro base station can perform security algorithm negotiation and security key acquisition, thereby enabling the macro base station and When the micro base station performs CA or CoMP operation, the UE can securely communicate with the macro base station and the micro base station.
  • a first aspect provides a security processing method for mobile communications, where the method includes: acquiring, by a macro base station, a security algorithm supported by a user equipment UE and a micro base station;
  • the macro base station performs security algorithm negotiation according to the security algorithm supported by the UE, the micro base station, and the macro base station, and obtains the negotiated security algorithm;
  • the macro base station notifies the UE and the micro base station of the negotiated security algorithm; the macro base station acquires a security key used by the UE air interface;
  • the communication between the U E, the micro base station and the macro base station can be subjected to security protection processing according to the negotiated security algorithm and the security key.
  • the macro base station performs a security algorithm negotiation according to a security algorithm supported by the UE, the micro base station, and the macro base station, and the obtained security algorithm includes:
  • the acquiring, by the macro base station, a security algorithm supported by the UE includes:
  • the macro base station determines that the UE needs the macro base station and the micro base station to perform carrier aggregation CA or multi-point cooperative CoMP cooperative communication.
  • the acquiring, by the macro base station, the security algorithm supported by the UE includes:
  • the method Before the UE accesses the macro base station, acquiring a security algorithm supported by the UE; before the macro base station notifying the UE of the negotiated security algorithm, the method further includes: the macro base station determining that the UE needs the Macro base station and micro base station perform CA or
  • the acquiring, by the macro base station, the security algorithm supported by the micro base station includes:
  • the macro base station sends a request for acquiring a security algorithm supported by the micro base station to the macro base station OAM, so that the macro base station OAM acquires a security algorithm supported by the micro base station from the micro base station OAM, where the macro base station receives the a security algorithm supported by the micro base station sent by the macro base station OAM;
  • the micro base station And receiving, by the micro base station, a request for establishing an interface with the macro base station, where the interface establishment request carries a security algorithm supported by the micro base station;
  • the acquiring, by the macro base station, the security algorithm supported by the UE includes:
  • the macro base station acquires a security algorithm supported by the UE;
  • the method further includes: the macro base station determining that the UE needs the macro base station and the micro base station to perform CA or
  • the security algorithm supported by the macro base station to obtain the micro base station includes:
  • the macro base station sends request information to the micro base station, and the request message requests the micro base station to send a security algorithm supported by the micro base station to the macro base station, and receives the micro base station to send the micro base station to support Security algorithm.
  • the macro base station acquires the UE air interface
  • the security keys used include:
  • the macro base station sends the security key to the micro base station, so that communication between the UE, the micro base station, and the macro base station can be securely protected according to the negotiated security algorithm and the security key. Processing includes:
  • the communication between the macro base stations can perform security protection processing according to the negotiated security algorithm and the encryption and integrity protection keys of the UE air interface.
  • the acquiring, by the macro base station, the security key used by the UE air interface includes:
  • the macro base station Receiving a shared root key used by the UE air interface sent by the mobility management entity; the macro base station transmitting the security key to the micro base station, so that communication between the UE, the micro base station, and the macro base station can Performing security protection processing according to the negotiated security algorithm and the security key includes:
  • the key and the negotiated security algorithm perform secure communication with the micro base station and the UE.
  • a second aspect provides a security processing method for mobile communications, where the method includes: the micro base station interacts with a macro base station to perform a security algorithm, so that the macro base station acquires a security algorithm supported by the micro base station;
  • the micro base station receives the negotiated security algorithm sent by the macro base station, and the negotiated security algorithm is obtained by the macro base station according to the security algorithm supported by the UE, the micro base station, and the macro base station. of;
  • the interaction between the micro base station and the macro base station to perform a security algorithm includes:
  • the micro base station sends a security algorithm supported by the micro base station to the micro base station OAM, so that the macro base station OAM and the micro base station OAM negotiate a security algorithm supported by the macro base station and the micro base station, and the security is supported. Sending an algorithm to the macro base station;
  • the micro base station sends the security algorithm supported by the micro base station to the micro base station OAM, so that the macro base station OAM obtains the security algorithm supported by the micro base station from the micro base station OAM, and supports the security supported by the micro base station. Sending an algorithm to the macro base station; or
  • the micro base station sends an interface establishment request to the macro base station, where the interface establishment request carries a security algorithm supported by the micro base station;
  • the micro base station sends a configuration update message to the macro base station, where the configuration update message carries a security algorithm supported by the micro base station;
  • the security algorithm and the security key for security protection processing include:
  • a third aspect provides a security processing method for mobile communications, where the method includes: the user equipment UE sends a security algorithm supported by the UE to a macro base station;
  • the UE communicates with the macro base station and the micro base station after the macro base station sends the security key to the micro base station according to the negotiated security algorithm and the security key used by the UE air interface.
  • a fourth aspect provides a macro base station, where the macro base station includes: a first acquiring unit, a negotiating unit, a notifying unit, a second acquiring unit, and a sending unit;
  • the first acquiring unit is configured to acquire a security algorithm supported by the user equipment UE and the micro base station;
  • the negotiating unit is configured to perform security algorithm negotiation according to a security algorithm supported by the UE, the micro base station, and the macro base station, to obtain a negotiated security algorithm;
  • the notifying unit is configured to notify the UE and the base station of the negotiated security algorithm
  • the second acquiring unit is configured to acquire a security key used by the air interface of the UE, and the sending unit is configured to send the security key to the micro base station, so that the UE, the micro base station, and the asteroid base
  • the communication between the stations can perform security protection processing according to the negotiated security algorithm and the security key.
  • the negotiating unit is specifically configured to obtain, according to the obtained security algorithm supported by the UE and the micro base station, and the security algorithm supported by the macro base station, an intersection of the security algorithms supported by the UE, the micro base station, and the macro base station, and Any of the intersections of the security algorithms
  • the full algorithm acts as the negotiated security algorithm.
  • the first acquiring unit is specifically configured to: when the UE accesses the macro base station, obtain a security algorithm supported by the UE;
  • the macro base station further includes: a determining unit;
  • the determining unit is configured to determine whether the UE needs the macro base station and the micro base station to perform carrier aggregation CA or multi-point cooperative CoMP cooperative communication;
  • the negotiating unit is specifically configured to: after the determining unit determines that the UE needs the macro base station and the micro base station to perform CA or CoMP cooperative communication, perform security according to a security algorithm supported by the UE, the micro base station, and the macro base station.
  • the algorithm negotiates to obtain the negotiated security algorithm.
  • the first acquiring unit is specifically configured to: when the UE accesses the macro base station, obtain a security algorithm supported by the UE;
  • the macro base station further includes a determining unit
  • the determining unit is configured to determine that the UE needs the macro base station and the micro base station to perform CA or CoMP cooperative communication;
  • the notifying unit is further configured to notify the UE of the negotiated security algorithm after the determining unit determines that the UE needs the macro base station and the drum base station to perform CA or CoMP cooperative communication.
  • the first acquiring unit is specifically configured to: receive, operate, and manage the macro base station Maintaining a security algorithm negotiated by the macro base station OAM and the base station OAM sent by the OAM;
  • the micro base station And receiving, by the micro base station, a request for establishing an interface with the macro base station, where the interface establishment request carries a security algorithm supported by the micro base station;
  • the first acquiring unit is specifically configured to: when the UE accesses the macro base station, obtain a security algorithm supported by the UE;
  • the macro base station further includes a determining unit
  • the determining unit is configured to determine that the UE needs the macro base station and the micro base station to perform CA or CoMP cooperative communication;
  • the first acquiring unit is further configured to: after the determining unit determines that the UE needs the macro base station and the micro base station to perform CA or CoMP cooperative communication, send request information to the micro base station, where the request information is requested.
  • the micro base station sends a security algorithm supported by the micro base station to the macro base station, and receives a security algorithm supported by the micro base station sent by the micro base station.
  • the second acquiring unit is specifically configured to receive a shared root key used by the air interface of the UE sent by the mobility management entity, and derive an encryption and integrity protection key of the UE air interface according to the shared root key;
  • the sending unit is specifically configured to send the shared root key to the micro base station, so that the micro base station derives an encryption and integrity protection key of the UE air interface according to the shared root key, where the UE
  • the communication between the micro base station and the macro base station can be performed according to the negotiated security algorithm and the encryption and integrity protection key of the UE air interface. Full protection processing.
  • the second obtaining unit is configured to receive a shared root key used by the air interface of the UE sent by the mobility management entity, and derive an encryption and integrity protection key of the UE air interface according to the shared root key;
  • the sending unit is specifically configured to send an encryption and integrity protection key of the UE air interface to the micro base station, so that communication between the UE, the micro base station, and the macro base station can be performed according to the negotiated
  • the security algorithm and the encryption and integrity protection keys of the UE air interface perform security protection processing.
  • a fifth aspect provides a micro base station, where the micro base station includes: an interaction unit and a receiving unit;
  • the interaction unit is configured to perform a security algorithm interaction with the macro base station, so that the macro base station acquires a security algorithm supported by the micro base station;
  • the receiving unit is configured to receive the negotiated security algorithm sent by the macro base station, where the negotiated security algorithm is that the macro base station performs a security algorithm according to a security algorithm supported by the UE, the micro base station, and the macro base station. Obtained after consultation;
  • the receiving unit is further configured to receive a security key used by the UE air interface sent by the macro base station, so that communication between the UE, the micro base station, and the macro base station can be according to the negotiated security algorithm and the The security key is processed for security protection.
  • the interaction unit is specifically configured to:
  • the receiving unit is specifically configured to receive a shared root key used by the UE air interface sent by the macro base station;
  • the micro base station further includes a derivation unit
  • Deriving unit configured to: after the receiving unit receives the shared root key used by the UE air interface, derive an encryption and integrity protection key of the UE air interface according to the shared root key, according to the encryption and An integrity protection key and the negotiated security algorithm perform secure communication with the macro base station and the UE;
  • the receiving unit is specifically configured to receive an encryption and integrity protection key of the derived UE air interface sent by the macro base station, so that communication between the UE, the micro base station, and the macro base station can be performed according to the negotiated The security algorithm and the encryption and integrity protection keys of the UE air interface perform security protection processing.
  • a sixth aspect provides a user equipment, where the user equipment includes: a sending unit, a receiving unit, and a communication unit;
  • the sending unit is configured to send the security algorithm supported by the UE to the macro base station, where the receiving unit is configured to receive the negotiated security algorithm notified by the macro base station, where the negotiated security algorithm is the macro base
  • the station obtains the negotiation according to the security algorithm supported by the UE, the micro base station, and the macro base station;
  • the communication unit is configured to: after the macro base station sends the security key to the micro base station, according to the negotiated security algorithm and a security key used by the UE air interface, and the macro base station and the micro The base station communicates.
  • a macro base station includes: a transceiver, a processor, and a memory;
  • the memory is configured to store a security algorithm supported by the macro base station
  • the transceiver is configured to receive a security algorithm supported by the user equipment UE and the micro base station, where the processor is configured to perform security algorithm negotiation according to a security algorithm supported by the UE, the micro base station, and the macro base station, and obtain the negotiated Security algorithm
  • the transceiver is further configured to send the negotiated security algorithm to the UE and the micro base station;
  • the transceiver is further configured to receive a security key used by the air interface of the UE; the transceiver is further configured to send the security key to the micro base station, so that the UE, the micro base station, and the Acer base
  • the communication between the stations can perform security protection processing according to the negotiated security algorithm and the security key.
  • the processor is specifically configured to obtain, according to a security algorithm supported by the UE and the micro base station, and a security algorithm supported by the macro base station, an intersection of the security algorithms supported by the UE, the micro base station, and the macro base station, and Any security algorithm in the intersection of the security algorithms is used as the negotiated security algorithm.
  • the transceiver is specifically configured to: when the UE accesses the macro base station, receive a security algorithm supported by the UE;
  • the processor is further configured to determine whether the UE needs the macro base station and the micro base station to perform carrier aggregation CA or multi-point cooperative CoMP cooperative communication;
  • the processor is specifically configured to: after determining that the UE needs the macro base station and the micro base station to perform CA or CoMP cooperative communication, perform security algorithm negotiation according to a security algorithm supported by the UE, the micro base station, and the macro base station, Get the negotiated security algorithm.
  • the transceiver is specifically configured to: when the UE accesses the macro base station, receive a security algorithm supported by the UE;
  • the processor is further configured to determine whether the UE needs the macro base station and the micro base station to perform carrier aggregation CA or multi-point cooperative CoMP cooperative communication;
  • the transceiver is specifically configured to: after the determining that the UE needs the macro base station and the micro base station to perform CA or CoMP cooperative communication, send the negotiated security algorithm to the UE.
  • the transceiver is specifically configured to:
  • the micro base station And receiving, by the micro base station, a request for establishing an interface with the macro base station, where the interface establishment request carries a security algorithm supported by the micro base station;
  • the transceiver is specifically configured to: when the UE accesses the macro base station, receive a security algorithm supported by the UE;
  • the processor is further configured to determine that the UE needs the macro base station and the micro base station to enter CA or CoMP collaborative communication;
  • the transceiver is further configured to: after the processor determines that the UE needs the macro base station and the micro base station to perform CA or CoMP cooperative communication, send request information to the micro base station, where the request information requests the The micro base station sends the security algorithm supported by the micro base station to the macro base station, and receives the security algorithm supported by the micro base station sent by the micro base station.
  • the transceiver is specifically configured to receive a shared root key used by the UE of the UE sent by the mobility management entity;
  • the processor configured to derive an encryption and integrity protection key of the UE air interface according to the shared root key
  • the transceiver is specifically configured to send the shared root key to the micro base station, so that the micro base station derives an encryption and integrity protection key of the UE air interface according to the shared root key, where the UE
  • the communication between the micro base station and the macro base station can perform security protection processing according to the negotiated security algorithm and the encryption and integrity protection key of the UE air interface.
  • the transceiver is configured to receive a shared root key used by the air interface of the UE sent by the mobility management entity;
  • the processor is further configured to derive an encryption and integrity protection key of the UE air interface according to the shared root key;
  • the transceiver is specifically configured to send an encryption and integrity protection key of the UE air interface to the micro base station, so that communication between the UE, the micro base station, and the macro base station can be performed according to the negotiated
  • the security algorithm and the encryption and integrity protection keys of the UE air interface perform security protection processing.
  • a micro base station in an eighth aspect, includes: a transceiver and a memory;
  • the memory is configured to store a security algorithm supported by the micro base station;
  • the transceiver is configured to perform a security algorithm interaction with a macro base station, so that the macro base station acquires a security algorithm supported by the micro base station;
  • the transceiver is further configured to receive the negotiated security algorithm sent by the macro base station, where the negotiated security algorithm is that the macro base station performs security according to a security algorithm supported by the UE, the micro base station, and the macro base station. Obtained after the algorithm is negotiated;
  • the transceiver is further configured to receive a security key used by the UE air interface sent by the macro base station, so that communication between the UE, the micro base station, and the macro base station can be according to the negotiated security algorithm and the The security key is processed for security protection.
  • the transceiver is specifically configured to:
  • the transceiver is specifically configured to receive a shared root key used by the UE air interface sent by the macro base station;
  • the micro base station further includes: a processor
  • the processor after the transceiver receives the shared root key used by the UE air interface, deriving an encryption and integrity protection key of the UE air interface according to the shared root key, according to the encryption and An integrity protection key and the negotiated security algorithm perform secure communication with the macro base station and the UE;
  • the transceiver is specifically configured to receive an encryption and integrity protection key of the derived UE air interface sent by the macro base station, so that communication between the UE, the micro base station, and the macro base station can be performed according to the negotiated The security algorithm and the encryption and integrity protection keys of the UE air interface perform security protection processing.
  • a ninth aspect provides a user equipment, where the user equipment includes: a transceiver, a processor, and a memory;
  • the memory is configured to store a security algorithm supported by the UE
  • the transceiver is configured to receive the negotiated security algorithm notified by the macro base station, where the negotiated security algorithm is obtained by the macro base station according to a security algorithm supported by the UE, the micro base station, and the macro base station. of;
  • the processor is configured to: after the macro base station sends the security key to the micro base station, according to the negotiated security algorithm and a security key used by the UE air interface, and the macro base station and the micro The base station communicates.
  • the embodiment of the present invention provides a security processing method for a mobile communication, a macro base station, a micro base station, and a user equipment, where the macro base station acquires a security algorithm supported by the UE and the micro base station; and then, according to the UE, the micro base station, and the macro base station Supporting the security algorithm, performing security algorithm negotiation, and obtaining the negotiated security algorithm; the macro base station notifying the user equipment and the micro base station of the negotiated security algorithm; and the macro base station acquiring the security of the UE air interface use Key, and transmitting the security key to the micro base station, so that communication between the UE, the micro base station, and the macro base station can be secured according to the negotiated security algorithm and the security key deal with.
  • the security algorithm negotiation and the acquisition of the security key can be performed between the three network entities.
  • the macro base station determines to perform macro-MAC or CoMP operation on the UE, the UE can securely communicate with the macro base station and the micro base station.
  • FIG. 1 is a schematic flowchart of a method for securely processing a mobile communication according to an embodiment of the present invention
  • FIG. 2 is a schematic flowchart of another method for securely processing mobile communications according to an embodiment of the present invention
  • FIG. 3 is a schematic flowchart of another method for securely processing mobile communications according to an embodiment of the present invention.
  • FIG. 4 is a schematic diagram of an interaction of a security processing method for mobile communication according to an embodiment of the present invention.
  • FIG. 5 is a schematic diagram of another embodiment of a security processing method for mobile communication according to an embodiment of the present invention
  • FIG. 6 is a schematic diagram of another method for securely processing a mobile communication according to an embodiment of the present invention
  • FIG. FIG. 8 is a schematic structural diagram of another macro base station according to an embodiment of the present invention
  • FIG. 9 is a schematic structural diagram of a micro base station according to an embodiment of the present invention
  • FIG. 1 is a schematic structural diagram of another macro base station according to an embodiment of the present invention
  • FIG. 12 is a schematic structural diagram of another micro base station according to an embodiment of the present invention
  • An embodiment of the present invention provides a method for securely processing a mobile communication.
  • an execution entity of the method is a macro base station, and the method may specifically include:
  • the macro base station acquires a security algorithm supported by the user equipment UE and the micro base station.
  • the security algorithm is an algorithm that can be used for secure communication between the UE and the macro base station, the UE and the micro base station, and performs encryption/decryption and integrity protection operations on data and signaling, and may include, for example, encryption and integrity protection.
  • the algorithm is not limited in this embodiment of the present invention.
  • the security algorithm supported by the UE may be sent to the mobility management entity MME (Mobility Management Entity) through non-access stratum NAS (Non Access Statum) signaling, and then the MME passes through the SI interface.
  • MME Mobility Management Entity
  • NAS Non Access Statum
  • the signaling forwards the received security algorithm supported by the UE to the macro base station.
  • the macro base station may obtain multiple security modes supported by the micro base station.
  • the macro base station acquiring the security algorithm supported by the micro base station may be: performing macro base station and micro base station between the OAM (Operation Administration and Maintenance) and the micro base station 0 AM by the macro base station.
  • the negotiation of the supported security algorithm after the negotiation is completed, the macro base station OAM sends the negotiated security algorithm to the macro base station, and the micro base station OAM also sends the negotiated security algorithm to the The micro base station ensures consistency of security algorithms supported by the macro base station and the micro base station.
  • the acquiring, by the macro base station, the security algorithm supported by the micro base station may be: the macro base station sending, to the macro base station OAM, a request for acquiring a security algorithm supported by the micro base station, so that the macro base station OAM and the macro base station After the micro base station OAM interacts, Obtaining a security algorithm supported by the micro base station in the micro base station OAM, and then the macro base station OAM sends a security algorithm supported by the micro base station to the macro base station.
  • the obtaining, by the macro base station, the security algorithm supported by the micro base station may be: in the process of establishing an interface between the macro base station and the micro base station, the micro base station sends an interface connection to the macro base station.
  • the security algorithm supported by the micro base station is carried in the request for establishing the interface connection.
  • the request for establishing the interface connection may be an X interface connection establishment request message.
  • the security algorithm supported by the micro base station may be carried in the configuration update message sent by the micro base station to the macro base station.
  • the macro base station performs security algorithm negotiation according to a security algorithm supported by the UE, the micro base station, and the macro base station, to obtain a negotiated security algorithm.
  • the macro base station After the macro base station acquires the security algorithm supported by the UE and the security algorithm supported by the micro base station, the macro base station performs a security algorithm negotiation according to its own security algorithm to obtain the UE, the micro base station, and the macro base station. An intersection of the security algorithms is used, and any security algorithm in the intersection of the security algorithms is used as the security algorithm after the negotiation, so that the negotiated security algorithm is used as the security algorithm used by the UE air interface.
  • the macro base station cannot negotiate the security algorithm used by the UE air interface. At this time, the macro base station and the base station cannot simultaneously provide cooperative communication for the UE.
  • the macro base station notifies the UE and the micro base station of the negotiated security algorithm.
  • the macro base station may specifically perform the negotiated security algorithm by using an interface between the macro base station and the micro base station, for example, an X interface. Notifying the micro base station.
  • the macro base station may specifically notify the UE of the negotiated security algorithm by using an interface between the macro base station and the UE, for example, a Uu interface.
  • the macro base station acquires a security key used by the UE air interface.
  • the security key used by the UE air interface may be: The shared root key used by the UE air interface.
  • the macro base station sends the security key to the micro base station, so that communication between the UE, the micro base station, and the macro base station can be performed according to the negotiated security algorithm and the security key. Security protection processing.
  • the micro base station If the micro base station receives the shared root key used by the UE air interface from the macro base station, the micro base station further derives an encryption and integrity protection key used by the UE air interface based on the shared root key.
  • the embodiment of the present invention provides a security processing method for mobile communication, where the macro base station acquires a security algorithm supported by the UE and the micro base station; and then performs security algorithm negotiation according to the security algorithm supported by the user equipment, the micro base station, and the macro base station. Obtaining a security algorithm after the negotiation; the macro base station notifying the UE and the micro base station of the negotiated security algorithm; the macro base station acquiring a security key used by the UE air interface, and the security key is used And transmitting to the micro base station, so that communication between the UE, the micro base station, and the macro base station can perform security protection processing according to the negotiated security algorithm and the security key.
  • the UE can securely cooperate with the UE.
  • the macro base station and the micro base station communicate.
  • An embodiment of the present invention provides a method for securely processing a mobile communication.
  • the execution entity of the method is a micro base station, and the method may specifically include:
  • the micro base station and the macro base station perform a security algorithm interaction, so that the macro base station acquires a security algorithm supported by the micro base station.
  • the micro base station interacts with the macro base station to perform a security algorithm, which may be in various manners.
  • the interaction between the micro base station and the macro base station may be: the micro base station sends a security algorithm supported by the micro base station to the micro base station 0 AM, so that the macro base station OAM negotiates with the micro base station OAM. And a security algorithm supported by both the macro base station and the micro base station, and sending the security algorithm to the macro base station.
  • the interaction between the micro base station and the macro base station to perform the security algorithm may be:
  • the micro base station sends the security algorithm supported by the micro base station to the micro base station OAM, so that the macro base station OAM obtains the security algorithm supported by the micro base station from the micro base station OAM, and the security algorithm supported by the micro base station Send to the macro base station.
  • the interaction between the micro base station and the macro base station to perform the security algorithm may be: in the process of establishing an interface between the macro base station and the micro base station, the micro base station sends an interface to the macro base station to establish an interface.
  • the request, the interface establishment request carries a security algorithm supported by the micro base station.
  • the request for establishing the interface connection may be an X interface connection establishment request message.
  • the interaction between the micro base station and the macro base station to perform the security algorithm may be: in the process of performing configuration update of the micro base station and the macro base station, sending a configuration update message to the macro base station, where The configuration update message carries the security algorithm supported by the micro base station.
  • the interaction between the micro base station and the macro base station to perform the security algorithm may be: after the network deployment is complete, when the macro base station determines that the UE needs to perform CA or CoMP cooperative communication between the macro base station and the micro base station,
  • the macro base station may send a request message to the micro base station, where the request message requests the micro base station to send a security algorithm supported by itself to the macro base station.
  • the micro base station After receiving the request message, the micro base station sends a security algorithm supported by itself to the macro base station.
  • the micro base station receives the negotiated security algorithm sent by the macro base station, where the negotiated security algorithm is that the macro base station performs security algorithm negotiation according to a security algorithm supported by the UE, the micro base station, and the macro base station. After getting it.
  • the micro base station After the macro base station acquires the security algorithm supported by the micro base station, the UE, and the self, and performs the negotiation of the security algorithm, the micro base station receives the negotiated security algorithm sent by the macro base station.
  • the negotiated security algorithm is a security algorithm used by the UE air interface.
  • the security key used by the UE air interface may be: The shared root key used by the UE air interface.
  • the macro base station may send the shared root key used by the UE air interface to the micro base station.
  • the micro base station derives an encryption and integrity protection key of the UE air interface according to the shared root key, according to the encryption and integrity protection key and the negotiated security The algorithm performs secure communication with the macro base station and the UE.
  • the micro base station after the micro base station receives the encryption and integrity protection key of the derived UE air interface sent by the macro base station, the micro base station according to the encryption and integrity protection key and the The security algorithm performs secure communication with the UE and the macro base station.
  • the embodiment of the present invention provides a security processing method for mobile communication, where the micro base station and the macro base station perform a security algorithm interaction; the micro base station receives the negotiated security algorithm sent by the macro base station; and then, the micro base station And receiving, by the macro base station, a security key used by the UE air interface, so that communication between the UE, the micro base station, and the macro base station can perform security protection processing according to the negotiated security algorithm and the security key.
  • the security algorithm negotiation and the security key acquisition are performed between the three network entities of the UE, the macro base station, and the micro base station, when the macro base station determines to perform macro-MAC or CoMP operation on the UE, the UE can securely The macro base station and the micro base station communicate.
  • An embodiment of the present invention provides a method for securely processing a mobile communication.
  • the execution subject of the method is a user equipment, and the method may specifically include:
  • the UE sends the security algorithm supported by the UE to the macro base station.
  • the security algorithm supported by the UE is sent to the MME through the NAS signaling, and then the MME forwards the received security algorithm supported by the UE to the macro base station through the S1 interface signaling.
  • the UE receives the negotiated security algorithm notified by the macro base station, where the negotiated security algorithm is obtained by the macro base station according to a security algorithm supported by the UE, the micro base station, and the macro base station.
  • the macro base station After the macro base station acquires the security algorithm supported by the UE and the micro base station, the macro base station negotiates a security algorithm supported by the UE, the micro base station, and the macro base station, and obtains a negotiation.
  • the security algorithm uses the negotiated security algorithm as a security algorithm used by the UE air interface, and notifies the UE and the micro base station of the negotiated security algorithm.
  • the UE performs, according to the negotiated security algorithm and a security key used by the UE air interface, after the macro base station sends the security key to the micro base station, and performs with the macro base station and the micro base station. Communication.
  • the UE When the UE accesses the network side and communicates with the micro base station or the macro base station through the air interface, the UE may derive the shared root key of the Uu interface according to the shared root key of the NAS layer.
  • security key K — enC used for
  • the user plane data between the UE and the macro base station or the micro base station is encrypted; the security key KRRC_ is used for integrity protection of the control plane signaling between the UE and the macro base station or the micro base station; the security key K S is used for the UE Encryption processing of control plane signaling with a macro base station or a micro base station.
  • the security key may be the shared root key or an encryption and integrity protection key derived from the shared root key.
  • the embodiment of the present invention provides a security processing method for mobile communication, where the UE sends the security algorithm supported by the UE to the macro base station; the UE receives the negotiated security algorithm notified by the macro base station, and the security after the negotiation
  • the algorithm is obtained by the macro base station according to the security algorithm supported by the UE, the micro base station, and the macro base station; the UE is based on the negotiated security algorithm and the security key used by the UE air interface, in the macro base.
  • the station After transmitting the security key to the micro base station, the station communicates with the macro base station and the micro base station.
  • the UE can securely cooperate with the UE.
  • the macro base station and the micro base station communicate.
  • a further embodiment of the present invention provides a method for securely processing a mobile communication. As shown in FIG. 4, the method may specifically include: 401.
  • the macro base station acquires a security algorithm supported by the micro base station.
  • the security algorithm includes an encryption and integrity protection algorithm for communicating between the UE and the macro base station and the micro base station, and performing encryption/decryption and integrity protection operations on data and signaling.
  • the macro base station may obtain multiple types of security algorithms supported by the micro base station. For details, refer to the description of the security algorithm supported by the micro base station in the macro base station in the previous embodiment.
  • the macro base station acquires a security algorithm supported by the UE.
  • the UE When the UE accesses the macro base station, the UE sends the security algorithm supported by the UE to the MME through the NAS signaling, and then the MME forwards the received security algorithm supported by the UE to the macro base station through the S1 interface signaling. .
  • the macro base station determines that the UE needs the macro base station and the micro base station to perform CA or CoMP cooperative communication.
  • the CA is mainly used in the scenario of macro-frequency networking
  • CoMP is mainly used in the scenario of macro-frequency networking.
  • the macro base station and the micro base station may improve the UE by using CA or CoMP cooperative communication. Network service quality.
  • the macro base station After the macro base station obtains the security algorithm supported by the UE and the micro base station, the macro base station performs a security algorithm negotiation according to its own security algorithm, and obtains an intersection of the security algorithms supported by the UE, the micro base station, and the macro base station, and Any security algorithm in the intersection of the security algorithms is used as the negotiated security algorithm, that is, the security algorithm used by the UE air interface.
  • the macro base station cannot negotiate the security algorithm used by the UE air interface. At this time, the macro base station and the base station cannot simultaneously provide cooperative communication for the UE.
  • the macro base station notifies the UE and the micro base station of the negotiated security calculation. Law.
  • the macro base station sends the negotiated security algorithm to the UE through the Uu interface between the macro base station and the UE.
  • the macro eNB may send an RRC connection reconfiguration message (RRC Connection Reconfiguration) to the UE, where the RRC connection reconfiguration message carries the information of the negotiated security algorithm.
  • RRC Connection Reconfiguration RRC Connection Reconfiguration
  • the macro base station sends the negotiated security algorithm to the micro base station.
  • the macro base station may send a serving cell add request to the micro base station by using X interface signaling.
  • the macro base station acquires a security key used by the UE air interface, and sends the security key to the micro base station, so that communication between the UE, the micro base station, and the macro base station can be
  • the negotiated security algorithm and the security key perform security protection processing.
  • the UE When the UE accesses the network side and communicates with the micro base station or the macro base station through the air interface, the UE may derive the shared root key of the Uu interface according to the shared root key of the NAS layer.
  • security key K — enC used for
  • KRRC- is used for integrity protection of control plane signaling between the UE and the macro base station or the micro base station; the security key K S is used for encryption processing of control plane signaling between the UE and the macro base station or the micro base station.
  • the macro base station may obtain the shared root key of the UE air interface from the MME through the S1 interface signaling, where the shared root key is derived by the MME according to the key. After receiving the shared root key of the Uu interface of the UE, the macro base station further derives the user plane data of the UE air interface, the security key K UP of the control plane signaling encryption/decryption and integrity protection operation according to the shared root key. -, K RRC-i, and K RRC- enc.
  • the base station and the MME are not directly connected, when the base station and the UE communicate, the user plane data and the control plane signaling encryption/decryption and integrity protection processing between the micro base station and the UE, the required security key may be Derived from the micro base station, of course, it may also be obtained by the micro base station from the macro base station.
  • the micro base station first needs to obtain a shared root key from the macro base station, and then the micro base station further derives according to the shared root key: the security key is used for encrypting user plane data between the UE and the micro base station; ⁇ - int , used for integrity protection of control plane signaling between the UE and the micro base station; the security key ⁇ is used for encryption processing of control plane signaling between the UE and the micro base station.
  • the micro base station is a micro base station security key acquired from the macro base station, then the macro base station acquired from the MME according to the root key shared ⁇ further derive security keys between the UE and the micro base station, Sending a security key between the derived UE and the micro base station to the micro base station.
  • the micro base station and the UE perform only user plane data transmission without control plane signaling
  • the micro base station security key is derived by the micro base station according to the shared root key ⁇
  • the micro only the base station derives the security key of the user plane data security keys if the micro base station is a macro base station receives ⁇ derived security key, the macro base station forwarding user plane data only macro base station to a micro base station according to the derived root key shared Security key.
  • the micro base station and the MME are directly connected, when the micro base station and the UE communicate, the acquisition of the micro base station key does not need to be forwarded by the macro base station, and the process of obtaining the specific security key is the same as the process of obtaining the security key by the macro base station. This embodiment is not described here.
  • the security processing method of the mobile communication may also be as shown in FIG. 5.
  • the macro base station After the macro base station acquires the security algorithm supported by the micro base station and the UE, the macro base station first performs the negotiation of the security algorithm of the macro base station, the micro base station, and the UE, and uses the negotiated security algorithm as the security algorithm used by the UE air interface. After the macro base station obtains the negotiated security algorithm, the macro base station first notifies the negotiated security algorithm to the micro base station through an X interface between the macro base station and the micro base station.
  • the macro base station After the macro base station determines that the UE needs to perform CA or CoMP cooperative communication between the macro base station and the micro base station, the macro base station first notifies the UE of the negotiated security algorithm, and then acquires the UE. a security key used by the air interface, and transmitting the security key to the micro base station, so that communication between the UE, the micro base station, and the macro base station can be based on the negotiated security algorithm and the security secret Key for security protection, to Thus, the secure processing method of the mobile communication ends.
  • FIG. 4 For a detailed description of the technical details, reference may be made to the description of the method shown in FIG. 4, which is not repeatedly described in the embodiment of the present invention.
  • the macro base station after the macro base station acquires the security algorithm of the micro base station and the UE, the macro base station negotiates the macro base station and the micro base station regardless of whether the UE needs to perform CA or CoMP cooperative communication between the macro base station and the micro base station.
  • the security algorithm of the base station and the UE uses the negotiated security algorithm as the security algorithm used by the UE air interface, and sends the negotiated security algorithm to the micro base station.
  • the macro base station may directly send the negotiated security algorithm to the UE, without requiring the CA of the macro base station and the micro base station to be performed in the UE or
  • CoMP cooperates, it takes time to negotiate the security algorithm, so that the UE obtains the negotiated security algorithm in a short time, so that the UE can be quickly provided with high-quality network services.
  • the security processing method of the mobile communication may also be as shown in FIG. 6.
  • the macro base station first obtains a security algorithm supported by the UE when the UE accesses the macro base station, and the macro base station after the macro base station determines that the UE needs to perform CA or CoMP cooperative communication between the macro base station and the micro base station.
  • the communication between the stations can be performed according to the negotiated security algorithm and the security key, and thus, the mobile communication End security approach.
  • the method shown in FIG. 6 is applicable to the macro base station not obtaining the security algorithm supported by the micro base station when the network is deployed; after the network deployment is completed, the macro base station determines that the UE needs to perform the CA of the macro base station and the micro base station or The macro when the CoMP cooperatively communicates The base station needs to obtain the security algorithm supported by the micro base station from the micro base station, and then the macro base station performs the negotiation of the security algorithm.
  • the encryption and integrity protection keys used by the UE air interface may be performed simultaneously, or the negotiated security algorithm may be obtained first, and then the encryption and integrity protection keys used by the UE air interface are obtained.
  • the micro base station can also obtain the security algorithm supported by the macro base station and the UE and negotiate the security algorithm used by the UE air interface. Therefore, the security algorithm used by the macro base station, the micro base station, and the UE according to the air interface of the UE is securely communicated with the security key, and the security algorithm supported by the macro base station and the UE is specifically obtained, and the security algorithm used by the UE air interface is negotiated.
  • the process is the same as the method in which the macro base station obtains the security algorithm supported by the micro base station and the UE and negotiates the security algorithm used by the UE air interface, and details are not described herein again.
  • the embodiment of the present invention provides a security processing method for mobile communication, where the macro base station acquires a security algorithm supported by the UE and the micro base station; and then performs a security algorithm according to the security algorithm supported by the user equipment, the micro base station, and the macro base station.
  • Negotiating obtaining a negotiated security algorithm; notifying the UE and the micro base station of the negotiated security algorithm; the macro base station acquiring a security key used by the UE air interface, and sending the security key to
  • the micro base station is configured to enable communication between the UE, the micro base station, and the macro base station to perform security protection processing according to the negotiated security algorithm and the security key.
  • the UE can be secure when the macro base station determines to perform macro-MAC or CoMP operation on the UE. Communicate with the macro base station and the micro base station.
  • the macro base station 70 includes: a first acquiring unit 71, a negotiating unit 72, a notifying unit 73, a second acquiring unit 74, and a sending unit 75.
  • the first obtaining unit 71 is configured to separately acquire a security algorithm supported by the user equipment UE and the micro base station.
  • the security algorithm is an algorithm that can be used for secure communication between the UE and the macro base station, the UE and the micro base station, and performs encryption/decryption and integrity protection operations on data and signaling, and may include, for example, encryption and integrity protection.
  • the algorithm is not limited in this embodiment of the present invention.
  • the security algorithm supported by the UE may be sent to the MME through NAS signaling, and then the MME forwards the received security algorithm supported by the UE to the macro base station through the S1 interface signaling. .
  • the first obtaining unit 71 obtains the security algorithm supported by the micro base station in multiple manners.
  • the security algorithm supported by the first acquiring unit 71 to obtain the micro base station may be: performing negotiation between a macro base station OAM and the base station OAM on a security algorithm supported by the macro base station and the base station, after the negotiation is completed.
  • the macro base station OAM sends the negotiated security algorithm to the first acquiring unit 71, and the micro base station OAM also sends the negotiated security algorithm to the micro base station, thereby ensuring the Acer base.
  • the acquiring, by the first acquiring unit 71, the security algorithm supported by the micro base station may be: the first acquiring unit 71 sends a request for acquiring a security algorithm supported by the micro base station to the macro base station OAM, so that After the macro base station OAM interacts with the micro base station OAM, the security algorithm supported by the micro base station is obtained from the micro base station OAM, and then the macro base station OAM sends the security algorithm supported by the micro base station to the The first obtaining unit 71 is described.
  • the obtaining, by the first acquiring unit 71, the security algorithm supported by the micro base station may be: in the process of establishing an interface between the macro base station and the micro base station, the micro base station sends an interface to the macro base station.
  • the security algorithm supported by the micro base station is carried in the request for establishing the interface connection.
  • the first obtaining unit 71 acquires a security algorithm supported by the micro base station from the request for establishing the interface connection.
  • the request for establishing the interface connection may be an X interface connection establishment request message.
  • the micro base station and the macro base station may perform the configuration update, and may also carry the micro base in a configuration update message sent by the micro base station to the macro base station.
  • the first obtaining unit 71 acquires a security algorithm supported by the micro base station from the configuration update message.
  • the negotiating unit 72 is configured to perform security algorithm negotiation according to a security algorithm supported by the UE, the micro base station, and the macro base station, to obtain a negotiated security algorithm.
  • the negotiating unit 72 After the first obtaining unit 71 acquires the security algorithm supported by the UE and the security algorithm supported by the micro base station, the negotiating unit 72 performs a security algorithm negotiation according to its own security algorithm to obtain the UE and the micro An intersection of a security algorithm supported by the base station and the macro base station, and any security algorithm in the intersection of the security algorithm is used as the negotiated security algorithm, so that the negotiated security algorithm is used as a security algorithm for the UE air interface. .
  • the negotiating unit 72 is configured to obtain the UE, the micro base station, and the macro base station according to the security algorithm supported by the UE and the micro base station acquired by the first acquiring unit 71, and the security algorithm supported by the macro base station. An intersection of the supported security algorithms, and any security algorithm in the intersection of the security algorithms is used as the negotiated security algorithm.
  • the negotiation unit 72 cannot negotiate the security algorithm used by the UE air interface. At this time, the macro base station and the base station cannot simultaneously provide cooperative communication for the UE.
  • the notification unit 73 is configured to notify the UE and the base station of the negotiated security algorithm.
  • the notification unit 73 may specifically perform the negotiated security through an interface between the macro base station and the micro base station, for example, an X interface.
  • the algorithm is sent to the micro base station.
  • the notification unit 73 may send a serving cell add request message (SCell Add Request) to the micro base station by using X-interface signaling, where the serving cell adds a request message. It carries a negotiated security algorithm.
  • SCell Add Request serving cell add request message
  • the notification unit 73 may send the negotiated security algorithm to the UE through an interface between the macro base station and the UE, for example, a Uu interface. Specifically, the notification unit 73 may send an RRC connection reconfiguration message to the UE, where the RRC connection reconfiguration message carries the negotiation Information about the security algorithm.
  • the second obtaining unit 74 is configured to obtain a security key used by the UE air interface.
  • the security key used by the UE air interface may be: a shared root key used by the UE air interface received from the MME, or may be, the macro base station further derived by the shared root key.
  • the encryption and integrity protection keys used by the air interface may be: a shared root key used by the UE air interface received from the MME, or may be, the macro base station further derived by the shared root key.
  • the sending unit 75 is configured to send the security key to the micro base station, so that communication between the UE, the micro base station, and the macro base station can be based on the negotiated security algorithm and the security secret The key is secured.
  • the micro base station If the sending unit 75 sends to the micro base station a shared root key used by the UE air interface, the micro base station further derives an encryption and integrity protection key of the UE air interface based on the shared root key.
  • the first obtaining unit 71 When the network is deployed, the first obtaining unit 71 has acquired the security algorithm supported by the micro base station.
  • the first acquiring unit 71 is specifically configured to acquire a security algorithm supported by the UE when the UE accesses the macro base station.
  • the UE When the UE accesses the network side, the UE sends the security algorithm supported by the UE to the MME through the NAS signaling, and then the MME forwards the received security algorithm supported by the UE to the macro base station through the S1 interface signaling. .
  • the macro base station 70 further includes: a determining unit 76.
  • the determining unit 76 is configured to determine whether the UE needs the macro base station and the micro base station to perform CA or CoMP cooperative communication.
  • the CA is mainly used in the scenario of macro-frequency networking
  • CoMP is mainly used in the scenario of macro-frequency networking.
  • the macro base station and the micro base station may improve the UE by using CA or CoMP cooperative communication. Network service quality.
  • the negotiating unit 73 is specifically configured to: after the determining unit 76 determines that the UE needs the macro base station and the micro base station to perform CA or CoMP cooperative communication, according to a security algorithm supported by the UE, the micro base station, and the macro base station, Perform security algorithm negotiation to obtain the negotiated security algorithm.
  • the negotiation unit 73 will negotiate the macro base station, whether the UE needs to perform CA or CoMP cooperative communication between the macro base station and the micro base station.
  • the security algorithm of the micro base station and the UE uses the negotiated security algorithm as the security algorithm used by the UE air interface, and then the notification unit 74 sends the negotiated security algorithm to the micro base station.
  • the determining unit 76 is configured to determine that the UE needs the macro base station and the micro base station to perform CA or CoMP cooperative communication.
  • the notification unit 74 may directly send the already negotiated security algorithm to the UE without performing the macro base station in the UE.
  • the cooperative communication with the micro base station it takes time to negotiate the security algorithm, so that the UE obtains the negotiated security algorithm in a short time, thereby quickly providing the UE with high-quality network services.
  • the notifying unit 74 is further configured to notify the UE of the negotiated security algorithm after the determining unit 76 determines that the UE needs the macro base station and the micro base station to perform CA or CoMP cooperative communication.
  • the first acquiring unit 71 when the network is deployed, the first acquiring unit 71 does not obtain the security algorithm supported by the micro base station; after the network deployment is complete, the determining unit 76 determines that the UE needs to perform the macro base station and the micro base station.
  • the CA or the CoMP is in cooperative communication, the first acquiring unit 71 needs to acquire the security algorithm supported by the micro base station from the micro base station, and the negotiating unit 73 performs the negotiation of the security algorithm.
  • the first obtaining unit 71 is further configured to: after the determining unit 76 determines that the UE needs the macro base station and the micro base station to perform CA or CoMP cooperative communication, send request information to the micro base station, where The request information requests the micro base station to report the security algorithm, so that the micro base station sends the security algorithm supported by the micro base station to the macro base station, and receives the security algorithm supported by the micro base station sent by the micro base station.
  • the UE When the UE accesses the network side and communicates with the micro base station or the macro base station through the air interface, the UE may derive the shared root key of the Uu interface according to the shared root key of the NAS layer.
  • security key K — enC used for
  • the macro base station may obtain the shared root key of the UE air interface from the MME through the S1 interface signaling, where the shared root key is derived by the MME according to the key. After receiving the shared root key of the Uu interface of the UE, the macro base station further derives the user plane data of the UE air interface, the security key K UP of the control plane signaling encryption/decryption and integrity protection operation according to the shared root key. —, K RRC-i , and K RRC— enc .
  • the base station and the MME are not directly connected, when the base station and the UE communicate, the user plane data and the control plane signaling encryption/decryption and integrity protection processing between the micro base station and the UE, the required security key may be Derived from the micro base station, of course, it may also be obtained by the micro base station from the macro base station.
  • the second obtaining unit 74 is specifically configured to receive a shared root key used by the air interface of the UE sent by the mobility management entity, and according to The shared root key derives an encryption and integrity protection key for the UE air interface.
  • the sending unit 75 is specifically configured to send the shared root key to the micro base station, so that the micro base station derives an encryption and integrity protection key of the UE air interface according to the shared root key,
  • the communication between the UE, the micro base station, and the macro base station can perform security protection processing according to the negotiated security algorithm and the encryption and integrity protection key of the UE air interface.
  • the second acquiring unit 74 is configured to receive the shared root density used by the air interface of the UE sent by the mobility management entity. a key, and deriving an encryption and integrity protection key of the UE air interface according to the shared root key.
  • the sending unit 75 is specifically configured to send the encryption and integrity protection key of the UE air interface to the micro base station, so that communication between the UE, the micro base station, and the macro base station can be performed according to the negotiation.
  • the security algorithm and the encryption and integrity protection keys of the UE air interface are subjected to security protection processing.
  • the micro base station only performs data transmission with the UE without signaling.
  • the micro base station only derives the security key of the user plane data
  • the security key of the micro base station is receiving the first two acquisition unit 74 according to the security key shared derived root key
  • the sending unit 75 is only forwarded to the second micro base station unit 74 acquires the security key K derived user plane data up-.
  • the obtaining of the micro base station key does not need to be forwarded by the sending unit 75.
  • the process of obtaining the specific security key is the same as the process of obtaining the security key by the macro base station, and this embodiment does not Let me repeat.
  • the macro base station and the micro base station obtain the negotiated security algorithm, and may obtain the encryption and integrity protection key used by the UE air interface at the same time, or may obtain the negotiated security algorithm first, and then, Obtain an encryption and integrity protection key used by the UE air interface.
  • the embodiment of the present invention provides a macro base station, where the first acquiring unit acquires a security algorithm supported by the UE and the micro base station; and then, the negotiating unit performs according to the security algorithm supported by the user equipment, the micro base station, and the macro base station.
  • the security algorithm negotiates to obtain the negotiated security algorithm; the notification unit notifies the user equipment and the micro base station of the negotiated security algorithm; the second obtaining unit acquires the security key used by the UE air interface, Transmitting, by the sending unit, the security key to the micro base station, so that communication between the UE, the micro base station, and the macro base station can perform security protection processing according to the negotiated security algorithm and the security key.
  • the UE can be secure when the macro base station determines to perform macro-MAC or CoMP operations on the UE. Communicate with the macro base station and the micro base station.
  • the micro base station 90 includes: an interaction unit 91 and a receiving unit 92.
  • the interaction unit 91 is configured to perform a security algorithm interaction with the macro base station, so that the macro base station acquires a security algorithm supported by the micro base station.
  • the interaction between the micro base station and the macro base station by using a security algorithm may be in multiple manners. Specifically, refer to the micro base station in the method embodiment to perform security with the macro base station. A description of the interaction of the full algorithm.
  • the receiving unit 92 is configured to receive the negotiated security algorithm sent by the macro base station, where the negotiated security algorithm is that the macro base station performs security according to a security algorithm supported by the UE, the micro base station, and the macro base station. Obtained after the algorithm is negotiated.
  • the receiving unit 92 receives the negotiated security algorithm sent by the macro base station.
  • the negotiated security algorithm is a security algorithm used by the UE air interface.
  • the receiving unit 92 is further configured to receive a security key sent by the macro base station, so that communication between the UE, the micro base station, and the macro base station can be based on the negotiated security algorithm and the security key. Perform security protection processing.
  • the security key used by the UE air interface may be: a shared root key used by the UE air interface received from the MME, or may be, the macro base station further derived by the shared root key.
  • the encryption and integrity protection keys used by the air interface may be: a shared root key used by the UE air interface received from the MME, or may be, the macro base station further derived by the shared root key.
  • the receiving unit 92 is specifically configured to receive a shared root key used by the UE air interface sent by the macro base station.
  • the micro base station also includes a derivation unit 93.
  • the deriving unit 93 is configured to: after the receiving unit receives the shared root key used by the UE air interface, deriving an encryption and integrity protection key of the UE air interface according to the shared root key, so that the The communication between the UE, the micro base station, and the macro base station can perform security protection processing according to the negotiated security algorithm and the encryption and integrity protection key of the UE air interface.
  • the macro base station may send the shared root key used by the UE air interface to the receiving unit 92.
  • the deriving unit 93 derives an encryption and integrity protection key of the UE air interface according to the shared root key, according to the encryption and integrity protection key and The negotiated security algorithm performs secure communication with the macro base station and the UE.
  • the micro base station receives the derived UE that is sent by the macro base station. After the encryption and integrity protection key of the port, the micro base station performs secure communication with the UE and the macro base station according to the encryption and integrity protection key and the negotiated security algorithm.
  • the receiving unit 92 is specifically configured to receive an encryption and integrity protection key of the derived UE air interface sent by the macro base station, so that communication between the UE, the micro base station, and the macro base station can be performed according to the negotiation.
  • the security algorithm and the encryption and integrity protection keys of the UE air interface are subjected to security protection processing.
  • An embodiment of the present invention provides a micro base station, where the interaction unit performs a security algorithm interaction with a macro base station; the receiving unit receives a negotiated security algorithm sent by the macro base station; and then, the receiving unit receives the macro base.
  • the security key used by the UE air interface sent by the station, so that the communication between the UE, the micro base station and the macro base station can perform security protection processing according to the negotiated security algorithm and the security key.
  • the UE can securely communicate with the Acer base.
  • the station communicates with the micro base station.
  • the user equipment 100 includes: a sending unit 101, a receiving unit 102, and a communication unit 103.
  • the sending unit 101 is configured to send the security algorithm supported by the UE to the macro base station.
  • the security algorithm supported by the UE may be sent to the MME through NAS signaling, and then the MME forwards the received security algorithm supported by the UE to the macro base station through the S1 interface signaling. .
  • the receiving unit 102 is configured to receive the negotiated security algorithm that is notified by the macro base station, where the negotiated security algorithm is that the macro base station negotiates according to the security algorithm supported by the UE, the micro base station, and the macro base station. owned.
  • the macro base station After the macro base station acquires the security algorithm supported by the UE and the micro base station, the macro base station negotiates the security algorithm supported by the UE, the micro base station, and the macro base station, and obtains the negotiated security algorithm, and the negotiated security algorithm As a security algorithm used by the UE air interface, and notifying the receiving unit 102 and the micro by the negotiated security algorithm Base station.
  • the communication unit 103 is configured to: after the macro base station sends the security key to the micro base station, according to the negotiated security algorithm and a security key used by the UE air interface, and the macro base station and The micro base station communicates.
  • the UE When the UE accesses the network side and communicates with the micro base station or the macro base station through the air interface, the UE may derive the shared root key of the Uu interface according to the shared root key of the NAS layer.
  • security key K — enC used for
  • the user plane data between the UE and the macro base station or the micro base station is encrypted; the security key KRRC_ is used for integrity protection of the control plane signaling between the UE and the macro base station or the micro base station; the security key K S is used for the UE Encryption processing of control plane signaling with a macro base station or a micro base station.
  • the receiving unit 102 After the receiving unit 102 obtains the negotiated security algorithm and the security key used by the UE air interface, and the macro base station sends the security key to the micro base station, the UE and the macro base station and the micro The base station communicates.
  • the security key may be the shared key or an encryption and integrity protection key derived from the shared key.
  • An embodiment of the present invention provides a user equipment, where the sending unit sends a security algorithm supported by the UE to a macro base station; the receiving unit receives a negotiated security algorithm notified by the macro base station, and the negotiated security algorithm Obtaining, by the macro base station, a security algorithm supported by the UE, the micro base station, and the macro base station, where the communication unit is based on the negotiated security algorithm and a security key used by the UE air interface, in the macro base. After transmitting the security key to the micro base station, the station communicates with the macro base station and the micro base station.
  • the UE can securely cooperate with the UE.
  • the macro base station and the micro base station communicate.
  • a further embodiment of the present invention provides a macro base station.
  • the macro base station 1 10 includes: a processor 1 1 1 , a transceiver 1 12 and a memory 1 13 .
  • the memory 1 13 is configured to store a security algorithm supported by the macro base station.
  • the transceiver 1 12 is configured to receive a security algorithm supported by the user equipment UE and the micro base station.
  • the security algorithm is an algorithm that can be used for secure communication between the UE and the macro base station, the UE and the micro base station, and performs encryption/decryption and integrity protection operations on data and signaling, and may include, for example, encryption and integrity protection.
  • the algorithm is not limited in this embodiment of the present invention.
  • the security algorithm supported by the UE may be sent to the MME through NAS signaling, and then the MME forwards the received security algorithm supported by the UE to the macro base station through the S1 interface signaling. .
  • the transceiver 12 receives the security algorithm supported by the micro base station in a plurality of manners.
  • the security algorithm supported by the micro-base station by the transceiver 1 12 may be: after the negotiation between the macro base station OAM and the micro base station OAM is performed by the macro base station and the micro base station supporting the security algorithm,
  • the transceiver 1 12 receives the negotiated security algorithm sent by the macro base station OAM, and the micro base station OAM also sends the negotiated security algorithm to the micro base station, thereby ensuring the macro base station and the micro base station.
  • the receiving, by the transceiver, the security algorithm supported by the micro base station may be: the transceiver 1 12 sends a request for acquiring a security algorithm supported by the micro base station to the macro base station OAM, so that the After the macro base station OAM interacts with the base station OAM, the security algorithm supported by the micro base station is obtained from the micro base station OAM, and then the macro base station OAM sends the security algorithm supported by the micro base station to the transceiver. 1 12.
  • the receiving, by the transceiver, the security algorithm supported by the micro base station may be: in the process of establishing an interface between the macro base station and the micro base station, the micro base station sends an interface connection to the macro base station.
  • the security algorithm supported by the micro base station is carried in the request for establishing the interface connection.
  • the transceiver 1 12 obtains a security algorithm supported by the micro base station from a request for establishing the interface connection.
  • the request for establishing the interface connection may be an X interface connection establishment request message.
  • the security update algorithm supported by the micro base station may be carried in the configuration update message sent by the micro base station to the macro base station.
  • the transceiver 1 12 obtains a security algorithm supported by the micro base station from the configuration update message.
  • the processor 1 1 1 is configured to perform security algorithm negotiation according to a security algorithm supported by the UE, the micro base station, and the macro base station, to obtain a negotiated security algorithm.
  • the processor 1 1 1 is specifically configured to obtain, according to a security algorithm supported by the UE and the micro base station, and a security algorithm supported by the macro base station, an intersection of the security algorithms supported by the UE, the micro base station, and the macro base station, where And any security algorithm in the intersection of the security algorithms is used as the negotiated security algorithm.
  • the security algorithm supported by the UE, the micro base station, and the macro base station is negotiated, and the method of the security algorithm is obtained.
  • the method of the security algorithm is obtained.
  • the transceiver 1 12 is further configured to send the negotiated security algorithm to the UE and the micro base station.
  • the transceiver 1 12 is further configured to receive a security key used by the UE air interface.
  • the security key used by the UE air interface may be: a shared root key used by the UE air interface received from the MME, or may be, the macro base station further derived by the shared root key.
  • the encryption and integrity protection keys used by the air interface may be: a shared root key used by the UE air interface received from the MME, or may be, the macro base station further derived by the shared root key.
  • the transceiver 1 12 is further configured to send the security key to the micro base station, so that communication between the UE, the micro base station, and the macro base station can be according to the negotiated security algorithm and the The security key is processed for security protection.
  • the micro base station If the transceiver 1 12 sends to the micro base station a shared root key used by the UE air interface, the micro base station further derives an encryption and integrity protection key of the UE air interface based on the shared root key.
  • the transceiver 1 12 is specifically configured to receive a security algorithm supported by the UE when the UE accesses the macro base station.
  • the security algorithm supported by the UE is sent to the MME through NAS signaling, and then the MME uses the S1 interface signaling to secure the received UE.
  • the algorithm forwards to the macro base station.
  • the processor 111 is configured to determine that the UE needs the macro base station and the micro base station to perform CA or CoMP cooperative communication.
  • the CA is mainly used in the scenario of macro-frequency networking
  • CoMP is mainly used in the scenario of macro-frequency networking.
  • the macro base station and the micro base station may improve the UE by using CA or CoMP cooperative communication. Network service quality.
  • the processor 111 is specifically configured to: after determining that the UE needs the macro base station and the micro base station to perform CA or CoMP cooperative communication, perform security algorithm negotiation according to a security algorithm supported by the UE, the micro base station, and the macro base station, Obtain the negotiated security algorithm.
  • the processor 111 will negotiate the macro base station and the micro base station. And the security algorithm of the UE obtains the negotiated security algorithm, and then the transceiver 112 sends the negotiated security algorithm to the micro base station.
  • the transceiver 112 may directly send the already negotiated security algorithm to the UE without requiring the macro base station and the UE to perform the macro base station and The cooperative communication of the micro base station takes time to negotiate the security algorithm, so that the UE obtains the negotiated security algorithm in a short time, thereby quickly providing the UE with high-quality network services.
  • the transceiver 112 is further configured to send the negotiated security algorithm to the UE after the processor 111 determines that the UE needs the macro base station and the micro base station to perform CA or CoMP cooperative communication.
  • the transceiver 112 when the network is deployed, the transceiver 112 does not obtain a security algorithm supported by the micro base station; after the network deployment is complete, the processor 111 determines that the UE needs to perform the CA of the macro base station and the micro base station. When the CoMP is in cooperative communication, the transceiver 112 needs to acquire the security algorithm supported by the micro base station from the micro base station, and the processor 111 performs negotiation of the security algorithm.
  • the transceiver 112 is further configured to: after the processor 111 determines that the UE needs the macro base station and the micro base station to perform CA or CoMP cooperative communication, to the micro The base station sends the request information, and the request information requests the micro base station to report the security algorithm, so that the micro base station sends the security algorithm supported by the micro base station to the macro base station, and receives the micro The security algorithm supported by the base station.
  • the UE When the UE accesses the network side and communicates with the micro base station or the macro base station through the air interface, the UE may derive the shared root key of the Uu interface according to the shared root key of the NAS layer.
  • security key K — enC used for
  • KRRC- is used for integrity protection of control plane signaling between the UE and the macro base station or the micro base station; the security key K S is used for encryption processing of control plane signaling between the UE and the macro base station or the micro base station.
  • the macro base station may obtain the shared root key of the UE air interface from the MME through the S1 interface signaling, where the shared root key is derived by the MME according to the key. After receiving the shared root key of the Uu interface of the UE, the macro base station further derives the user plane data of the UE air interface, the security key K UP of the control plane signaling encryption/decryption and integrity protection operation according to the shared root key.
  • K RRC-i is used for integrity protection of control plane signaling between the UE and the macro base station or the micro base station
  • K S is used for encryption processing of control plane signaling between the UE and the macro base station or the micro base station.
  • the macro base station may obtain the shared root key of the UE air interface from the MME through the S
  • the base station and the MME are not directly connected, when the base station and the UE communicate, the user plane data and the control plane signaling encryption/decryption and integrity protection processing between the micro base station and the UE, the required security key may be Derived from the micro base station, of course, it may also be obtained by the micro base station from the macro base station.
  • the transceiver 1 12 is configured to receive a shared root key used by the air interface of the UE sent by the mobility management entity.
  • the processor 1 1 1 is further configured to derive an encryption and integrity protection key of the UE air interface according to the shared root key.
  • the transceiver 1 12 is further configured to send the shared root key to the micro base station, so that the micro base station derives a key according to the shared root key.
  • the processor 1 1 1 For further deriving a key according to the shared key.
  • the transceiver 1 12 is further configured to send the derived key to the micro base station,
  • the base station is caused to communicate with the UE according to a key derived from the processor 111.
  • the micro base station transmits data only with the UE without signaling
  • the security key of the micro base station is derived by the micro base station according to the shared root key
  • the micro base station only derives the user plane.
  • Security Key of Data If the security key of the micro base station is a security key derived from the shared root key ⁇ , the transceiver 112 forwards the processor 111 only to the micro base station.
  • the security key K up- of the derived user plane data.
  • the obtaining of the micro base station key does not need to be forwarded by the transceiver 112.
  • the process of obtaining the specific security key is the same as the process of obtaining the security key by the macro base station, and this embodiment does not Let me repeat.
  • the processor 111 and the transceiver 112 are directly connected to the memory 113 in FIG. 11.
  • the processor 111, the transceiver 112, the memory 113, and other modules of the macro base station 110 are further It can be connected via a bus, which can be an IS A (Industry Standard Architecture) bus, a PCI (Peripheral Component) bus or an EISA (Extended Industry Standard Architecture) bus. Wait.
  • the bus may be one or more physical lines, and may be divided into an address bus, a data bus, a control bus, etc. when it is a plurality of physical lines.
  • the embodiment of the present invention provides a macro base station, where the transceiver receives a security algorithm supported by the UE and the micro base station. Then, the processor performs a security algorithm according to the security algorithm supported by the user equipment, the micro base station, and the macro base station.
  • the processor performs a security algorithm according to the security algorithm supported by the user equipment, the micro base station, and the macro base station.
  • Negotiating obtaining a negotiated security algorithm; the transceiver respectively sending a negotiated security algorithm to the user equipment and the micro base station; the transceiver receiving a security key used by the UE air interface, and the security secret
  • the key is sent to the micro base station, so that communication between the UE, the micro base station, and the macro base station can perform security protection processing according to the negotiated security algorithm and the security key.
  • the UE, the macro base station, and the micro base station can enter between three network entities Negotiation of the row security algorithm and acquisition of the security key, so that when the macro base station determines to perform macro-MAC or CoMP operation on the UE, the UE can securely communicate with the macro base station and the micro base station.
  • a further embodiment of the present invention provides a micro base station.
  • the micro base station 120 includes: a transceiver 121 and a memory 122.
  • the memory 122 is configured to store a security algorithm supported by the micro base station.
  • the transceiver 121 is configured to perform a security algorithm interaction with the macro base station, so that the macro base station acquires a security algorithm supported by the micro base station.
  • the micro base station interacts with the macro base station to perform a security algorithm, which may be in various manners. For a specific process, refer to the description of interaction between the micro base station and the macro base station in the method embodiment.
  • the transceiver 121 is configured to receive, after the macro base station obtains the security algorithm of the micro base station, the UE, and the macro base station, and perform the negotiation of the security algorithm, and receive the negotiated security algorithm sent by the macro base station.
  • the transceiver 121 After the macro base station acquires the security algorithm supported by the micro base station, the UE, and the self, and performs the negotiation of the security algorithm, the transceiver 121 receives the negotiated security algorithm sent by the macro base station.
  • the negotiated security algorithm is a security algorithm used by the UE air interface.
  • the transceiver 121 is further configured to receive a security key sent by the macro base station, so that communication between the UE, the micro base station, and the macro base station can be based on the negotiated security algorithm and the security key. Perform security protection processing.
  • the security key used by the UE air interface may be: a shared root key used by the UE air interface received from the MME, or may be, the macro base station further derived by the shared root key.
  • the encryption and integrity protection keys used by the air interface may be: a shared root key used by the UE air interface received from the MME, or may be, the macro base station further derived by the shared root key.
  • the micro base station also includes a processor 123.
  • the processor 123 is configured to: after the transceiver 121 receives the shared root key used by the UE air interface, derive an encryption and integrity protection key of the UE air interface according to the shared root key, so that the The communication between the UE, the micro base station and the macro base station can be protected according to the negotiated security algorithm and the encryption and integrity protection of the UE air interface.
  • the key is securely processed.
  • the macro base station may send the shared root key used by the UE air interface to the transceiver 121.
  • the processor 123 derives an encryption and integrity protection key of the UE air interface according to the shared root key, according to the encryption and integrity protection key and The negotiated security algorithm performs secure communication with the macro base station and the UE.
  • the transceiver 121 is configured to receive an encryption and integrity protection key of the derived UE air interface sent by the macro base station, so that communication between the UE, the micro base station, and the macro base station can be performed according to the negotiation.
  • the security algorithm and the encryption and integrity protection keys of the UE air interface are subjected to security protection processing.
  • the transceiver 121 and the memory 122 shown in FIG. 12 are directly connected to the processor 123.
  • the transceiver 13 1 , the memory 122 and the processor 132, and other modules of the micro base station 130 It can also be connected via a bus, which can be an IS A (Industry Standard Architecture) bus, a PCI (Peripheral Component) bus or an EISA (Extended Industry Standard Architecture) Bus, etc.
  • the bus may be one or more physical lines, and may be divided into an address bus, a data bus, a control bus, etc. when it is a plurality of physical lines.
  • transceiver 121 For a specific implementation of the transceiver 121, the memory 122, and the processor 123, reference may be made to the foregoing embodiments, and details are not described herein.
  • An embodiment of the present invention provides a micro base station, where the transceiver and a macro base station perform a security algorithm interaction; the transceiver receives a negotiated security algorithm sent by the macro base station; and then, the transceiver receives the macro base.
  • the security key used by the UE air interface sent by the station, so that the communication between the UE, the micro base station, and the macro base station can perform security protection processing according to the negotiated security algorithm and the security key.
  • the security algorithm negotiation and the security key acquisition are performed between the three network entities of the UE, the macro base station, and the micro base station, when the macro base station determines to perform macro-MAC or CoMP operation on the UE, the UE can securely cooperate with the UE.
  • the macro base station and the micro base station communicate.
  • a further embodiment of the present invention provides a user equipment. As shown in FIG. 13, the user equipment 130 includes: a transceiver 13 1 , a processor 132 , and a memory 133 .
  • the memory 133 is configured to store a security algorithm supported by the UE.
  • the transceiver 13 1 is configured to send, to the macro base station, the security algorithm supported by the UE stored in the memory 133, so that the macro base station negotiates a security algorithm supported by the UE, the micro base station, and the macro base station,
  • the negotiated security algorithm is used as a security algorithm used by the UE air interface, and the negotiated security algorithm is notified to the UE and the micro base station.
  • the security algorithm supported by the UE may be sent to the MME through NAS signaling, and then the MME forwards the received security algorithm supported by the UE to the macro base station through the S1 interface signaling. .
  • the transceiver 13 1 is configured to receive the negotiated security algorithm notified by the macro base station, where the negotiated security algorithm is that the macro base station negotiates according to a security algorithm supported by the UE, the micro base station, and the macro base station. After getting it.
  • the processor 132 is configured to: after the macro base station sends the security key to the micro base station, according to the negotiated security algorithm and a security key used by the UE air interface, and the macro base station and The micro base station communicates.
  • the UE When the UE accesses the network side and communicates with the micro base station or the macro base station through the air interface, the UE may derive the shared root key of the Uu interface according to the shared root key of the NAS layer.
  • security key K — enC used for
  • the user plane data between the UE and the macro base station or the micro base station is encrypted; the security key KRRC_ is used for integrity protection of the control plane signaling between the UE and the macro base station or the micro base station; the security key K S is used for the UE Encryption processing of control plane signaling with a macro base station or a micro base station.
  • the transceiver 13 1 and the processor 132 shown in FIG. 13 are directly connected to the memory 133.
  • the transceiver 13 1 , the processor 132 and the memory 133 and other components of the user equipment 130 The module can also be connected via a bus, which can be an ISA (Industry Standard Architecture) bus or a PCI (Peripheral Component) bus. Or EISA (Extended Industry Standard Architecture) bus.
  • the bus may be one or more physical lines, and when it is a plurality of physical lines, it may be divided into an address bus, a data bus, a control bus, and the like.
  • transceiver 13 1 For a specific implementation of the transceiver 13 1 , the processor 132 , and the memory 133 , reference may be made to the foregoing embodiments, and details are not described herein again.
  • An embodiment of the present invention provides a user equipment, where the transceiver sends a security algorithm supported by the UE to a macro base station; the transceiver receives the negotiated security algorithm notified by the macro base station, and the negotiated security algorithm And the macro base station is obtained according to the security algorithm supported by the UE, the micro base station, and the macro base station; and the processor is based on the negotiated security algorithm and a security key used by the UE air interface, in the macro base. After transmitting the security key to the micro base station, the station communicates with the macro base station and the micro base station.
  • the UE can securely cooperate with the UE.
  • the macro base station and the micro base station communicate.
  • the device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as the cells may or may not be physical. Units can be located in one place, or they can be distributed to multiple network units. Some or all of the modules may be selected according to actual needs to achieve the objectives of the solution of the embodiment.
  • the connection relationship between the modules indicates that there is a communication connection between them, and specifically, one or more communication buses or signal lines can be realized.
  • the present invention can be implemented by means of software plus necessary general hardware, and of course, dedicated hardware, dedicated CPU, dedicated memory, dedicated memory, Special components and so on.
  • any function performed by a computer program can be easily implemented with the corresponding hardware, and the specific function used to achieve the same function.
  • the hardware structure can also be varied, such as analog circuits, digital circuits, or dedicated circuits.
  • software program implementation is a better implementation in more cases.
  • the technical solution of the present invention which is essential or contributes to the prior art, may be embodied in the form of a software product stored in a readable storage medium, such as a floppy disk of a computer.
  • U disk mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc., including a number of instructions to make a computer device (may be A personal computer, server, or network device, etc.) performs the methods described in various embodiments of the present invention.
  • a computer device may be A personal computer, server, or network device, etc.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Quality & Reliability (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

La présente invention concerne un procédé de traitement de sécurité pour des communications mobiles, une macro-station de base, une micro-station de base et un équipement d'utilisateur (UE). Lorsque la macro-station de base détermine de réaliser une macro-micro opération CA ou CoMP sur l'UE, l'UE peut communiquer de manière sécurisée avec la macro-station de base et avec la micro-station de base. Le procédé comprend les opérations suivantes : la macro-station de base obtient des algorithmes de sécurité pris en charge par l'UE et par la micro-station de base ; selon des algorithmes de sécurité pris en charge par l'UE, par la micro-station de base et par la macro-station de base, réalisation d'une négociation d'algorithme de sécurité afin d'obtenir un algorithme de sécurité négocié ; notification de l'algorithme de sécurité négocié à l'UE et à la micro-station de base ; obtention d'une clé de sécurité utilisée par une interface radioélectrique de l'UE ; et la macro-station de base envoie la clé de sécurité à la micro-station de base de sorte qu'un traitement de protection de sécurité puisse être réalisé sur la communication entre l'UE, la micro-station de base et la macro-station de base selon l'algorithme de sécurité négocié et la clé de sécurité. La présente invention s'applique au domaine des communications.
PCT/CN2012/084586 2012-11-14 2012-11-14 Procédé de traitement de sécurité pour des communications mobiles, macro-station de base, micro-station de base et équipement d'utilisateur WO2014075238A1 (fr)

Priority Applications (2)

Application Number Priority Date Filing Date Title
PCT/CN2012/084586 WO2014075238A1 (fr) 2012-11-14 2012-11-14 Procédé de traitement de sécurité pour des communications mobiles, macro-station de base, micro-station de base et équipement d'utilisateur
CN201280002618.0A CN103959833B (zh) 2012-11-14 2012-11-14 移动通信的安全处理方法、宏基站、微基站和用户设备

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2012/084586 WO2014075238A1 (fr) 2012-11-14 2012-11-14 Procédé de traitement de sécurité pour des communications mobiles, macro-station de base, micro-station de base et équipement d'utilisateur

Publications (1)

Publication Number Publication Date
WO2014075238A1 true WO2014075238A1 (fr) 2014-05-22

Family

ID=50730472

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2012/084586 WO2014075238A1 (fr) 2012-11-14 2012-11-14 Procédé de traitement de sécurité pour des communications mobiles, macro-station de base, micro-station de base et équipement d'utilisateur

Country Status (2)

Country Link
CN (1) CN103959833B (fr)
WO (1) WO2014075238A1 (fr)

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101500229A (zh) * 2008-01-30 2009-08-05 华为技术有限公司 建立安全关联的方法和通信网络系统
WO2010151182A1 (fr) * 2009-06-22 2010-12-29 Telefonaktiebolaget L M Ericsson (Publ) Procédé et système de gestion de la sécurité dans un système de télécommunications
CN102612070A (zh) * 2012-02-17 2012-07-25 新邮通信设备有限公司 一种多点协作下的无线资源管理测量集的配置方法和基站

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20110263274A1 (en) * 2006-11-22 2011-10-27 David Fox Telecommunications networks and devices
US9143275B2 (en) * 2008-12-16 2015-09-22 Samsung Electronics Co., Ltd. Methods and apparatus to identify the accessibility of femto-base stations in communication systems
CN102348244B (zh) * 2010-08-03 2014-11-05 华为技术有限公司 蜂窝通信系统、终端在小区间切换的方法及宏基站

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101500229A (zh) * 2008-01-30 2009-08-05 华为技术有限公司 建立安全关联的方法和通信网络系统
WO2010151182A1 (fr) * 2009-06-22 2010-12-29 Telefonaktiebolaget L M Ericsson (Publ) Procédé et système de gestion de la sécurité dans un système de télécommunications
CN102612070A (zh) * 2012-02-17 2012-07-25 新邮通信设备有限公司 一种多点协作下的无线资源管理测量集的配置方法和基站

Also Published As

Publication number Publication date
CN103959833A (zh) 2014-07-30
CN103959833B (zh) 2018-03-13

Similar Documents

Publication Publication Date Title
US11570617B2 (en) Communication method and communications apparatus
US11121862B2 (en) System and method for wireless network access protection and security architecture
US8605904B2 (en) Security method in wireless communication system having relay node
US11343104B2 (en) Method for establishing secured connection, and related device
JP2018521566A (ja) 分散されたコンフィギュレータエンティティ
US20170359719A1 (en) Key generation method, device, and system
US20160080940A1 (en) Method, Apparatus, and System for Configuring Wireless Device
WO2019041802A1 (fr) Procédé et appareil de découverte basés sur une architecture orientée service
JP2018532325A (ja) ユーザ機器ｕｅのアクセス方法、アクセスデバイス、およびアクセスシステム
CN104662997A (zh) 用于缺乏网络覆盖的情况下的设备到设备通信的系统和方法
WO2011088677A1 (fr) Procédé et système de traitement de sécurité durant un rétablissement de connexion rrc
CN108781110B (zh) 用于通过通信网络中继数据的系统和方法
WO2015096138A1 (fr) Procédé de délestage, équipement utilisateur, station de base et point d'accès
WO2011098048A1 (fr) Procédé d'accès à un réseau par un nœud radio, système et nœud de relais
WO2013174267A1 (fr) Procédé, système et dispositif pour l'établissement d'une connexion sécurisée à un réseau local sans fil
WO2013087010A1 (fr) Procédé et dispositif associé pour générer une clé de strate d'accès dans un système de communication
KR20150051568A (ko) 이동 통신 시스템 환경에서 프락시미티 기반 서비스 단말 간 발견 및 통신을 지원하기 위한 보안 방안 및 시스템
US20230179400A1 (en) Key management method and communication apparatus
EP3952374B1 (fr) Procédé et appareil de communication
WO2017024662A1 (fr) Procédé et appareil de vérification d'accès
WO2012116599A1 (fr) Procédé d'établissement de tunnel de sécurité et enb
CN107925874B (zh) 超密集网络安全架构和方法
WO2014075238A1 (fr) Procédé de traitement de sécurité pour des communications mobiles, macro-station de base, micro-station de base et équipement d'utilisateur
CN103974245B (zh) 设备配置方法、设备及系统
CN114362984B (zh) 一种接口安全性保护方法及装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 12888250

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 12888250

Country of ref document: EP

Kind code of ref document: A1