WO2014110908A1

WO2014110908A1 - Secure data transmission method and lte access network system

Info

Publication number: WO2014110908A1
Application number: PCT/CN2013/083505
Authority: WO
Inventors: 王昕�; 和峰
Original assignee: 中兴通讯股份有限公司
Priority date: 2013-01-15
Filing date: 2013-09-13
Publication date: 2014-07-24
Also published as: CN103929740A; CN103929740B

Abstract

Disclosed are a secure data transmission method and an LTE access network. The method comprises: an MeNB obtaining a base station key from a core network, generating a first access layer key according to the base station key, using the first access layer key to encrypt corresponding control plane information and user data, and sending the corresponding control plane information to an LTE user equipment after performing integrity protection on the corresponding control plane information; the MeNB determining a shunting policy of the user data of the LTE user equipment, and sending a request message to a corresponding LPN for providing a multi-stream transmission service for the LTE user equipment; the MeNB receiving a request response sent by the LPN, sending a part of the user data received from the core network to the LTE user equipment after encrypting the corresponding user data using the first access layer key according to the shunting policy, and sending the other part of the user data to the LPN; and the LPN using a second access layer key to encrypt the corresponding user data, and sending the encrypted user data to the LTE user equipment.

Description

Data security transmission method and LTE access network system

The present invention relates to the field of mobile communications, and in particular, to a data security transmission method and a Long Term Evolution (LTE) access network system. BACKGROUND OF THE INVENTION In the prior art, with the continuous evolution of wireless communication technologies and protocol standards, mobile packet services have undergone tremendous development, and the data throughput capability of a single terminal has been continuously improved. Taking the LTE system as an example, the data transmission rate of the downlink maximum rate of 100 Mbps can be supported in the 20 M bandwidth. In the subsequent LTE (LTE Advanced, LTE-A) system, the data transmission rate will be further increased, even up to 1 Gbps. . The inflated growth of terminal data traffic has put tremendous pressure and challenge on the service capabilities and deployment strategies of mobile networks. On the one hand, operators need to enhance existing network deployment and communication technologies. On the other hand, they hope to accelerate the promotion of new technologies and network expansion, so as to achieve rapid improvement of network performance. Since the development of mobile communication systems, it has become more and more difficult to provide economical, flexible, and high-capacity services only by enhancing macro networks. Therefore, deploy low power nodes (Low Power Nodes, LPN for short). The network strategy of providing small cell coverage has become an attractive solution, especially when indoor/outdoor hotspots with huge data transmission need to provide users with a good user experience.

The enhancements in LPN deployment have been identified by the Third Generation Partnership Projects (3GPP) as one of the most interesting topics in future network development. The deployment of LPN in the coverage of the macro network is very different from the traditional macro network in terms of transmission, mobility, security and interference. There are many problems in the process of each base station independently providing services to the terminal, and it cannot meet the requirements. The demand for large data volume and high mobility; and due to practical limitations and historical factors, the selection of LPN backhaul (Backhaul) is also diverse, and the characteristics of each interface are different, and the macro network The coordination interaction is limited. Therefore, in the scenario where the LPN is deployed, how to use the features of the macro base station (Macro eNB, referred to as MeNB) to maintain a good cooperation mechanism, thereby providing an optimized communication service for the user equipment (User Equipment, UE for short). To meet the needs of higher bandwidth, better performance, lower cost, more security and a variety of backward links, it is an important issue to be solved in the future development of LTE communication systems. Therefore, there is an urgent need for a system architecture in which a heterogeneous network in which a macro base station and a low power node are deployed provides a joint transmission service for the UE and a method for securely transmitting data in the architecture. SUMMARY OF THE INVENTION The present invention provides a data security transmission method and an LTE access network system, to at least solve the related art lacking a heterogeneous network in which a macro base station and a low power node are deployed, to provide a joint transmission service for the UE. The problem of implementing a method of securely transferring data in this architecture. The present invention provides a data security transmission method for a heterogeneous network based on an LTE system. The heterogeneous network includes: an LTE core network, an LTE access network, and an LTE user equipment. One or more LTE access networks are deployed. The macro base station MeNB has one or more low-power nodes LPNs deployed in the coverage of the MeNB. The method includes: when the LTE user equipment accesses the MeNB, the MeNB acquires the base station key from the LTE core network, and generates the base station key according to the base station key. An access layer key, and through the control plane interface with the LTE user equipment, encrypts the corresponding control plane information and user data by using the first access layer key, and performs integrity protection on the corresponding control plane information And then sent to the LTE user equipment; the MeNB determines a traffic off policy of the user data of the LTE user equipment, and sends a multi-stream transmission service for the LTE user equipment to the corresponding LPN through the backward link interface between the MeNB and the LPN. Request message, control plane information required by the LPN, and a second access layer key; the MeNB receives the request response sent by the LPN, and receives the request response from the core network according to the offload policy A part of the user data is encrypted by using the first access layer key to encrypt the corresponding user data and then sent to the LTE user equipment through the user plane interface with the LTE user equipment, and the other part of the user data is passed through the backward chain. The road interface is sent to the LPN. The LPN encrypts the corresponding user data by using the second access layer key, and sends the encrypted user data to the LTE user equipment through the user plane interface with the LTE user equipment. Preferably, the first access layer key comprises: a user plane encryption key for user plane data encryption, and a control plane encryption key for control plane signaling encryption and/or for control plane signaling integrity Protected control plane integrity protection key. Preferably, the method further includes: receiving, by the LPN, a measurement plane interface between the LTE user equipment and the LTE user equipment, and receiving the measurement result information reported by the LTE user equipment, and adjusting the scheduling of the LTE user equipment according to the measurement result information. Preferably, when the user has only a user plane interface between the LPN and the LTE user equipment, the second access layer key includes: a user plane encryption key for user plane data encryption; and between the LPN and the LTE user equipment. The user interface interface and the control plane interface, the second access layer key includes: a user plane encryption key for user plane data encryption, and a control plane encryption key for control plane signaling encryption and/or for Control plane integrity protection key for control plane signaling integrity protection. Preferably, the first access layer key is the same as or different from the second access layer key; when the first access layer key is different from the second access layer key, the LTE user equipment needs to support two Set of security algorithms. Preferably, the offloading policy of the user data by the MeNB includes: determining, by the MeNB, a traffic offloading policy of the user data by using the radio bearer as the split granularity according to the network load and the measurement result information reported by the LTE user equipment. Preferably, when the offloading policy uses the radio bearer as the offloading granularity, the protocol form of the offloading policy includes: a data packet aggregation protocol entity for performing security protection, and each lower layer protocol entity respectively configured on the MeNB and the LPN, wherein each The lower layer protocol entities include: a radio link control sublayer, a medium access control sublayer, and a physical layer. Preferably, the method further includes: in a multi-stream transmission service process, when the key update is required according to the requirements of the operator, the LTE core network, or the LTE access network, the MeNB sends the secret to the LPN through the backward link interface. The key update indication indicates that the key update indication carries a new access layer key; the MeNB receives the key update response that the LPN feeds back through the backward link interface, and notifies the LTE through the control plane interface between the LTE user equipment and the LTE user equipment. Update of the user device key. The present invention also provides an LTE access network system in which one or more macro base stations MeNB are deployed in the LTE access network, and one or more low power nodes LPN are deployed within the coverage of the MeNB: MeNB, which is set to When the LTE user equipment accesses the MeNB, the base station key is obtained from the LTE core network, the first access layer key is generated according to the base station key, and the first access layer is used through the control plane interface with the LTE user equipment. The key encrypts the corresponding control plane information and the user data, and performs integrity protection on the corresponding control plane information, and then sends the information to the LTE user equipment; determines a traffic splitting strategy of the user data of the LTE user equipment, and passes the LPN through the LPN. a backward link interface, sending a request message for providing a multi-stream transmission service for the LTE user equipment, control plane information required by the LPN, and a second access layer key to the corresponding LPN; receiving the request response sent by the LPN According to the splitting policy, a part of the user data received from the core network is used to interface with the LTE user equipment, and the first access layer key is used to input the corresponding user data. After being encrypted, the LTE user equipment is sent to the LTE user equipment, and another part of the user data is sent to the LPN through the backward link interface. The LPN is configured to receive the request message sent by the MeNB for providing the multi-stream transmission service for the LTE user equipment, and send the request message to the MeNB. Requesting a response; encrypting the corresponding user data by using the second access layer key, and transmitting the encrypted user data to the LTE user equipment through the user plane interface with the LTE user equipment. Preferably, the first access layer key comprises: a user plane encryption key for user plane data encryption, and a control plane encryption key for control plane signaling encryption and/or for control plane signaling integrity. Control surface integrity protection key for sexual protection. Preferably, the foregoing LPN is further configured to: receive, through its control plane interface with the LTE user equipment, receive

The measurement result information reported by the LTE user equipment, and the scheduling of the LTE user equipment is adjusted according to the measurement result information. Preferably, when the user has only a user plane interface between the LPN and the LTE user equipment, the second access layer key includes: a user plane encryption key for user plane data encryption; and between the LPN and the LTE user equipment. The user interface interface and the control plane interface, the second access layer key includes: a user plane encryption key for user plane data encryption, and a control plane encryption key for control plane signaling encryption and/or for Control plane integrity protection key for control plane signaling integrity protection. Preferably, the first access layer key is the same as or different from the second access layer key; when the first access layer key is different from the second access layer key, the LTE user equipment needs to support two Set of security algorithms. Preferably, the foregoing MeNB is configured to: determine, according to the network load and the measurement result information reported by the LTE user equipment, the traffic offloading policy of the user data by using the radio bearer as the split granularity. Preferably, when the offloading policy uses the radio bearer as the offloading granularity, the protocol form of the offloading policy includes:

The MeNB and the LPN are respectively provided with a data packet aggregation protocol entity for performing security protection, and each lower layer protocol entity, wherein each lower layer protocol entity includes: a radio link control sublayer, a media access control sublayer, and a physical layer. Preferably, the foregoing MeNB is further configured to: when the key update is required according to the requirements of the operator, the LTE core network, or the LTE access network, send the secret to the LPN through the backward link interface in the multi-stream transmission service process. The key update indication, the key update indication carries a new access layer key; receives the key update response that the LPN feeds back through the backward link interface, and notifies the LTE user through the control plane interface between the LPN and the LTE user equipment Update of the device key. The beneficial effects of the present invention are as follows: In the embodiment of the present invention, a part of user data can be offloaded to an LPN for transmission by a heavily loaded MeNB.

When the UE moves between the Small cells, the signaling in the handover process can be reduced, and the message load of the network is reduced. For the UE, the bandwidth widening of the multi-carrier transmission can better meet the requirements of the large data volume service, and the distance. The more recent LPN transmission is also more power efficient, and the system architecture improves the user experience. In addition, in the system architecture of the embodiment of the present invention, the key is transmitted to the LPN through the macro base station in the heterogeneous access network. The transmission on the radio link between the LPN and the UE can implement the configured security protection function, which ensures the security performance of the system architecture. The technical solution of the embodiment of the present invention can provide a good joint transmission service for the UE securely and reliably. The above description is only an overview of the technical solutions of the present invention, and the technical means of the present invention can be more clearly understood, and can be implemented in accordance with the contents of the specification, and the above and other objects, features and advantages of the present invention can be more clearly understood. Specific embodiments of the invention are set forth below. BRIEF DESCRIPTION OF THE DRAWINGS Various other advantages and benefits will become apparent to those skilled in the art from this description. The drawings are only for the purpose of illustrating the preferred embodiments and are not to be construed as limiting. Throughout the drawings, the same reference numerals are used to refer to the same parts. 1 is a schematic diagram of a node deployment scenario according to an embodiment of the present invention; FIG. 2 is a schematic diagram of a system architecture of the present invention; FIG. 3 is a flowchart of a data security transmission method according to an embodiment of the present invention; FIG. 5 is a schematic diagram of a user plane and a control plane protocol in the embodiment of the present invention; FIG. 6 is a signaling flowchart of the example 1 of the embodiment of the present invention; Figure 7 is a signaling flow chart of Example 2 of the embodiment of the present invention; Figure 8 is a signaling flow chart of Example 3 of the embodiment of the present invention; and Figure 9 is a schematic structural diagram of an LTE access network system according to an embodiment of the present invention. DETAILED DESCRIPTION OF EXEMPLARY EMBODIMENTS Exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. While the embodiments of the present invention have been shown in the drawings, the embodiments Rather, these embodiments are provided so that this disclosure will be more fully understood, and the scope of the disclosure may be fully disclosed to those skilled in the art. In order to meet the requirements of a user with higher bandwidth, better performance, lower cost, more security, and multiple backward links, the present invention provides a heterogeneous network in which a macro base station and a low power node are deployed to provide a joint for the UE. The system architecture of the transport service and the scheme for realizing secure transmission of data in the architecture. The architecture and scheme are applicable to various Backhaul links, and can provide a good joint transmission service for the UE securely and reliably. The present invention will be further described in detail below in conjunction with the drawings and embodiments. It is understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention. Method embodiment According to an embodiment of the present invention, a data security transmission method is provided for a heterogeneous network based on a Long Term Evolution (LTE) system, where the heterogeneous network includes: an LTE core network, an LTE access network, and an LTE user equipment, and LTE access One or more macro base stations MeNB are deployed in the network, and one or more low power nodes LPN are deployed within the coverage of the MeNB. Specifically, FIG. 1 is a schematic diagram of a node deployment scenario according to an embodiment of the present invention. As shown in FIG. 1 , one or more LPNs are deployed in a coverage area of a MeNB (eg, in a hotspot area), and the LPN may be a low-power micro base station ( Pico eNB), Relay Node or Home Base Station (HeNB). Correspondingly, the Backhaul interface between the LPN and the MeNB may be a wired interface (such as a fiber) or a wireless interface (such as an Un port). 2 is a schematic diagram of a system architecture of the present invention. As shown in FIG. 2, the system includes an LTE core network (Core Network, abbreviated as CN), an LTE access network composed of an MeNB and an LPN, and a multi-data transmission and reception mechanism. LTE user equipment. The LTE core network is the same as the core network of the existing LTE network. The LTE access network includes an MeNB and an LPN. The MeNB and the core network and the UE are respectively connected to the existing Control Plane (CP) and User Plane (UP). The LPN and the UE can be UP or UP. The CP is connected, and the MeNB and the LPN are Backhaul interfaces (wired or wireless) that can transmit control signaling and user data. FIG. 3 is a flowchart of a data security transmission method according to an embodiment of the present invention. As shown in FIG. 3, a data security transmission method according to an embodiment of the present invention includes the following processing: Step 301: When an LTE user equipment accesses an MeNB, the MeNB The core network obtains the base station key, generates the first access layer key according to the base station key, and uses the first access layer key pair to control the corresponding control plane information and user data through the control plane interface with the LTE user equipment. Performing encryption, and performing integrity protection on the corresponding control plane information, and then sending the information to the LTE user equipment; that is, before the offloading, the MeNB and the LTE user equipment perform normal user data interaction and control signaling interaction according to the prior art. . The first access layer key includes: a user plane encryption key for user plane data encryption, and a control plane encryption key for control plane signaling encryption and/or for control plane signaling integrity protection. The control plane integrity protects the key. Step 302: The MeNB determines a traffic off policy of the user data of the LTE user equipment, and sends a request message for providing the multi-stream transmission service to the LTE user equipment, and the LPN is required to be sent to the corresponding LPN through the backward link interface between the MeNB and the LPN. The control plane information and the second access layer key; in step 302, the MeNB determines the traffic policy of the user data, including: the MeNB according to at least the network load and the measurement result information reported by the LTE user equipment (the MeNB may also be based on other information) , with radio bearer A shunting policy for determining user data for the shunt granularity. When the offloading policy uses the radio bearer as the offloading granularity, the protocol form of the offloading policy includes: a packet aggregation protocol entity for performing security protection on the MeNB and the LPN, and each lower layer protocol entity, wherein each lower layer The protocol entity includes: a radio link control sublayer, a medium access control sublayer, and a physical layer. Step 303: The MeNB receives the request response sent by the LPN, and uses a first access layer key to the corresponding user by using a part of the user data received from the core network according to the splitting policy. The data is encrypted and sent to the LTE user equipment, and another part of the user data is sent to the LPN through the backward link interface. In step 304, the LPN encrypts the corresponding user data by using the second access layer key, and passes through the data. The user plane interface with the LTE user equipment sends the encrypted user data to the LTE user equipment. Preferably, in the embodiment of the present invention, the LPN can receive the measurement result information reported by the LTE user equipment by using the control plane interface with the LTE user equipment, and adjust the scheduling of the LTE user equipment according to the measurement result information. It should be noted that, when only the user plane interface exists between the LPN and the LTE user equipment, the second access layer key includes: a user plane encryption key used for user plane data encryption; between the LPN and the LTE user equipment. When having a user plane interface and a control plane interface, the second access layer key includes: a user plane encryption key for user plane data encryption, and a control plane encryption key for control plane signaling encryption and/or Control plane integrity protection key for control plane signaling integrity protection. In the embodiment of the present invention, the first access layer key is the same as or different from the second access layer key; when the first access layer key is different from the second access layer key, LTE User equipment needs to support two sets of security algorithms. In the embodiment of the present invention, in the multi-stream transmission service process, when the key update is required according to the requirements of the operator, the LTE core network, or the LTE access network, the MeNB needs to send the secret to the LPN through the backward link interface. The key update indication indicates that the key update indication carries a new access layer key; the MeNB receives the key update response that the LPN feeds back through the backward link interface, and notifies the LTE through the control plane interface between the LTE user equipment and the LTE user equipment. Update of the user device key. The above technical solutions of the embodiments of the present invention are described in detail below with reference to the accompanying drawings. From the control plane, the MeNB is responsible for all control signaling with the UE, and on the other hand is responsible for the control plane information required by the LPN, so that the LPN can hold the necessary UE context information, configure each protocol layer, and implement the UE. Effective scheduling; preferably, the LPN and the UE may also have a CP connection (there may be an existing CP connection) Part of the function), so as to obtain more timely information such as the measurement results of the UE, so as to quickly adjust the scheduling strategy. From the perspective of the user, the MeNB sends a part of the UE user data received from the core network to the UE through the UP connection between the UE and the UE according to the splitting policy determined by the user, and the other part is sent to the LP through the Backhaul interface, and then the LPN The prior art is sent to the UE through an air interface. The UE data offload policy determined by the MeNB may be a radio bearer (Radio Bearer, referred to as

RB) is a traffic-split granularity, that is, for services with different Quality of Service (QoS), the MeNB may decide to transmit it to the UE through different carrier links according to its QoS characteristics. For example, real-time services (such as voice) are transmitted on the link between the MeNB and the UE, and services with large data volume and delay tolerance (such as video download) are offloaded to the LPN and then transmitted to the UE. For example, FIG. 4 is a schematic diagram of a feasible protocol form of a traffic offloading policy according to an embodiment of the present invention. As shown in FIG. 4, the MeNB includes the MeNB to transmit the offloaded data to the LPN and then to the user plane part of the UE (upstream data). Then reverse); the interface between the MeNB and the LPN, and the control plane portion of the interface between the possible LPN and the UE. The Backhaul interface protocol between the MeNB and the LPN may be in other forms depending on the wired/wireless characteristics of the specific interface (for example, the GTP-U may also be replaced by other protocols). It can be seen that when the RB is used as the offloading granularity, the network side has a Packet Data Convergence Protocol (PDCP) entity and the following lower layer protocol entities (Radio Link Control (Radio Link Control). The RLC, the Medium Access Control (MAC), and the Physical Layer (PHY) are located at the MeNB and the LPN. FIG. 5 is a schematic diagram of a user plane and a control plane protocol in the form of an embodiment of the present invention. The MeNB with heavy load can offload part of the user data to the LPN for transmission. When the UE moves between the Small cells, the signaling in the handover process can be reduced, and the message load of the network is reduced. For the UE, the multi-carrier transmission is performed. The bandwidth widening can better meet the needs of large data services, and the power consumption is also more efficient with LPN transmissions that are closer. The system architecture improves the user experience. In the process of message transmission between the user and the access network through the wireless interface, the network side needs to provide sufficient security protection mechanism to prevent the message from being intercepted and easily cracked by the attacker. In the LTE system, when the UE is attached to the network, the MeNB acquires a base station key (eNB Key, denoted as K^B) from the core network and/or derives an access stratum key (AS Key for short). ). The AS Key includes a user plane encryption key (UP Key, K _UPen .), a control plane encryption key (RRC Key, K _RRCen .), and a control plane security key (RRC Key, K _RRCmt ), which are respectively used for the user plane. Encryption of data, encryption of control plane signaling, and integrity protection of control plane signaling. In the following behavior example, the MeNB uses the AS Key and the corresponding encryption/guarantee algorithm to provide configuration security protection for the sending information, and after receiving the UE, the UE performs processing such as decryption/integrity verification according to the corresponding key and algorithm. The functions are all located in the PDCP layer of the protocol. In the system architecture of the present invention, the LPN is only a cooperative base station that performs the offload data transmission task in the access network, and does not have direct information interaction with the core network; and because the MeNB and the LPN use the RB as the offload granularity for data offloading and The joint data transmission service is provided to the UE. As shown in the foregoing protocol, the PDCP layer is located at the MeNB and the LPN, respectively. Therefore, the LPN cannot obtain K^B from the core network, and the PDCPL _PN cannot protect the encryption/security of the shunt data and possible control signaling. The security problem is extremely serious. Because, in the architecture of the embodiment of the present invention, for the UE that obtains the joint transmission service, the MeNB needs to transmit its necessary key to the LPN that bears the offload transmission. However, if the MeNB transmits K^B to the LPN in order to derive the AS Key, since the LPN is physically lower than the MeNB, it is easy to be intruded by an attacker, and the risk of key leakage is high. Once the K^B on the LPN side is cracked, the K^B on the MeNB side is also leaked. Therefore, the scheme in which the two base stations in the access network share the same K^B is not feasible. In order to solve this problem in the architecture in a safe and effective manner, the embodiment of the present invention proposes the following solutions:

The LPN obtains a security key (AS Key) from the MeNB, and performs corresponding security protection according to the configuration of the offloaded data and the possible control signaling transmitted on the radio interface. The security key refers to the AS Key derived by the MeNB according to K^B, and the MeNB determines the AS Key used for transmitting to the LPN and the AS Key used by the MeNB according to the network configuration and the UE capability (supporting one/two sets of security contexts). Is it consistent? The security key is different according to the specific traffic distribution mode: if only the transmission of the offload data between the LPN and the UE (that is, only UP), the AS Key only includes the UP Key, that is, K _UP; if there is a split between the LPN and the UE The transmission of data and control signaling (ie having UP and CP, even if only part of the CP), then the AS key includes all UP Keys and RRC Keys, ie K _Upenc , and at least one of K _RRCenc and K _RRCmt . The conditions for the LPN to obtain the security key from the MeNB are as follows (but not limited to): In the case of the offloading service request, the MeNB transmits the necessary information such as the offloading bearer and the security key to the LPN through the Backhaul interface; When the key is updated, that is, in the process of the joint transmission service, according to the requirement of the operator, the core network or the MeNB/LPN itself to update the UE key, the MeNB transmits the updated security key to the LPN through the Backhaul interface. Through the above system and the method for implementing secure transmission data, in the system architecture of the present invention, the key is transmitted to the LPN through the macro base station in the heterogeneous access network, so that the transmission on the radio link between the LPN and the UE can be configured. The security protection function guarantees the security performance of the system architecture. The embodiments of the present invention are exemplified below in conjunction with different embodiments. Example 1: The MeNB and the LPN are deployed in the network. These two nodes constitute the access network of the system architecture of the present invention, and the LPN bears the transmission of the offloaded data. At the network side, it is decided to provide the UE with cross-base station multi-stream joint transmission service. During the preparation process, the MeNB transmits the AS Key to the LPN so that it can perform security protection functions. Figure 6 is a signaling flow chart of the first embodiment of the present invention. As shown in Figure 6, the method may include the following steps: Step 1: The UE accesses the macro cell established by the MeNB according to the existing LTE procedure, and A CP connection (RRC Connection) that can transmit control plane information and an UP connection that can transmit user data are established. The MeNB obtains the KeNB from the core network, and derives the AS Key (including the UP Key and the RRC Key), and utilizes the AS.

The Key together with the corresponding encryption/surpass algorithm provides a configured security protection for the transmitted/received information. Step 2: The MeNB decides to offload a certain data bearer of the UE to the LPN according to the network load and the measurement report of the UE, and the remaining bearers are still transmitted on the radio link between the MeNB and the UE.

The MeNB transmits the necessary UE context and the like to the LPN through the Backhaul interface to request to provide the multi-stream transmission service for the UE. For example, the information may be carried in a message called a “bearer setup request” (may be other existing The message, or a new message, which is the same as the processing of the message name mentioned below, includes the relevant parameters of the offloading bearer, the security capabilities of the UE, and the like. In the present invention, the message should carry an AS Key derived by the MeNB according to the KeNB. In this example, there is only an UP connection between the LPN and the UE (as shown in FIG. 6, that is, the LPN only bears the transmission of the offloaded data), then the AS Key transmitted by the MeNB to the LPN only includes the UP Key (such as KUPenc). Preferably, the AS Key transmitted by the MeNB to the LPN may be the same as or different from the AS Key used by the MeNB itself. If the two AS keys are different, the MeNB must know that the UE can support two different security contexts, that is, the messages sent/received by the UE on the two wireless carriers with the MeNB and the LPN are respectively encrypted/decrypted using different security keys. And integrity protection/verification. The LPN agrees to the post-establishment reply response message of the offload bearer, which may be referred to as a "bearer setup response" message, and the message may carry a list of the admission bearers and specific configurations of the UE protocol layers. Step 3: After receiving the consent splitting response message of the LPN reply, the MeNB notifies the UE to access the cell established by the LPN. In this example, the UE only has an UP connection with the LPN, and the user data transmitted on the wireless carrier has a key (KUPenc) and an encryption protection according to the configuration, that is, the sender (such as the MeNB or the LPN). The user data interacting with the wireless link on the receiving end (such as the UE) can be encrypted and decrypted separately by using a valid key and a known algorithm, and the security performance requirements of the network are guaranteed. Example 2: Same as the deployment scenario of instance 1. In the service process in which the MeNB and the LPN provide joint transmission for the UE, the MeNB side updates the key, and then it needs to notify the LPN of the updated key, so that its effective execution Line security features. FIG. 7 is a signaling flowchart of Embodiment 2 of the embodiment of the present invention. As shown in FIG. 7, the following may be included. Step 1 In the system architecture of the embodiment of the present invention, a wireless connection between the UE and the MeNB and the LPN is respectively implemented. Connect, thereby obtaining a multi-stream joint transmission service across base stations. The UE and the MeNB are the same as the prior art, and the CP and the UP are connected. In this example, an UP connection is established between the UE and the LPN. The LPN pairs the data transmitted between the UE and the UP Key (KUPenc) obtained from the MeNB. The algorithm performs security protection for encryption/decryption. Step 2: During the process of the UE being connected to the network, the key may be updated according to the requirements of the operator, the core network, or the access network itself. Then, after updating the own key, the MeNB needs to update the key. The key is notified to the LPN. For example, the information can be carried in a message called a "key update indication" and passed to the LPN via the Backhaul interface. Preferably, the message may also carry an indication of whether the key is updated, and the updated key. This example takes the UP connection between the LPN and the UE as an example. Therefore, the message carries the updated UP Key (such as KUPenc'). Preferably, after the key is updated, the New AS Key transmitted by the MeNB to the LPN may be the same as or different from the New AS Key used by the MeNB itself. If the two AS keys are different, the MeNB must know that the UE can support two different security contexts, that is, the data transmitted/received by the UE on the two wireless carriers with the MeNB and the LPN are respectively encrypted/decrypted using different security keys. . It should be noted that when the MeNB and the LPN use different keys, only the LPN side needs to update the key at a time and the MeNB does not need the requirement. Then, the MeNB derives the updated key for the LPN and then notifies the LPN ( Because the MeNB and the LPN in this architecture will exchange some necessary information related to data packet transmission in real time, the MeNB will know the need to update the key on the LPN side in time. Preferably, the LPN may reply to the response message after successfully updating the key, such as a message called "Key Update Response". On the other hand, the MeNB also needs to notify the UE of the update of the key. After the configuration update of each node is completed, the service for cross-base station offload joint transmission may be continued, and the data exchanged between the UE and the LPN in the access network uses a new key and algorithm for encryption/decryption security protection. Example 3: Same as the deployment scenario of instance 1. In the architecture in which the MeNB and the LPN provide the UE with the inter-base station multi-stream joint transmission service, this embodiment takes the CP and the UP connection between the LPN and the UE as an example. During the preparation of the multi-stream service or the need for key update on the network side, the MeNB needs to transmit the AS Key to the LPN to It can perform security protection functions. FIG. 8 is a signaling flowchart of Example 3 of the embodiment of the present invention. As shown in FIG. 8, the following may be included: Step 1: When the MeNB decides to provide a multi-stream transmission service across the base station for the UE accessing the cell, the MeNB determines that Information such as the UE context is transmitted to the LPN through the Backhaul interface, as carried in the "bearer setup request" message. In addition to the necessary information about the offloading bearer related parameters and the security capabilities of the UE, the message also needs to include the AS Key derived by the MeNB according to the KeNB. This example takes the UP and RRC connections between the LPN and the UE as an example. Therefore, the AS Key transmitted by the MeNB to the LPN needs to include the UP Key and the RRC Key (KUpenc, and at least one of KRRCenc and KRRCint). Preferably, the AS Key transmitted by the MeNB to the LPN may be the same as or different from the AS Key used by the MeNB itself. If the two AS Keys are different, then the MeNB must know that the UE can support two different sets of security contexts.

After the LPN agrees to establish the offloaded bearer, it responds to the MeNB with a response message, as may be referred to as a "bearer setup response"message; then the MeNB may notify the UE to access the cell established by the LPN. Since the UE has a CP and UP connection with the MeNB and the LPN respectively, the user data and control signaling transmitted on the two wireless carriers are protected by the key and the algorithm according to the configuration, and the security protection of the network is required. It is guaranteed. Step 3: In the process of the multi-stream service, if the network side (including the operator, the core network, the MeNB, and the LPN) has a need to update the key, the MeNB needs to notify the LPN of the updated key. For example, the information can be carried in a message called a "key update indication" and passed to the LPN via the Backhaul interface. Preferably, the message carries an indication of "whether the key is updated" and the updated key. This example takes the example of an UP and RRC connection between the LPN and the UE. Therefore, the New AS Key transmitted by the MeNB to the LPN needs to include the UP Key and the RRC Key (KUpenc', and at least one of KRRCenc' and KRRCint'). Preferably, after the key is updated, the New AS Key transmitted by the MeNB to the LPN may be the same as or different from the New AS Key used by the MeNB itself. If the two AS Keys are different, then the MeNB must know that the UE can support two different sets of security contexts. Preferably, the LPN may reply to the response message after successfully updating the key, such as a message called "Key Update Response". On the other hand, the MeNB needs to notify the UE of information such as update of the key and change of the protocol layer configuration. After the configuration update of each node is completed, the service of the cross-base station offload joint transmission may be continued, and the UE and the access network The user data and control signaling that the MeNB interacts with the LPN uses the new key and algorithm to perform effective encryption and secure security protection according to the configuration. In summary, with the technical solution of the embodiment of the present invention, a part of user data can be offloaded to the LPN for transmission by the heavily loaded MeNB, and the UE can also reduce the signaling in the handover process when moving between the Small cells. The message load of the network; for the UE, the bandwidth widening of the multi-carrier transmission can better meet the demand of the large data volume service, and the LPN transmission with the closer distance is also more power-saving, and the system architecture is improved. In addition, in the system architecture of the embodiment of the present invention, the key is transmitted to the LPN through the macro base station in the heterogeneous access network, so that the transmission on the radio link between the LPN and the UE can implement the configured security protection function. , to ensure the security of the system architecture. The technical solution of the embodiment of the present invention can provide a good joint transmission service for the UE securely and reliably. System Embodiments According to an embodiment of the present invention, an LTE access network system is provided. One or more macro base stations MeNB are deployed in an LTE access network, and one or more low-power nodes are deployed in a coverage area of the MeNB. LPN, preferably, FIG. 1 is a schematic diagram of a node deployment scenario according to an embodiment of the present invention. As shown in FIG. 1, one or more LPNs are deployed in the coverage of the MeNB (such as in a hotspot area), and the LPN may be a low power micro. A base station (Pico eNB), a relay node (Relay Node), or a home base station (HeNB). Correspondingly, the Backhaul interface between the LPN and the MeNB can be a wired interface (such as a fiber) or a wireless interface (such as an Un port). 2 is a schematic diagram of a system architecture of the present invention. As shown in FIG. 2, the system includes an LTE core network (Core Network, abbreviated as CN), an LTE access network composed of an MeNB and an LPN, and a multi-data transmission and reception mechanism. LTE user equipment. The LTE core network is the same as the core network of the existing LTE network. The LTE access network includes an MeNB and an LPN. The existing control plane (Control Plane, abbreviated as CP) and the user plane (User Plane, referred to as UP) are respectively connected between the MeNB and the core network and the UE. The existing UP connection between the LPN and the UE may have a CP connection. The MeNB and the LPN are Backhaul interfaces (wired or wireless) that can transmit control signaling and user data. FIG. 9 is a schematic structural diagram of an LTE access network system according to an embodiment of the present invention. As shown in FIG. 9, an LTE access network according to an embodiment of the present invention includes: an MeNB 90, and an LPN 92. The following modules are used in the embodiments of the present invention. Carry out detailed instructions.

The MeNB 90 is configured to: when the LTE user equipment accesses the MeNB 90, acquire a base station key from the core network, generate a first access layer key according to the base station key, and interface with a control plane between the LTE user equipment and the LTE user equipment, Encrypting the corresponding control plane information and the user data by using the first access layer key, and performing integrity protection on the corresponding control plane information, and then sending the information to the LTE user equipment; determining a traffic splitting strategy of the user data of the LTE user equipment, And through its backward link interface with the LPN 92, send a request message for providing a multi-stream transmission service for the LTE user equipment, control plane information required by the LPN 92, and a second access layer confidentiality to the corresponding LPN 92. Receiving a request response sent by the LPN 92, according to a part of the user data received from the core network according to the offloading policy, using the first access layer key to the corresponding user data through the user plane interface with the LTE user equipment After being encrypted, the LTE user equipment is sent to the LTE user equipment, and another part of the user data is sent to the LPN 92 through the backward link interface. The first access layer key includes: user plane encryption for user plane data encryption. Key, and control plane encryption key for control plane signaling encryption and/or control plane integrity protection key for control plane signaling integrity protection. The foregoing MeNB 90 is configured to: determine, according to the network load and the measurement result information reported by the LTE user equipment, the traffic offloading policy of the user data by using the radio bearer as the split granularity. When the offloading policy uses the radio bearer as the offloading granularity, the protocol form of the offloading policy includes: the MeNB 90 and the LPN 92 are respectively provided with a packet aggregation protocol entity for performing security protection, and each lower layer protocol entity, wherein each lower layer protocol The entity includes: a radio link control sublayer, a medium access control sublayer, and a physical layer. The foregoing MeNB 90 is further configured to: send a key to the LPN 92 through the backward link interface when the key update is required according to the requirements of the operator, the LTE core network, or the LTE access network in the multi-stream transmission service process. The update indication, the key update indication carries a new access layer key; receives the key update response that the LPN 92 feeds back through the backward link interface, and notifies the LTE user through the control plane interface between the LTE user equipment and the LTE user equipment Update of the device key.

The LPN 92 is configured to receive a request message that is sent by the MeNB 90 to provide a multi-stream transmission service for the LTE user equipment, and send a request response to the MeNB 90; use the second access layer key to encrypt the corresponding user data, and pass the same The user plane interface with the LTE user equipment sends the encrypted user data to the LTE user equipment.

The LPN 92 is further configured to: receive, by using a control plane interface with the LTE user equipment, the measurement result information reported by the LTE user equipment, and adjust the scheduling of the LTE user equipment according to the measurement result information. It should be noted that, when only the user plane interface exists between the LPN 92 and the LTE user equipment, the second access layer key includes: a user plane encryption key used for user plane data encryption; and the LPN 92 and the LTE user equipment. When there is a user plane interface and a control plane interface, the second access layer key includes: a user plane encryption key for user plane data encryption, and a control plane encryption key for control plane signaling encryption and/or Or control plane integrity protection key for control plane signaling integrity protection. In the embodiment of the present invention, the first access layer key is the same as or different from the second access layer key; when the first access layer key is different from the second access layer key, the LTE user The device needs to support two sets of security algorithms. The above technical solutions of the embodiments of the present invention are described in detail below with reference to the accompanying drawings. From the control plane, the MeNB is responsible for all control signaling with the UE, and on the other hand is responsible for the control plane information required by the LPN, so that the LPN can hold the necessary UE context information, configure each protocol layer, and implement the UE. An effective scheduling is performed. Preferably, the LPN and the UE may also have a CP connection (which may be part of the function of the existing CP connection), so as to obtain information such as measurement results of the UE in a timely manner, so as to quickly adjust the scheduling policy. From the perspective of the user, the MeNB sends a part of the UE user data received from the core network to the UE through the UP connection between the UE and the UE according to the splitting policy determined by the user, and the other part is sent to the LP through the Backhaul interface, and then the LPN The prior art is sent to the UE through an air interface. The MeNB may determine that the UE data offloading policy may be a radio bearer (Radio Bearer, RB for short), that is, for a service with different quality of service (QoS), the MeNB may Its QoS characteristics determine that it is transmitted to the UE through different carrier links. For example, real-time services (such as voice) are transmitted on the link between the MeNB and the UE, and services with large data volume and delay tolerance (such as video download) are offloaded to the LPN and then transmitted to the UE. For example, FIG. 4 is a schematic diagram of a feasible protocol form of a traffic offloading policy according to an embodiment of the present invention. As shown in FIG. 4, the MeNB includes the MeNB to transmit the offloaded data to the LPN and then to the user plane part of the UE (upstream data). Then reverse); the interface between the MeNB and the LPN, and the control plane portion of the interface between the possible LPN and the UE. The Backhaul interface protocol between the MeNB and the LPN may be in other forms depending on the wired/wireless characteristics of the specific interface (for example, the GTP-U may also be replaced by other protocols). It can be seen that when the RB is used as the offloading granularity, the network side has a Packet Data Convergence Protocol (PDCP) entity and the following lower layer protocol entities (Radio Link Control (Radio Link Control). The RLC, the Medium Access Control (MAC), and the Physical Layer (PHY) are located at the MeNB and the LPN. FIG. 5 is a schematic diagram of a user plane and a control plane protocol in the embodiment of the present invention. The MeNB with heavy load can offload part of the user data to the LPN for transmission. When the UE moves between the Small cells, the signaling in the handover process can be reduced, and the message load of the network is reduced. For the UE, the multi-carrier transmission is performed. The bandwidth widening can better meet the needs of large data services, and the power consumption is also more efficient with LPN transmissions that are closer. The system architecture improves the user experience. In the process of message transmission between the user and the access network through the wireless interface, the network side needs to provide sufficient security protection mechanism to prevent the message from being intercepted and easily cracked by the attacker. In the LTE system, when the UE is attached to the network, the MeNB acquires the base station key (eNB Key, denoted as K^B) and/or from the core network, and derives the connection. Access Stratum Key (AS Key). The AS Key includes a user plane encryption key (UP Key, K _UPen .), a control plane encryption key (RRC Key, K _RRCen .), and a control plane security key (RRC Key, K _RRCmt ), which are respectively used for the user plane. Encryption of data, encryption of control plane signaling, and integrity protection of control plane signaling. In the following behavior example, the MeNB uses the AS Key and the corresponding encryption/guarantee algorithm to provide configuration security protection for the sending information, and after receiving the UE, the UE performs processing such as decryption/integrity verification according to the corresponding key and algorithm. The functions are all located in the PDCP layer of the protocol. In the system architecture of the present invention, the LPN is only a cooperative base station that performs the offload data transmission task in the access network, and does not have direct information interaction with the core network; and because the MeNB and the LPN use the RB as the offload granularity for data offloading and The joint data transmission service is provided to the UE. As shown in the foregoing protocol, the PDCP layer is located at the MeNB and the LPN, respectively. Therefore, the LPN cannot obtain K^B from the core network, and the PDCPLTM cannot protect the encryption/security of the shunt data and possible control signaling. The security problem is extremely serious. Because, in the architecture of the embodiment of the present invention, for the UE that obtains the joint transmission service, the MeNB needs to transmit its necessary key to the LPN that bears the offload transmission. However, if the MeNB is to transmit to the LPN in order to derive the AS Key, since the LPN is physically lower than the MeNB, it is easy to be intruded by an attacker, and the risk of key leakage is high. Once the K^B on the LPN side is cracked, the K^B on the MeNB side is also leaked. Therefore, the scheme in which the two base stations in the access network share the same K^B is not feasible. In order to solve this problem in the architecture in a safe and effective manner, the embodiment of the present invention proposes the following solutions:

The LPN obtains a security key (AS Key) from the MeNB, and performs corresponding security protection according to the configuration of the offloaded data and the possible control signaling transmitted on the radio interface. The security key refers to the AS Key derived by the MeNB according to K^B, and the MeNB determines the AS Key used for transmitting to the LPN and the AS Key used by the MeNB according to the network configuration and the UE capability (supporting one/two sets of security contexts). Is it consistent? The security key is different according to the specific splitting mode: if there is only the transmission of the _offloaded data between the LPN and the UE (that is, only UP), then the AS Key only includes the UP Key, that is, Κ _υΡ; if there is a split between the LPN and the UE The transmission of data and control signaling (ie having UP and CP, even if only part of the CP), then the AS key includes all UP Keys and RRC Keys, ie K _Upenc , and at least one of K _RRCenc and K _RRCmt .

The conditions for the LPN to obtain the security key from the MeNB are as follows (but not limited to): In the case of the offloading service request, the MeNB transmits the necessary information such as the offloading bearer and the security key to the LPN through the Backhaul interface; When the key is updated, that is, in the process of the joint transmission service, according to the requirement of the operator, the core network or the MeNB/LPN itself to update the UE key, the MeNB transmits the updated security key to the LPN through the Backhaul interface. Through the above system and the method for implementing secure transmission data, in the system architecture of the present invention, the key is transmitted to the LPN through the macro base station in the heterogeneous access network, so that the transmission on the radio link between the LPN and the UE can be configured. The security protection function guarantees the security performance of the system architecture. The embodiments of the present invention are exemplified below in conjunction with different embodiments. Example 1: The MeNB and the LPN are deployed in the network. These two nodes constitute the access network of the system architecture of the present invention, and the LPN bears the transmission of the offloaded data. In the preparation process for the network side to provide the UE with the cross-base station multi-stream joint transmission service, the MeNB transmits the AS Key to the LPN so that it can perform the security protection function. Figure 6 is a signaling flow chart of the first embodiment of the present invention. As shown in Figure 6, the method may include the following steps: Step 1: The UE accesses the macro cell established by the MeNB according to the existing LTE procedure, and A CP connection (RRC Connection) that can transmit control plane information and an UP connection that can transmit user data are established. The MeNB obtains the KeNB from the core network, and derives the AS Key (including the UP Key and the RRC Key), and utilizes the AS.

The Key together with the corresponding encryption/surpass algorithm provides a configured security protection for the transmitted/received information. Step 2: The MeNB decides to offload a certain data bearer of the UE to the LPN according to the network load and the measurement report of the UE, and the remaining bearers are still transmitted on the radio link between the MeNB and the UE. The MeNB transmits the necessary UE context and the like to the LPN through the Backhaul interface to request to provide the multi-stream transmission service for the UE. For example, the information may be carried in a message called a “bearer setup request” (may be other existing The message, or a new message, which is the same as the processing of the message name mentioned below, includes the relevant parameters of the offloading bearer, the security capabilities of the UE, and the like. In the present invention, the message should carry an AS Key derived by the MeNB according to the KeNB. In this example, there is only a UP connection between the LPN and the UE (as shown in Figure 6, that is, the LPN only bears the transmission of the offloaded data), then the AS Key transmitted by the MeNB to the LPN only contains the UP Key (such as KUPenc). Preferably, the AS Key transmitted by the MeNB to the LPN may be the same as or different from the AS Key used by the MeNB itself. If the two AS keys are different, the MeNB must know that the UE can support two different security contexts, that is, the messages sent/received by the UE on the two wireless carriers with the MeNB and the LPN are respectively encrypted/decrypted using different security keys. And integrity protection/verification.

The LPN agrees to the post-establishment reply response message of the offload bearer, which may be referred to as a "bearer setup response" message, and the message may carry a list of the admission bearers and specific configurations of the UE protocol layers. Step 3: After receiving the consent splitting response message of the LPN reply, the MeNB notifies the UE to access the cell established by the LPN. In this example, the UE only has an UP connection with the LPN, and then the wireless carrier The transmitted user data has a key (KUPenc) and encryption protection according to the configuration of the algorithm, that is, the sender (such as MeNB or LPN) and the receiving end (such as UE) interact with each other on the wireless link between the two. The data can be encrypted and decrypted separately using a valid key and a known algorithm, and the security performance requirements of the network are guaranteed. Example 2: Same as the deployment scenario of instance 1. In the service process in which the MeNB and the LPN provide joint transmission for the UE, the MeNB side updates the key, and then it needs to notify the LPN of the updated key, so that it can effectively perform the security protection function. FIG. 7 is a signaling flowchart of Embodiment 2 of the embodiment of the present invention. As shown in FIG. 7, the following may be included. Step 1 In the system architecture of the embodiment of the present invention, a wireless connection between the UE and the MeNB and the LPN is respectively implemented. Connect, thereby obtaining a multi-stream joint transmission service across base stations. The UE and the MeNB are the same as the prior art, and the CP and the UP are connected. In this example, an UP connection is established between the UE and the LPN. The LPN pairs the data transmitted between the UE and the UP Key (KUPenc) obtained from the MeNB. The algorithm performs security protection for encryption/decryption. Step 2: During the process of the UE being connected to the network, the key may be updated according to the requirements of the operator, the core network, or the access network itself. Then, after updating the own key, the MeNB needs to update the key. The key is notified to the LPN. For example, the information can be carried in a message called a "key update indication" and passed to the LPN via the Backhaul interface. Preferably, the message may also carry an indication of whether the key is updated, and the updated key. In this example, the UP connection between the LPN and the UE is taken as an example. Therefore, the message carries the updated UP Key (such as KUPenc'). Preferably, after the key is updated, the MeNB transmits the New AS Key to the LPN and the MeNB itself.

New AS Keys can be the same or different. If the two AS keys are different, the MeNB must know that the UE can support two different security contexts, that is, the data transmitted/received by the UE on the two wireless carriers with the MeNB and the LPN are respectively encrypted/decrypted using different security keys. . It should be noted that when the MeNB and the LPN use different keys, only the LPN side needs to update the key at a time and the MeNB does not need the requirement. Then, the MeNB derives the updated key for the LPN and then notifies the LPN ( Because the MeNB and the LPN in this architecture will exchange some necessary information related to data packet transmission in real time, the MeNB will know the need of the update key on the LPN side in time. Preferably, the LPN may reply to the response message after successfully updating the key, such as a message called "Key Update Response". On the other hand, the MeNB also needs to notify the UE of the update of the key. After the configuration update of each node is completed, the service for cross-base station offload joint transmission may be continued, and the data exchanged between the UE and the LPN in the access network uses a new key and algorithm for encryption/decryption security protection. Example 3: Same as the deployment scenario of instance 1. In the architecture in which the MeNB and the LPN provide the UE with the inter-base station multi-stream joint transmission service, this embodiment takes the CP and the UP connection between the LPN and the UE as an example. During the preparation of the multi-stream service or the need for key update on the network side, the MeNB needs to transmit the AS Key to the LPN so that it can perform the security protection function. FIG. 8 is a signaling flowchart of Example 3 of the embodiment of the present invention. As shown in FIG. 8, the following may be included: Step 1: When the MeNB decides to provide a multi-stream transmission service across the base station for the UE accessing the cell, the MeNB determines that Information such as the UE context is transmitted to the LPN through the Backhaul interface, as carried in the "bearer setup request" message. In addition to the necessary information about the offloading bearer related parameters and the security capabilities of the UE, the message also needs to include the AS Key derived by the MeNB according to the KeNB. In the example, the UP and RRC connections between the LPN and the UE are taken as an example. Therefore, the AS Key transmitted by the MeNB to the LPN needs to include the UP Key and the RRC Key (KUpenc, and at least one of KRRCenc and KRRCint). Preferably, the AS Key transmitted by the MeNB to the LPN may be the same as or different from the AS Key used by the MeNB itself. If the two AS Keys are different, then the MeNB must know that the UE can support two different sets of security contexts.

After the LPN agrees to establish the offloaded bearer, it responds to the MeNB with a response message, as may be referred to as a "bearer setup response"message; then the MeNB may notify the UE to access the cell established by the LPN. Since the UE has a CP and UP connection with the MeNB and the LPN respectively, the user data and control signaling transmitted on the two wireless carriers are protected by the key and the algorithm according to the configuration, and the security protection of the network is required. It is guaranteed. Step 3: In the process of the multi-stream service, if the network side (including the operator, the core network, the MeNB, and the LPN) has a need to update the key, the MeNB needs to notify the LPN of the updated key. For example, the information can be carried in a message called a "key update indication" and passed to the LPN via the Backhaul interface. Preferably, the message carries an indication of "whether the key is updated" and the updated key. In this example, the UP and RRC connections between the LPN and the UE are taken as an example. Therefore, the New AS Key transmitted by the MeNB to the LPN needs to include at least one of the UP Key and the RRC Key (KUpenc', and KRRCenc' and KRRCint'. ). Preferably, after the key is updated, the New AS Key transmitted by the MeNB to the LPN may be the same as or different from the New AS Key used by the MeNB itself. If the two AS Keys are different, then the MeNB must know that the UE can support two different sets of security contexts. Preferably, the LPN may reply to the response message after successfully updating the key, such as a message called "Key Update Response". On the other hand, the MeNB needs to notify the UE of information such as update of the key and change of the protocol layer configuration. After the configuration update of each node is completed, the service of the cross-base station offload joint transmission may be continued, and the user data and control signaling exchanged between the UE and the LPN in the access network are valid according to the configuration by using a new key and algorithm. Encryption and security protection. In summary, with the technical solution of the embodiment of the present invention, a part of user data can be offloaded to the LPN for transmission by the heavily loaded MeNB, and the UE can also reduce the signaling in the handover process when moving between the Small cells. The message load of the network; for the UE, the bandwidth widening of the multi-carrier transmission can better meet the demand of the large data volume service, and the LPN transmission with the closer distance is also more power-saving, and the system architecture is improved. In addition, in the system architecture of the embodiment of the present invention, the key is transmitted to the LPN through the macro base station in the heterogeneous access network, so that the transmission on the radio link between the LPN and the UE can implement the configured security protection function. , to ensure the security of the system architecture. The technical solution of the embodiment of the present invention can provide a good joint transmission service for the UE securely and reliably. The algorithms and displays provided herein are not inherently related to any particular computer, virtual system, or other device. Various general purpose systems can also be used with the teaching based on the teachings herein. From the above description, the structure required to construct such a system is obvious. Moreover, the invention is not directed to any particular programming language. It is to be understood that the invention may be embodied in a variety of programming language, and the description of the specific language has been described above in order to disclose the preferred embodiments of the invention. Numerous specific details are set forth in the description provided herein. However, it is understood that the embodiments of the invention may be practiced without these specific details. In some instances, well-known methods, structures, and techniques are not shown in detail so as not to obscure the understanding of the description. Similarly, the various features of the present invention are sometimes grouped together into a single embodiment, in the above description of the exemplary embodiments of the invention, Figure, or a description of it. However, the method disclosed is not to be interpreted as reflecting the intention that the claimed invention requires more features than those recited in the claims. Rather, as the following claims reflect, inventive aspects reside in less than all features of the single embodiments disclosed herein. Therefore, the claims following the specific embodiments are hereby explicitly incorporated into the specific embodiments, and each of the claims as a separate embodiment of the invention. Those skilled in the art will appreciate that the modules in the devices of the embodiments can be adaptively changed and placed in one or more devices different from the embodiment. The modules or units or components of the embodiments may be combined into one module or unit or component, and further they may be divided into a plurality of sub-modules or sub-units or sub-components. In addition to such features and/or at least some of the processes or units being mutually exclusive, any combination of the features disclosed in the specification, including the accompanying claims, the abstract and the drawings, and any methods so disclosed, or All processes or units of the device are combined. Each feature disclosed in the specification (including the accompanying claims, the abstract and the drawings) may be replaced by alternative features that provide the same, equivalent, or similar purpose, unless otherwise stated. In addition, those skilled in the art will appreciate that, although some embodiments described herein include certain features that are not included in other embodiments, and other features, combinations of features of different embodiments are intended to be within the scope of the present invention. Different embodiments are formed and formed. For example, in the following claims, any one of the claimed embodiments can be used in any combination. The various component embodiments of the present invention may be implemented in hardware, or in a software module running on one or more processors, or in a combination thereof. Those skilled in the art will appreciate that a microprocessor or digital signal processor (DSP) may be used in practice to implement some or all of the functionality of some or all of the components of the LTE access network in accordance with embodiments of the present invention. The invention can also be implemented as a device or device program (e.g., a computer program and a computer program product) for performing some or all of the methods described herein. Such a program implementing the invention may be stored on a computer readable medium or may be in the form of one or more signals. Such signals may be downloaded from an Internet website, provided on a carrier signal, or provided in any other form. It is to be noted that the above-described embodiments are illustrative of the invention and are not intended to limit the scope of the invention, and those skilled in the art can devise alternative embodiments without departing from the scope of the appended claims. In the claims, any reference signs placed between parentheses shall not be construed as a limitation. The word "comprising" does not exclude the presence of the elements or the steps in the claims. The word "a" or "an" preceding the <RTIgt; The invention can be implemented by means of hardware comprising several distinct elements and by means of a suitably programmed computer. In the unit claims enumerating several means, several of these means can be embodied by the same hardware item. The use of the words first, second, and third does not indicate any order. These words can be interpreted as names. Industrial Applicability As described above, a data security transmission method and an LTE access network system provided by the embodiments of the present invention have the following beneficial effects: A heavily loaded MeNB can offload part of user data to an LPN for transmission, UE When moving between small cells, the signaling in the handover process can also be reduced, and the message load of the network is reduced. For the UE, the bandwidth widening of the multi-carrier transmission can better meet the demand of the large data volume service, and the distance is better. The near-LPN transmission is also more power efficient, and the system architecture improves the user experience. In addition, in the system architecture of the embodiment of the present invention, the key is transmitted to the LPN through the macro base station in the heterogeneous access network. The transmission on the radio link between the LPN and the UE can implement the configured security protection function, which ensures the security performance of the system architecture.

Claims

The present invention is directed to a heterogeneous network based on a Long Term Evolution (LTE) system, where the heterogeneous network includes: an LTE core network, an LTE access network, and an LTE user equipment, where the LTE access network One or more macro base stations MeNB are deployed, and one or more low power nodes LPN are deployed in the coverage of the MeNB, and the method includes:

When the LTE user equipment accesses the MeNB, the MeNB acquires a base station key from the LTE core network, generates a first access layer key according to the base station key, and passes the same with the LTE user. a control plane interface between the devices, using the first access layer key to encrypt the corresponding control plane information and the user data, and performing integrity protection on the corresponding control plane information, and then sending the information to the LTE user equipment;

Determining, by the MeNB, a traffic offloading policy of the user data of the LTE user equipment, and transmitting, by using a backward link interface with the LPN, a request message for providing the multi-stream transmission service to the LTE user equipment, Control plane information required by the LPN, and a second access layer key; the MeNB receives a request response sent by the LPN, according to the user data received from the LTE core network according to the offload policy Passing a user plane interface with the LTE user equipment, encrypting the corresponding user data by using the first access layer key, and transmitting the data to the LTE user equipment, and using another part of the user data. Transmitting to the LPN through the backward link interface;

The LPN encrypts the corresponding user data by using the second access layer key, and sends the encrypted user data to the LTE user equipment through a user plane interface with the LTE user equipment. The method according to claim 1, wherein the first access layer key comprises: a user plane encryption key for user plane data encryption, and a control plane encryption key for control plane signaling encryption. And/or control plane integrity protection keys for control plane signaling integrity protection. The method of claim 1, wherein the method further comprises:

The LPN receives the measurement result information reported by the LTE user equipment by using the control plane interface with the LTE user equipment, and adjusts the scheduling of the LTE user equipment according to the measurement result information. The method of claim 3, wherein The second access layer key includes: a user plane encryption key used for user plane data encryption, when the user interface is only provided with the user plane interface between the LPN and the LTE user equipment;

When the user interface and the control plane interface are provided between the LPN and the LTE user equipment, the second access layer key includes: a user plane encryption key for user plane data encryption, and is used for controlling Control plane encryption key for face signaling encryption and/or control plane integrity protection key for control plane signaling integrity protection. The method according to claim 1, wherein the first access layer key is the same as or different from the second access layer key;

When the first access layer key is different from the second access layer key, the LTE user equipment needs to support two sets of security algorithms. The method of claim 1, wherein the determining, by the MeNB, the offloading policy of the user data comprises: determining, by the MeNB, the radio bearer as the offloading granularity according to at least the network load and the measurement result information reported by the LTE user equipment A traffic offloading strategy for user data. The method according to claim 6, wherein, when the offloading policy uses the radio bearer as the offloading granularity, the protocol form of the offloading policy includes: setting, on the MeNB and the LPN, respectively, for performing security The protected packet aggregation protocol entity, and each lower layer protocol entity, where the lower layer protocol entities include: a radio link control sublayer, a medium access control sublayer, and a physical layer. The method of claim 1, wherein the method further comprises:

In the process of the multi-stream transmission service, when the key update is required according to the requirements of the operator, the LTE core network, or the LTE access network, the MeNB sends the LPN to the LPN through the backward link interface. Sending a key update indication, where the key update indication carries a new access layer key;

And the MeNB receives a key update response that is sent by the LPN through the backward link interface, and notifies an update of the LTE user equipment key by using a control plane interface with the LTE user equipment. An LTE access network system, where one or more macro base stations MeNB are deployed in the LTE access network, and one or more low power nodes LPN are deployed in the coverage of the MeNB: The MeNB is configured to: when the LTE user equipment accesses the MeNB, acquire a base station key from the LTE core network, generate a first access layer key according to the base station key, and pass the LTE with the LTE a control plane interface between the user equipments, using the first access layer key pair corresponding control surface information And the user data is encrypted, and the corresponding control plane information is integrity-protected and sent to the LTE user equipment; determining a traffic splitting strategy of the user data of the LTE user equipment, and passing the backward chain between the user and the LPN a path interface, sending, to the corresponding LPN, a request message for providing the multi-stream transmission service for the LTE user equipment, control plane information required by the LPN, and a second access layer key; receiving a request response sent by the LPN According to the offloading policy, a part of the user data received from the core network is used to perform corresponding user data by using the first access layer key through a user plane interface with the LTE user equipment. After being encrypted, the LTE user equipment is sent to the LTE user equipment, and another part of the user data is sent to the LPN through the backward link interface;

The LPN is configured to receive a request message that is sent by the MeNB to provide a multi-stream transmission service for the LTE user equipment, and send a request response to the MeNB, and use the second access layer key to the corresponding user. The data is encrypted, and the encrypted user data is sent to the LTE user equipment through a user plane interface with the LTE user equipment. The LTE access network according to claim 9, wherein the first access layer key comprises: a user plane encryption key for user plane data encryption, and a control plane for control plane signaling encryption. Encryption key and/or control plane integrity protection key for control plane signaling integrity protection. The LTE access network according to claim 9, wherein the LPN is further configured to: receive, by using a control plane interface with the LTE user equipment, measurement result information reported by the LTE user equipment, and The scheduling of the LTE user equipment is adjusted according to the measurement result information. The LTE access network according to claim 11, wherein

The second access layer key includes: a user plane encryption key for user plane data encryption when the user interface is only provided with the user plane interface between the LPN and the LTE user equipment;

When the user interface and the control plane interface are provided between the LPN and the LTE user equipment, the second access layer key includes: a user plane encryption key for user plane data encryption, and is used for controlling Control plane encryption key for face signaling encryption and/or control plane integrity protection key for control plane signaling integrity protection. The LTE access network according to claim 9, wherein the first access layer key is the same as or different from the second access layer key;

When the first access layer key is different from the second access layer key, the LTE user equipment needs to support two sets of security algorithms. The LTE access network according to claim 9, wherein the MeNB is further configured to: determine, according to the network load, and the measurement result information reported by the LTE user equipment, the splitting of the user data by using the radio bearer as a split granularity Strategy. The LTE access network according to claim 14, wherein, when the offloading policy uses the radio bearer as the offloading granularity, the protocol form of the offloading policy includes: the MeNB and the LPN are respectively configured to be used for And a lower layer protocol entity, where the lower layer protocol entity includes: a radio link control sublayer, a medium access control sublayer, and a physical layer. The LTE access network according to claim 9, wherein the MeNB is further configured to:

In the process of the multi-stream transmission service, when the key update is required according to the requirements of the operator, the LTE core network, or the LTE access network, the key is sent to the LPN through the backward link interface. And an update indication, where the key update indication carries a new access layer key; receiving a key update response that is forwarded by the LPN through the backward link interface, and passing between the LTE user equipment and the LTE user equipment The control plane interface notifies the update of the LTE user equipment key.