WO2015081784A1

WO2015081784A1 - Method, device, and system for verifying security capability

Info

Publication number: WO2015081784A1
Application number: PCT/CN2014/091258
Authority: WO
Inventors: 吴义壮; 陈璟
Original assignee: 华为技术有限公司
Priority date: 2013-12-02
Filing date: 2014-11-17
Publication date: 2015-06-11
Also published as: CN104683981B; CN104683981A

Abstract

Embodiments of the present invention relate to the field of communications, and disclosed are a method, a device, and a system for verifying a security capability, which solve the problem of insecure information transmission. A specific solution comprises: a user equipment sending a first security capability of the user equipment to a second network device, receiving a second security capability sent by the second network device, and verifying whether the second security capability is consistent with the first security capability. The present invention is used for verifying a security capability.

Description

Method, device and system for verifying security capability

This application claims priority to Chinese Patent Application No. 201310635001.9, entitled "A Method, Apparatus and System for Verifying Security Capabilities", filed on December 2, 2013, the entire contents of which are incorporated by reference. In this application.

Technical field

The present invention relates to the field of communications, and in particular, to a method, device, and system for verifying security capabilities.

Background technique

SGSN (Serving GPRS Support Node) as GPRS (General Packet Radio Service)/TD-SCDMA (Time Division Synchronization Code Division Multiple Access) (WCDMA) (Wideband Code Division Multiple Access) An important component of the core network packet domain equipment, which mainly completes the routing and forwarding of packet data packets, mobility management, session management, logical link management, authentication and encryption, and words. Single generation and output functions.

RNC (Radio Network Controller) is a key network element of 3G (3rd Generation, 3rd Generation Mobile Communication Technology) network. It is an integral part of the access network and is used to provide mobility management, call processing, link management and handover mechanism. In the wireless network system, when the user needs to communicate with the network, first establish RRC with the RNC (Radio Resource). Control, Radio Resource Control Protocol) connection, establishes a connection with the SGSN after establishing an RRC connection with the RNC.

In the process of establishing the connection between the user end and the network side, the message sent by the user end to the RNC and the SGSN may be acquired and tampered by the attacker, and the transmission of the information is not secured.

Summary of the invention

Embodiments of the present invention provide a method, device, and system for verifying security capabilities, relating to the field of communications, capable of verifying whether information transmission is secure, and improving information transmission security.

In order to achieve the above object, embodiments of the present invention adopt the following technical solutions:

In a first aspect, a method of verifying security capabilities includes:

Transmitting, by the user equipment, the first security capability of the user equipment to the second network device;

Receiving, by the user equipment, a second security capability sent by the second network device, where the second security capability is forwarded by the first network device to the user equipment;

The user equipment verifies whether the second security capability is consistent with the first security capability.

In combination with the first aspect, in a first possible implementation manner,

The first network device is a serving network controller SRNC or a network controller RNC, and the second network device is a service supporting node SGSN or a visited location register VLR;

The method further includes:

Transmitting, by the user equipment, the first security capability to the first network device;

Receiving, by the user equipment, a third security capability sent by the first network device;

The user equipment verifies whether the third security capability is consistent with the first security capability.

In conjunction with the first possible implementation of the first aspect, in a second possible implementation, the method further includes:

If the third security capability is consistent with the first security capability, the user equipment turns on security protection according to the integrity protection algorithm of the first network device.

With the second possible implementation of the first aspect, in a third possible implementation, after the user equipment is enabled to perform security protection according to the integrity protection algorithm sent by the first network device, the method further includes:

If the second security capability is inconsistent with the first security capability, the user equipment generates a security establishment complete message and sends the security establishment complete message to the first network device, so as to facilitate the first network. And transmitting, by the device, the first security capability to the second network device according to the security establishment complete message.

In combination with the first aspect, in a fourth possible implementation,

The first network device is an evolved node eNB, and the second network device is a mobility management entity MME;

Transmitting, by the user equipment, the first security energy of the user equipment to the second network device Force, including:

Transmitting, by the user equipment, the first security capability to the third network device, so that the third network device acquires the second security capability, and sends the second security capability to the second network device, The third network device is an SGSN or a VLR.

In conjunction with the fourth possible implementation of the first aspect, in a fifth possible implementation, the method further includes:

If the second security capability is inconsistent with the first security capability, the user equipment sends the first security capability to the first network device and the second network device, so as to facilitate the second The network device and the first network device update the security capabilities according to the first security capability.

With reference to the fifth possible implementation of the first aspect, in a sixth possible implementation, the method further includes:

Receiving, by the user equipment, the first network device or the second network device, if the first security device received by the first network device or the second network device includes a higher priority algorithm The higher priority algorithm is sent and its own algorithm is updated.

In a second aspect, a method of verifying security capabilities includes:

Receiving, by the first network device, the first security capability sent by the user equipment and the second security capability sent by the second network device;

The first network device verifies whether the first security capability is consistent with the second security capability.

In combination with the second aspect, in a first possible implementation manner,

The method further includes:

If the second security capability is consistent with the first security capability, the first network device turns on security protection.

In combination with the first possible implementation of the second aspect, in the second possible implementation In the formula, after the first network device turns on the security protection, the method further includes:

The first network device sends a third security capability to the user equipment, so that the user equipment verifies that the third security capability is consistent with the first security capability, and then turns on security protection.

In combination with the second aspect, in a third possible implementation,

The method further includes:

And if the second security capability is inconsistent with the first security capability, the first network device updates the security capability according to the first security capability.

In conjunction with the third possible implementation of the second aspect, in a fourth possible implementation, the method further includes:

If the first security capability received by the first network device includes a higher priority algorithm, the first network device updates its own algorithm to the higher priority algorithm, and the A higher priority algorithm is sent to the user equipment to facilitate the user equipment update algorithm.

In a third aspect, a method of verifying security capabilities includes:

The mobility management entity MME receives the first security capability sent by the user equipment and the second security capability sent by the service support node SGSN or the visited location register VLR, wherein the first security capability is forwarded by the evolved node eNB to the MME;

The MME verifies whether the first security capability is consistent with the second security capability.

In conjunction with the third aspect, in a first possible implementation, the method further includes:

If the first security capability is inconsistent with the second security capability, the MME updates the security capability according to the first security capability.

In conjunction with the first possible implementation of the third aspect, in a second possible implementation, the method further includes:

If the first security capability received by the MME includes an algorithm with a higher priority, the first network device updates its own algorithm to the higher priority algorithm. And transmitting the higher priority algorithm to the user equipment to facilitate the user equipment update algorithm.

In a fourth aspect, a user equipment includes:

a sending unit, configured to send, to the second network device, the first security capability of the user equipment;

a receiving unit, configured to receive a second security capability sent by the second network device, where the second security capability is forwarded by the first network device to the user equipment;

And a verification unit, configured to verify whether the second security capability is consistent with the first security capability.

In combination with the fourth aspect, in a first possible implementation manner,

The sending unit is further configured to send the first security capability to the first network device;

The receiving unit is further configured to receive a third security capability sent by the first network device;

The verification unit is further configured to verify whether the third security capability is consistent with the first security capability.

In conjunction with the first possible implementation of the fourth aspect, in a second possible implementation manner,

The user equipment further includes a protection unit, configured to enable security protection according to the integrity protection algorithm of the first network device when the third security capability is consistent with the first security capability.

In conjunction with the second possible implementation of the fourth aspect, in a third possible implementation manner,

The verification unit is further configured to generate a security establishment complete message when the second security capability is inconsistent with the first security capability;

The sending unit is further configured to complete the security establishment generated by the verification unit Sending a message to the first network device, so that the first network device sends the first security capability to the second network device according to the security setup complete message.

In conjunction with the fourth aspect, in a fourth possible implementation,

The sending unit is further configured to send the first security capability to the third network device, so that the third network device acquires the second security capability, and sends the second security capability to the a second network device, wherein the third network device is an SGSN or a VLR.

With reference to the fourth possible implementation manner of the fourth aspect, in a fifth possible implementation manner,

The sending unit is further configured to: when the second security capability is inconsistent with the first security capability, send the first security capability to the first network device and the second network device, so as to facilitate The second network device and the first network device update security capabilities according to the first security capability.

With reference to the fifth possible implementation manner of the fourth aspect, in a sixth possible implementation manner,

The receiving unit is further configured to: when the first security device received by the first network device or the second network device includes an algorithm with a higher priority, receive the first network device or the The higher priority algorithm sent by the second network device;

The user equipment further includes a protection unit, configured to update its own algorithm according to the higher priority algorithm received by the receiving unit.

In a fifth aspect, a first network device includes:

a receiving unit, configured to receive a first security capability sent by the user equipment and a second security capability sent by the second network device;

And a verification unit, configured to verify whether the first security capability is consistent with the second security capability.

In combination with the fifth aspect, in the first possible implementation manner,

The first network device is a serving network controller SRNC or a network controller RNC, the second network device is a service supporting node SGSN or a visited location register VLR;

The first network device further includes a protection unit, configured to enable security protection when the second security capability is consistent with the first security capability.

In conjunction with the first possible implementation of the fifth aspect, in a second possible implementation manner,

The first network device further includes a sending unit, configured to send a third security capability to the user equipment, so that the user equipment verifies that the third security capability is consistent with the first security capability, and then turns on security protection. .

In combination with the seventh aspect, in a third possible implementation manner,

The first network device further includes a protection unit, configured to update the security capability according to the first security capability when the second security capability is inconsistent with the first security capability.

In conjunction with the third possible implementation of the seventh aspect, in a fourth possible implementation manner,

The protection unit is further configured to: when the first security capability received by the receiving unit includes an algorithm with a higher priority, update its own algorithm to the higher priority algorithm;

The sending unit is further configured to send the higher priority algorithm to the user equipment, so that the user equipment updates an algorithm.

In a sixth aspect, a mobility management entity MME includes:

a receiving unit, configured to receive a first security capability sent by the user equipment, and a second security capability sent by the service support node SGSN or the visited location register VLR, where the first security capability is forwarded by the evolved node eNB to the MME ;

In combination with the sixth aspect, in a first possible implementation manner,

The MME further includes a protection unit, configured to: when the first security capability and the first When the two security capabilities are inconsistent, the security capability is updated according to the first security capability.

In conjunction with the first possible implementation of the sixth aspect, in a second possible implementation manner,

The MME further includes a sending unit, configured to send the higher priority algorithm to the user equipment, so that the user equipment updates the algorithm.

The method, the device and the system for verifying the security capability provided by the embodiment of the present invention, the user equipment sends the first security capability of the user equipment to the second network device, receives the second security capability sent by the second network device, and verifies the Whether the second security capability is consistent with the first security capability, verifying whether the information transmission is secure and improving the security of information transmission.

DRAWINGS

In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings used in the description of the embodiments will be briefly described below.

1 is a schematic flowchart of a method for verifying security capability according to an embodiment of the present invention;

2 is a schematic diagram of instruction interaction of another method for verifying security capabilities according to an embodiment of the present invention;

FIG. 3 is a schematic diagram of an instruction interaction of another method for verifying security capabilities according to an embodiment of the present invention; FIG.

FIG. 4 is a schematic flowchart of a method for verifying security capability according to another embodiment of the present invention; FIG.

FIG. 5 is a schematic diagram of instruction interaction of another method for verifying security capabilities according to another embodiment of the present invention; FIG.

FIG. 6 is a schematic diagram of another instruction interaction of a method for verifying security capabilities according to another embodiment of the present invention; FIG.

FIG. 7 is a schematic flowchart of a method for verifying security capability according to another embodiment of the present invention; FIG.

FIG. 8 is a schematic diagram of another instruction interaction of a method for verifying security capability according to another embodiment of the present invention; FIG.

FIG. 9 is a schematic structural diagram of a user equipment according to an embodiment of the present invention;

FIG. 10 is a schematic structural diagram of a first network device according to an embodiment of the present invention;

FIG. 11 is a schematic structural diagram of an MME according to an embodiment of the present invention;

FIG. 12 is a schematic structural diagram of a user equipment according to another embodiment of the present invention;

FIG. 13 is a schematic structural diagram of a first network device according to another embodiment of the present invention;

FIG. 14 is a schematic structural diagram of an MME according to another embodiment of the present invention;

FIG. 15 is a schematic structural diagram of a wireless network system according to an embodiment of the present invention;

FIG. 16 is a schematic structural diagram of a wireless network system according to another embodiment of the present invention; FIG.

FIG. 17 is a schematic structural diagram of a wireless network system according to still another embodiment of the present invention.

detailed description

The technical solutions in the embodiments of the present invention are clearly and completely described in the following with reference to the accompanying drawings in the embodiments of the present invention. It is obvious that the described embodiments are only a part of the embodiments of the present invention, but not all embodiments.

A method, device and system for verifying security capabilities provided by embodiments of the present invention can be applied to GSM (Global System of Mobile communication) and GERAN (Enhanced Data Rate for GSM Evolution). Rate GSM evolution) Radio Access Network, GSM/EDGN radio access network system, UMTS (Universal Mobile Telecommunications System), LTE (Long Term Evolution) system, EPS (Evolved Packet System, evolution) Packet system), of course, the present invention can also be applied to other network systems, but in the existing communication field, the above five network systems are widely used. Therefore, the embodiments of the present invention mainly use the five network systems. The detailed description is made, but the present invention is not limited to these five network systems, and the present invention can also be implemented in other network systems.

Referring to FIG. 1, an embodiment of the present invention provides a method for verifying security capabilities, the method comprising the following steps:

101. The user equipment sends the first security capability of the user equipment to the second network device.

The first security capability may include one or more of UMTS security capability, GERAN security capability, GSM security capability, and EPS security capability. When the user equipment accesses the network, the first security capability of the user equipment is first sent to the second network device.

102. The user equipment receives a second security capability sent by the second network device.

Optionally, the second security capability may include one or more of UMTS security capability, GERAN security capability, GSM security capability, and EPS security capability, and specifically includes security capability and security included in the first security capability in step 101. The ability corresponds. It can also be said that the first security capability includes which network security capabilities, and the second security capability also includes which network security capabilities.

103. The user equipment verifies whether the second security capability is consistent with the first security capability.

In order to ensure that the information sent by the user equipment is secure, the user equipment verifies that the second security capability sent by the second network device is consistent with the first security capability of the user equipment, and if it is inconsistent, it represents security. The ability to be tampered with can stop accessing the network. If it is consistent, it means that the security capability has not been tampered with and can access the network. Here, the user equipment verifies whether the transmission of information between itself and the second network device is secure. The first security capability of the user equipment is only the security capability of the security function of the user, and the user equipment may also send the security capability that does not need to be verified to the second network device. Optionally, the security capability of the user equipment includes the security capability. A list of all encryption algorithms and integrity algorithms supported by the user.

In this way, whether the first security capability and the second security capability are consistent by the user equipment reduces the possibility of transmitting data without security, and improves the security of information transmission.

The method for verifying the security capability provided by the embodiment is to verify whether the second security capability sent by the second network device is consistent with the first security capability of the user equipment, and verify whether the information transmission is secure, and the information transmission is improved. .

An embodiment of the present invention provides another method for verifying security capabilities, which is applied to a UMTS system. In a UMTS system, a user equipment may be a user equipment (UE), where the UE includes an MS (Mobile Station). The first network device may be an RNC or an SRNC (Serving Radio Network Controller), and the second network device may be an SGSN or a VLR (Visitor Location Register). SRNC and SGSN are used to describe the technology of the present invention. It does not mean that the technology of the present invention can be implemented only by these devices, and the same effect can be achieved by other devices.

Referring to Figure 2, the method includes:

201. The user equipment sends the first security capability of the user equipment to the second network device.

Optionally, the first security capability includes a list of encryption algorithms supported by the user equipment and a list of integrity algorithms, where the first security capability may be included in an initial L3 (Layer 3, Layer 3) message sent to the second network device. The L3 message may also include the security capability not included in the first security capability, because the first security capability represents the security capability for verification, but the user equipment may choose to use other security features that are temporarily not verified when transmitting. Send it out together. Because the first security capability sent by the user equipment may be tampered with during the process of sending to the second network device, the security capability received by the second network device is referred to as the second security capability. If the first security capability and the second security capability are consistent, it proves that the first security capability has not been tampered with, and the information transmission is secure.

202. The user equipment receives a second security capability sent by the second network device.

The second security capability is forwarded by the first network device to the user equipment. Optionally, the second security capability is sent to the first network device in an SMC (Security Mode Command) message, and is sent by the first network. The device forwards the second security capability to the user equipment in the SMC message.

The second security capability may include one or more of UMTS security capability, GERAN security capability, GSM security capability, and EPS security capability, and specifically includes content corresponding to content included in the first security capability of the user equipment. Here, the SMC message may also include the security capability that is not included in the second security capability, and the second security capability only represents the security capability for performing the verification, but the SMC message may also include the security capability that does not need to be verified temporarily.

203. The user equipment verifies whether the second security capability is consistent with the first security capability.

In steps 201-203, the user equipment verifies whether the information transmission between itself and the second network device is secure.

The method further includes a step 204, and the step 204 has no sequential relationship with the step 201, the step 202, and the step 203, that is, the step 204 can be performed simultaneously with any step of step 201, step 202, and step 203 or at a certain step. Before or after.

204. The user equipment sends the first security capability to the first network device.

Optionally, the first security capability sent to the first network device is sent in an RRC connection setup.

205. The user equipment receives a third security capability sent by the first network device.

Here, the third security capability may include one or more of UMTS security capability, GERAN security capability, GSM security capability, and EPS security capability, specifically including the security capability and the first security capability and the second security capability in the foregoing steps. The content contained corresponds.

Optionally, the third security capability is included in the SMC message and sent to the user equipment.

206. The user equipment verifies whether the third security capability sent by the first network device is consistent with the first security capability of the user equipment.

Through the above steps 204-206, the user equipment verifies whether the information transmission between itself and the first network device is secure.

Optionally, the method further includes step 207, and any step between step 207 and steps 201-206 has no sequential relationship.

207. The first network device receives a priority list of integrity protection algorithms sent by the second network device.

Optionally, the integrity protection algorithm priority list is sent to the first network device in the SMC message, where the SMC message may further include one of an encryption algorithm priority list, an encryption key, and an integrity protection key. Or multiple, so that the first network device encrypts and integrity protects the transmitted data.

208. The first network device according to the received integrity protection algorithm priority list and the first A security capability selects an integrity protection algorithm and turns on security protection based on the selected integrity protection algorithm.

Specifically, in an actual situation, the first network device further receives the encryption algorithm priority list, and selects an encryption algorithm according to the encryption algorithm priority list, and starts security protection according to the selected encryption algorithm and the integrity protection algorithm, and then transmits the data. The first network device encrypts and integrity protects the data by using the selected encryption algorithm and the integrity protection algorithm. When the user equipment receives the data, the same algorithm is used to de-encrypt, and the same algorithm is used to transmit the data. Encryption ensures the security of subsequent data transmission.

209. The first network device sends the selected integrity protection algorithm to the user equipment.

Optionally, the first network device sends the selected integrity protection algorithm to the user equipment in the SMC message, where the SMC message may further include an encryption algorithm selected by the first network device.

For step 206, if the third security capability sent by the first network device is consistent with the first security capability of the user equipment, after step 209, the method further includes:

210. The user equipment turns on security protection according to an integrity protection algorithm.

211. The user equipment generates a security establishment complete message, and sends a security establishment complete message to the first network device.

212. The first network device sends a security setup complete message to the second network device.

Specifically, if the second security capability sent by the second network device is inconsistent with the first security capability of the user equipment, the first network device sends the first security capability to the second network device in the security establishment complete message. So that the second network device updates the security capability according to the first security capability.

Optionally, the security setup complete message may further include an encryption algorithm and an integrity protection algorithm selected by the first network device.

The user equipment verifies whether the first security capability is consistent with the second security capability sent by the second network device, and then verifies whether the third security capability sent by the first network device is consistent with the first security capability of the user equipment. Moreover, if the third security capability sent by the first network device is consistent with the first security capability of the user equipment, the user equipment turns on the security protection to ensure the security of the data transmission after the security protection is turned on, so as to verify the first network. Whether the security capability of the device, the second network device, and the user device itself are consistent, has not been tampered with, and the possibility of transmitting data without security guarantee is reduced, thereby improving the security of information transmission.

An embodiment of the present invention provides a method for verifying security capabilities, which is applied to an LTE system. In an LTE system, the network device includes an SRNC, an eNB (Envolved Node B), an SGSN, and an MME (Mobility Management Entity, The mobility management entity, wherein the eNB is a first network device, the MME is a second network device, and the SGSN is a third network device. Certainly, the present embodiment uses the MME, the eNB, and the SGSN as an example to describe the technology of the present invention, and does not mean that the technology of the present invention can be implemented only by these devices, and the same effect can be achieved by other devices. Specifically, the embodiment of the present invention is applied to the scenario where the user equipment is switched from the UMTS system to the LTE system. Referring to FIG. 3, the method includes:

301. The SRNC sends a relocation request message to the SGSN.

The SRNC sends a Relocation Request message to the SGSN to initiate a system handover.

302. The SGSN sends a relocation request message to the MME.

Because the user equipment security capability has been sent to the SGSN in the access UMTS network, the SGSN can send the second security capability to the MME. The second security capability is included in the relocation request message and sent to the MME. Here, the specific content of the second security capability included in the relocation request message is not limited in the present invention.

With reference to the embodiment corresponding to FIG. 2, steps 301-302 complete the first security capability sent by the user equipment to the second network device, so that the second network device acquires the second security capability. Specifically, the user equipment sends the first security device to the third network device. A security capability, such that the third network device acquires the second security capability and sends the second security capability to the second network device.

303. The MME sends a handover request message to the eNB.

Specifically, after receiving the handover request message, the MME detects whether the handover request message includes a second security capability, and when the handover request message includes the second security capability, the MME The second security capability is included in an IE (Information Element) of a NAS (Non Access Stratum) secure transparent container, and the IE of the NAS secure transparent container is included in the handover request and sent to the eNB;

Or, optionally, after receiving the relocation request message, the MME detects whether the first security capability of the relocation request message includes the second security capability, and when the handover request message includes the second security capability, the MME performs the second security. The capability and security capability indications are included in the handover request message sent to the eNB.

Because the user equipment cannot directly communicate with the eNB when the user equipment is not connected to the LTE network, it must be forwarded by the SGSN and the MME to send the security capability to the eNB.

304. The eNB sends a handover confirmation message to the MME.

Specifically, after receiving the second security capability sent by the MME, the eNB creates an RRC connection reconfiguration cell to establish a direct connection with the user equipment, and sends a handover request acknowledgement message to the MME, where the handover request acknowledgement message is compared with step 303. The IE of the NAS secure transparent container may be included, and the IE of the NAS secure transparent container includes the second security capability;

Alternatively, the eNB includes the second security capability in the RRC connection reconfiguration cell according to the security capability indication, and the RRC connection reconfiguration cell is included in the handover request acknowledgement message and sent to the MME.

305. The MME sends a redirect response message to the SGSN.

306. The SGSN sends a redirect command message to the SRNC.

307. The SRNC sends a handover command message to the user equipment.

In steps 305-307, the MME sends a redirect response message to the SGSN, and the SGSN forwards the message to the user equipment, wherein the redirect response message includes the second security capability according to step 303 and step 304.

Referring to the embodiment corresponding to FIG. 2, steps 303-307 complete the second security capability sent by the user equipment by the second network device, and the second security capability is forwarded by the first network device to the user equipment, specifically, the second network device. Transmitting the second security capability to the first network device, the first network device returning the second security capability to the second network device and passing the third The network device sends to the user device.

308. The user equipment verifies whether the second security capability sent by the eNB is consistent with the first security capability of the user equipment.

309. The user equipment sends a handover complete message to the eNB.

If the security capability sent by the eNB is inconsistent with the first security capability of the user equipment, the handover complete message further includes a first security capability, and the eNB may update the security capability and the algorithm according to the first security capability.

310. The eNB sends a handover notification message to the MME.

If the second security capability sent by the eNB is inconsistent with the first security capability of the user equipment, the handover message may further include a first security capability, a security capability and an algorithm that the MME updates according to the first security capability.

Specifically, when the first security capability includes a NAS (Non Access Stratum) algorithm with a higher priority, the MME changes the NAS algorithm, and the NAS algorithm is used to transmit data between the MME and the user equipment. Data is encrypted and integrity protected. At the same time, if the first security capability includes an AS (Access Stratum) algorithm with a higher priority, the eNB also changes the AS algorithm, and the AS algorithm encrypts the data when the user equipment and the eNB transmit data. And integrity protection, correspondingly, also triggers the user device to change its own algorithm.

311. The MME sends a relocation complete message to the SGSN.

Optionally, when the security capability sent by the SGSN is inconsistent with the first security capability of the user equipment, the relocation complete message includes a first security capability, so that the SGSN updates its saved user equipment security capability.

312. The SGSN sends a relocation complete confirmation message to the MME.

The method for verifying the security capability provided by the embodiment is to verify whether the second security capability sent by the second network device is consistent with the first security capability of the user equipment, and whether the information transmission is secure and the information transmission is improved. Safety.

Another embodiment of the present invention provides a method for verifying security capabilities. Referring to FIG. 4, the method includes:

401. The first network device receives a second security capability sent by the second network device.

The second security capability may include one or more of UMTS security capability, GERAN security capability, GSM security capability, and EPS security capability.

402. The first network device receives the first security capability sent by the user equipment.

The user equipment may be a UE, wherein the UE comprises an MS. The first security capability may include one or more of UMTS security capabilities, GERAN security capabilities, GSM security capabilities, and EPS security capabilities.

403. The first network device verifies whether the first security capability is consistent with the second security capability.

The method for verifying the security capability provided by the embodiment is to verify whether the first security capability sent by the user equipment is consistent with the second security capability sent by the second network device by using the first network device, verifying whether the information transmission is secure, and improving information transmission. Security.

Another embodiment of the present invention provides another method for verifying security capabilities, which is applied to a UMTS network. In a UMTS system, a user equipment may be a UE, where the UE includes an MS, and the first network device may be an RNC or an SRNC. The second network device can be an SGSN or a VLR. Certainly, the present embodiment uses the UE, the SRNC, and the SGSN as an example to describe the technology of the present invention, and does not mean that the technology of the present invention can be implemented only by these devices, and the same effect can be achieved by other devices. Referring to Figure 5, the method includes:

501. The user equipment sends the first security capability to the first network device.

Optionally, the first security capability is sent to the first network device in the RRC establishment connection.

In this embodiment, the first security capability includes the UMTS security capability, and may also include one or more of the GERAN security capability, the GSM security capability, and the EPS security capability.

502. The user equipment sends the first security capability to the second network device.

Optionally, the first security capability is included in the initial L3 message sent to the second network device. Because the first security capability sent by the user may be tampered with during the process of sending to the second network device, the security capability received by the second network device is called second. Security capability, if the first security capability and the second security capability are consistent, it proves that the security capability has not been tampered with and the information transmission is secure.

Step 501 and step 502 have no sequential relationship.

503. The first network device receives a second security capability sent by the second network device.

Optionally, the second security capability is sent to the first network device in the SMC message.

504. The first network device verifies whether the first security capability sent by the user equipment is consistent with the second security capability sent by the second network device.

The method further includes step 505, and step 505 has no sequential relationship with any of steps 501-504.

505. The first network device receives a priority list of integrity protection algorithms sent by the second network device.

Optionally, the integrity protection algorithm priority list is sent to the first network device in the SMC message, where the SMC message may further include one of an encryption algorithm priority list, an encryption key, and an integrity protection key. Or multiple, so that the first network device secures the transmitted data.

After the steps 504 and 505, if the first security capability sent by the user equipment is consistent with the second security capability sent by the second network device, the method further includes:

506. The first network device selects an integrity protection algorithm according to the received integrity protection algorithm priority list and the first security capability, and starts security protection according to the selected integrity protection algorithm.

Specifically, the first network device may also receive an encryption algorithm and select an encryption algorithm, and enable encryption protection according to the selected encryption algorithm.

Optionally, the second security capability and integrity protection algorithm priority list sent by the second network device may be included in the SMC message, that is, the steps 503-506 may also be combined into the following three steps:

a. The first network device receives a second security capability and an integrity protection algorithm priority list sent by the second network device.

Optionally, the second security capability and integrity protection algorithm priority list is included in The SMC message is sent to the network controller, where the SMC message may further include one or more of an encryption algorithm priority list, an encryption key, and an integrity protection key, so that the first network device secures the transmitted data. protection.

The first network device verifies whether the first security capability sent by the user equipment is consistent with the second security capability sent by the second network device.

If the first security capability sent by the user equipment is consistent with the second security capability sent by the second network device, the method further includes:

c. The first network device selects an integrity protection algorithm according to the received integrity protection algorithm priority list and the first security capability, and starts security protection according to the selected integrity protection algorithm.

507. The first network device sends the third security capability to the user equipment.

508. The user equipment verifies whether the third security capability sent by the first network device is consistent with the first security capability of the user equipment.

If the third security capability sent is consistent with the first security capability of the user equipment, the method further includes:

509. The first network device sends the selected integrity protection algorithm to the user equipment.

Optionally, the first network device sends the selected encryption algorithm and the integrity protection algorithm to the user equipment in the SMC message.

510. The user equipment turns on security protection according to an integrity protection algorithm sent by the first network device.

Optionally, if the user equipment receives the encryption algorithm, the security protection is started according to the encryption algorithm and the integrity protection algorithm.

511. The user equipment generates a security establishment complete message, and sends a security establishment complete message to the first network device.

512. The first network device sends a security setup complete message to the second network device.

If the second security capability sent by the second network device is inconsistent with the first security capability sent by the user equipment, the first network device sends the first security capability to the second network device in the security establishment complete message, so as to facilitate the second Network device update security capabilities.

The first network device verifies whether the first security capability sent by the user equipment is consistent with the second security capability sent by the second network device, and then sends the third security capability to the user equipment, so that the user equipment verifies the first device from the first network device. The three security capabilities are consistent with the first security capability of the user equipment. Moreover, if the first network device verifies that the first security capability sent by the user equipment is consistent with the second security capability sent by the second network device, the first network device turns on the security protection to ensure the security of the user equipment after the first network device is verified. When the capability is sent to the user equipment, it will not be tampered with. This can verify whether the security capabilities of the first network device, the second network device, and the user device are consistent, whether they have been tampered with, and the security is not reduced. The possibility of transmitting data, thereby improving the security of information transmission.

Another embodiment of the present invention provides a method for verifying security capabilities, which is applied to an LTE system. Specifically, in the LTE system of this embodiment, the network device includes an SRNC, an eNB, an SGSN, and an MME, where the eNB For the first network device, the MME is the second network device, and the SGSN is the third network device. Certainly, the present embodiment uses the MME, the eNB, and the SGSN as an example to describe the technology of the present invention, and does not mean that the technology of the present invention can be implemented only by these devices, and the same effect can be achieved by other devices.

For example, the user equipment is switched from the UMTS system to the LTE system. Referring to FIG. 6, the method includes:

601. The SRNC sends a relocation request message to the SGSN.

602. The SGSN sends a relocation request message to the MME.

Because the user equipment security capability has been sent to the SGSN in the access UMTS network, the SGSN can send the second security capability to the MME. Among them, the second security The capability is included in the relocation request message and sent to the MME. Here, the specific content of the second security capability included in the relocation request message is not limited in the present invention.

603. The MME sends a handover request message to the eNB.

Referring to the embodiment corresponding to FIG. 5, steps 601-603 complete the second network device receiving the second security capability sent by the second network device. Specifically, the user equipment sends the first security capability to the third network device, the third network device acquires the second security capability, and sends the second security capability to the second network device, where the second network device sends the second security capability. To the first network device.

604. The eNB sends a handover confirmation message to the MME.

605. The MME sends a redirect response message to the SGSN.

606. The SGSN sends a redirect command message to the SRNC.

607. The SRNC sends a handover command message to the user equipment.

608. The user equipment sends a handover complete message to the eNB.

Here, the handover complete message includes the first security capability.

Step 608 completes that the first network device receives the first security capability sent by the user equipment.

609. The eNB verifies whether the second security capability is consistent with the first security capability.

If the first security capability is consistent with the second security capability, the handover is continued. If the first security capability is inconsistent with the second security capability, when the first security capability includes a higher priority AS algorithm, the eNB changes the AS algorithm. In the first security capability, the AS algorithm with high priority is selected. The AS algorithm is used to encrypt data when the user equipment transmits data with the eNB, and also triggers the user equipment update algorithm.

610. The eNB sends a handover notification message to the MME.

Here, the handover notification message includes a first security capability. Specifically, when the first security capability includes a higher-level NAS algorithm, the MME changes the NAS algorithm, and selects a NAS algorithm with a high priority among the first security capabilities, and the NAS algorithm is used to transmit between the MME and the user equipment. Data is encrypted while the user device update algorithm is also triggered.

611. The MME sends a relocation complete message to the SGSN.

Optionally, when the second security capability from the SGSN is inconsistent with the first security capability of the user equipment, the relocation complete message includes a first security capability, so that the SGSN updates its saved user equipment security capability.

612. The SGSN sends a relocation complete confirmation message to the MME.

A further embodiment of the present invention provides a method for verifying security capabilities, which is applied to an LTE system. Optionally, in an LTE system, the network device includes an eNB, an SGSN/VLR, and an MME. Here, the MME is used in this embodiment. The eNB and the SGSN/VLR are used as an example to describe the technology of the present invention. It does not mean that the technology of the present invention can be implemented only by these devices, and the same effect can be achieved by other devices. Referring to FIG. 7, the method includes:

701. The MME receives a second security capability sent by the SGSN or the VLR.

702. The MME receives the first security capability sent by the user equipment.

The first security capability is forwarded by the eNB to the MME, and the second security capability may include one or more of UMTS security capability, GERAN security capability, GSM security capability, and EPS security capability.

703. The MME verifies whether the first security capability is consistent with the second security capability.

In this way, it is verified by the MME whether the first security capability and the second security capability are consistent, which reduces the possibility of transmitting data without security guarantee, and improves the security of information transmission.

The method for verifying the security capability provided by the embodiment is to verify whether the first security capability sent by the user equipment is consistent with the second security capability sent by the SGSN or the VLR, and verify whether the information transmission is secure and improve the security of information transmission.

A further embodiment of the present invention provides another method for verifying security capabilities, which is applied to an LTE system. Specifically, in an LTE system, the network device includes an SRNC, an eNB, an SGSN, and an MME. Of course, here, the MME, the eNB, the SRNC, and the SGSN are used in this embodiment. The technology of the present invention is described as an example, and does not mean that the technology of the present invention can be realized only by these devices, and the same effect can be achieved by other devices.

For example, as shown in FIG. 8 , the user equipment is switched from the UMTS system to the LTE system, and the method includes:

801. The SRNC sends a relocation request message to the SGSN.

The SRNC sends a Relocation Request message to the SGSN to initiate a cross-system handover.

802. The SGSN sends a relocation request message to the MME.

Because the user equipment security capability has been sent to the SGSN in the access UMTS network, the SGSN can send the second security capability to the MME. The second security capability is sent to the MME in the relocation request message, that is, the MME receives the second security capability sent by the SGSN or the VLR, where the specific content of the second security capability included in the relocation request message is not Make restrictions.

803. The MME sends a handover request message to the eNB.

804. The eNB sends a handover confirmation message to the MME.

805. The MME sends a redirect response message to the SGSN.

806. The SGSN sends a redirect command message to the SRNC.

807. The SRNC sends a handover command message to the user equipment.

808. The user equipment sends a handover complete message to the eNB.

Here, the handover complete message includes the first security capability.

809. The eNB sends a handover notification message to the MME.

Here, the handover notification message includes a first security capability. That is, the MME receives the first security capability sent by the user equipment.

810. The MME verifies whether the second security capability is consistent with the first security capability.

Specifically, if the first security capability is consistent with the second security capability, the handover is continued. If the first security capability is inconsistent with the second security capability, the MME updates the security capability, and when the first security capability includes a higher priority. In the NAS algorithm, the MME will change the NAS algorithm. The NAS algorithm is used to encrypt and protect the data when transmitting data between the MME and the user equipment, and trigger the user equipment change algorithm. At the same time, the MME sends an S1 context modification request containing the correct security capability to the eNB, if the security capability The AS algorithm is included in the higher priority AS, and the eNB also changes the AS algorithm. The AS algorithm is used to encrypt and protect data when transmitting data between the user equipment and the eNB.

811. The MME sends a relocation complete message to the SGSN.

Optionally, when the first security capability sent by the user is inconsistent with the second security capability of the second network device, the relocation complete message includes the first security capability, so that the SGSN updates the user device security capability saved by itself.

812. The SGSN sends a relocation complete confirmation message to the MME.

The embodiment of the present invention provides a user equipment for performing the method performed by the user equipment described in the embodiment corresponding to FIG. 1, FIG. 2 or FIG. 3, the structure of which is shown in FIG. The transmitting unit 901, the receiving unit 902, and the verifying unit 903.

The sending unit 901 is configured to send the first security capability of the user equipment 90 to the second network device.

The receiving unit 902 is configured to receive a second security capability sent by the second network device, where the second security capability is forwarded by the first network device to the user device 90.

The verification unit 903 is configured to verify whether the second security capability is consistent with the first security capability.

The user equipment provided in this embodiment verifies whether the information transmission is secure and improves the security of information transmission by verifying whether the second security capability sent by the second network device is consistent with the first security capability of the user equipment.

Optionally, in an application scenario, the first network device is a serving network controller SRNC or a network controller RNC, and the second network device is a service supporting node SGSN or a visited location register VLR. then:

The sending unit 901 is further configured to send the first security capability to the first network device.

The receiving unit 902 is further configured to receive a third security capability sent by the first network device.

The verification unit 903 is further configured to verify whether the third security capability and the first security capability are one To.

Optionally, the user equipment 90 may further include a protection unit 904.

The protection unit 904 is configured to enable security protection according to an integrity protection algorithm of the first network device when the third security capability is consistent with the first security capability.

Further, the verification unit 903 is further configured to generate a security establishment complete message when the second security capability is inconsistent with the first security capability.

The sending unit 901 is further configured to send the security setup complete message generated by the verification unit 903 to the first network device, so that the first network device sends the first security capability to the second network device according to the security setup complete message.

Optionally, in another application scenario, the first network device is an evolved node eNB, and the second network device is a mobility management entity MME. then:

The sending unit 901 is further configured to send the first security capability to the third network device, so that the third network device acquires the second security capability, and sends the second security capability to the second network device, where the third network device For SGSN or VLR.

Optionally, the sending unit 901 is further configured to: when the second security capability is inconsistent with the first security capability, send the first security capability to the first network device and the second network device, so as to facilitate the second network device and the first The network device updates the security capabilities according to the first security capability.

Optionally, the receiving unit 902 is further configured to: when the first security device received by the first network device or the second network device includes a higher priority algorithm, receive the priority sent by the first network device or the second network device Higher level algorithm.

The protection unit 904 is configured to update its own algorithm according to a higher priority algorithm received by the receiving unit 902.

In this embodiment, the user equipment verifies whether the first security capability is consistent with the second security capability sent by the second network device, and then verifies whether the third security capability sent by the first network device is consistent with the first security capability of the user equipment. Moreover, if the third security capability sent by the first network device is consistent with the first security capability of the user equipment, the user equipment turns on the security protection to ensure the security of the data transmission after the security protection is turned on, so as to verify the first network device, Whether the security capability of the second network device and the user equipment itself are consistent, has not been tampered with, and reduces the transmission of data without security guarantees. It is possible to improve the security of information transmission.

The user equipment provided in this embodiment verifies whether the information transmission is secure by verifying whether the second security capability sent by the second network device is consistent with the first security capability of the user equipment, and improves the security of information transmission.

An embodiment of the present invention provides a first network device, where the method performed by the first network device described in the embodiment corresponding to FIG. 4, FIG. 5 or FIG. 6 is performed, and the structure thereof is as shown in FIG. A network device 100 includes a receiving unit 1001 and a verification unit 1002.

The receiving unit 1001 is configured to receive a first security capability sent by the user equipment and a second security capability sent by the second network device.

The verification unit 1002 is configured to verify whether the first security capability is consistent with the second security capability.

The first network device provided in this embodiment verifies whether the information transmission is secure and improves the security of information transmission by verifying whether the first security capability sent by the user equipment is consistent with the second security capability sent by the second network device.

Optionally, in an application scenario, the first network device 100 is a serving network controller SRNC or a network controller RNC, and the second network device is a service supporting node SGSN or a visited location register VLR. then:

The first network device 100 further includes a protection unit 1003 and a transmitting unit 1004.

The protection unit 1003 is configured to enable security protection when the second security capability is consistent with the first security capability.

The sending unit 1004 is configured to send the third security capability to the user equipment, so that the user equipment verifies that the third security capability is consistent with the first security capability, and then turns on the security protection.

Optionally, in another application scenario, the first network device is an evolved node eNB, and the second network device is a mobility management entity MME, where:

The protection unit 1003 is configured to update the security capability according to the first security capability when the second security capability is inconsistent with the first security capability.

Further optionally, the protection unit 1003 is further configured to: when the first security capability received by the receiving unit 1001 includes a higher priority algorithm, update the algorithm to be prioritized. Higher level algorithm.

The sending unit 1004 is further configured to send a higher priority algorithm to the user equipment, so that the user equipment updates the algorithm.

In this way, whether the first security capability and the second security capability are consistent by the first network device reduces the possibility of transmitting data without security guarantee, and improves the security of information transmission.

The first network device verifies whether the first security capability sent by the user equipment is consistent with the second security capability sent by the second network device, and then sends the third security capability of the user equipment to the user equipment, so that the user equipment is verified from the first network. Whether the third security capability of the device is consistent with the first security capability of the user device. Moreover, if the first network device verifies that the first security capability sent by the user equipment is consistent with the second security capability sent by the second network device, the first network device turns on the security protection to ensure the security of the user equipment after the first network device is verified. When the capability is sent to the user equipment, it will not be tampered with. This can verify whether the security capabilities of the user equipment stored by the first network device, the second network device, and the user device are consistent, have not been tampered with, and have no security. In the case of the possibility of transmitting data, thereby improving the security of information transmission.

An embodiment of the present invention provides a mobility management entity MME, which is configured to perform the method performed by the MME described in the embodiment corresponding to FIG. 7 or FIG. 8. Referring to FIG. 11, the MME 110 includes a receiving unit 1101 and a verification unit 1102. .

The receiving unit 1101 is configured to receive the first security capability sent by the user equipment and the second security capability sent by the service support node SGSN or the visited location register VLR, where the first security capability is forwarded by the evolved node eNB to the MME.

The verification unit 1102 is configured to verify whether the first security capability is consistent with the second security capability.

In this way, it is verified by the MME whether the first security capability and the second security capability are consistent, which reduces the possibility of transmitting data without security guarantee, and improves information transmission. Safety.

The MME provided in this embodiment verifies whether the information transmission is secure and improves the security of information transmission by verifying whether the first security capability sent by the user equipment is consistent with the second security capability sent by the second network device.

Optionally, the MME 110 further includes a protection unit 1103 and a sending unit 1104.

The protection unit 1103 is configured to update the security capability according to the first security capability when the first security capability is inconsistent with the second security capability.

Further, the protection unit 1103 is further configured to: when the first security capability received by the receiving unit includes a higher priority algorithm, update the algorithm to a higher priority algorithm.

The sending unit 1104 is further configured to send a higher priority algorithm to the user equipment, so that the user equipment updates the algorithm.

The MME provided in this embodiment verifies whether the information transmission is secure and improves the security of information transmission by verifying whether the first security capability sent by the user equipment is consistent with the second security capability sent by the SGSN or the VLR.

Another embodiment of the present invention provides a user equipment for performing the method performed by the user equipment described in the embodiment corresponding to FIG. 1, FIG. 2 or FIG. 3. Referring to FIG. 12, the device may be embedded or itself. Is a micro-processing computer, such as a general-purpose computer, a custom machine, a mobile phone terminal or a tablet device, the user device 1201 includes: at least one processor 1211, a memory 1212 and a bus 1213, the at least one processor 1211 and the memory 1212 Connections to each other are completed via bus 1213.

The bus 1213 may be an ISA (Industry Standard Architecture) bus, a PCI (Peripheral Component) bus, or an EISA (Extended Industry Standard Architecture) bus. The bus 1213 can be divided into an address bus, a data bus, a control bus, and the like. For ease of representation, only one thick line is shown in Figure 12, but it does not mean that there is only one bus or one type of bus. among them:

The memory 1212 is for executing application code of the inventive scheme, and the application code for executing the inventive scheme is stored in a memory and controlled by the processor 1211 for execution.

The memory can be a read only memory ROM or other type of static storage device that can store static information and instructions, a random access memory RAM or other type of dynamic storage device that can store information and instructions, or can be electrically erasable or programmable. Read-only memory EEPROM, CD-ROM or other optical disc storage, optical disc storage (including compact discs, laser discs, optical discs, digital versatile discs, Blu-ray discs, etc.), disk storage media or other magnetic storage devices, or can be used for Any other medium that carries or stores the desired program code in the form of an instruction or data structure and that can be accessed by a computer, but is not limited thereto. These memories are connected to the processor via a bus.

The processor 1211 may be a central processing unit (CPU), or an application specific integrated circuit (ASIC), or one or more configured to implement the embodiments of the present invention. Integrated circuits.

The processor 1211 is configured to call the program code in the memory 1212. In a possible implementation manner, when the application program is executed by the processor 1211, the following functions are implemented.

The processor 1211 is configured to send the first security capability of the user equipment to the second network device.

The processor 1211 is further configured to receive a second security capability sent by the second network device, where the second security capability is forwarded by the first network device to the user equipment.

The processor 1211 is further configured to verify whether the second security capability is consistent with the first security capability.

The processor 1211 is further configured to send the first security capability to the first network device.

The processor 1211 is further configured to receive a third security capability sent by the first network device.

The processor 1211 is further configured to verify whether the third security capability is consistent with the first security capability.

Optionally, the processor 1211 is further configured to: when the third security capability is consistent with the first security capability, enable security protection according to the integrity protection algorithm of the first network device.

Further, the processor 1211 is further configured to generate a security establishment complete message when the second security capability is inconsistent with the first security capability.

The processor 1211 is further configured to send a security setup complete message to the first network device, so that the first network device sends the first security capability to the second network device according to the security setup complete message.

The processor 1211 is further configured to send the first security capability to the third network device, so that the third network device acquires the second security capability, and sends the second security capability to the second network device, where the third network device For SGSN or VLR.

Optionally, the processor 1211 is further configured to: when the second security capability is inconsistent with the first security capability, send the first security capability to the first network device and the second network device, so as to facilitate the second network device and the first The network device updates the security capabilities according to the first security capability.

Optionally, the processor 1211 is further configured to: when the first security device received by the first network device or the second network device includes a higher priority algorithm, receive the priority sent by the first network device or the second network device Higher level algorithms and update their own algorithms.

The user equipment verifies whether the first security capability is consistent with the second security capability sent by the second network device, and then verifies whether the third security capability sent by the first network device is consistent with the first security capability of the user equipment. Moreover, if the third security capability sent by the first network device is consistent with the first security capability of the user equipment, the user equipment turns on the security protection to ensure the security of the data transmission after the security protection is turned on, so as to verify the first network device, Whether the security capability stored by the second network device and the user equipment itself is consistent, has been tampered with, and the possibility of transmitting data without security guarantee is reduced, thereby improving the security of information transmission.

The user equipment provided in this embodiment is configured to verify the second security sent by the second network device. Whether the full capability is consistent with the first security capability of the user equipment, verifying that the information transmission is secure, and improving the security of information transmission.

Another embodiment of the present invention provides a first network device, for performing the method performed by the first network device described in the embodiment corresponding to FIG. 4, FIG. 5 or FIG. 6, referring to FIG. The first network device 1301 may include: at least one processor 1311, a memory 1312, and a bus 1313, at least one of which may be embedded or itself a microprocessor computer, such as a general purpose computer, a custom machine, a mobile phone terminal, or a tablet computer. The processor 1311 and the memory 1312 are connected by a bus 1313 and complete communication with each other.

The bus 1313 may be an ISA (Industry Standard Architecture) bus, a PCI (Peripheral Component) bus, or an EISA (Extended Industry Standard Architecture) bus. The bus 1313 can be divided into an address bus, a data bus, a control bus, and the like. For ease of representation, only one thick line is shown in FIG. 13, but it does not mean that there is only one bus or one type of bus. among them:

The memory 1313 is for executing the application code of the inventive scheme, and the application code for executing the inventive scheme is stored in the memory and controlled by the processor 1311 for execution.

The processor 1311 may be a central processing unit (CPU), or an application specific integrated circuit (ASIC), or one or more configured to implement the embodiments of the present invention. Integrated circuits.

The processor 1311 is configured to call the program code in the memory 1313. In a possible implementation manner, when the application program is executed by the processor 1311, the following functions are implemented.

The processor 1311 is configured to receive a first security capability sent by the user equipment and a second security capability sent by the second network device.

The processor 1311 is further configured to verify whether the first security capability is consistent with the second security capability.

The processor 1311 is further configured to enable security protection when the second security capability is consistent with the first security capability.

The processor 1311 is further configured to send the third security capability to the user equipment, so that the user equipment verifies that the third security capability is consistent with the first security capability, and then turns on the security protection.

The processor 1311 is further configured to: when the second security capability is inconsistent with the first security capability, update the security capability according to the first security capability.

Further, the processor 1311 is further configured to: when the received first security capability includes a higher priority algorithm, update the algorithm to a higher priority algorithm.

The processor 1311 is further configured to send a higher priority algorithm to the user equipment, so that the user equipment updates the algorithm.

The first network device verifies whether the first security capability sent by the user equipment is consistent with the second security capability sent by the second network device, and then sends the third security capability to the user equipment, so that the user equipment verifies the first device from the first network device. The three security capabilities are consistent with the first security capability of the user equipment. Moreover, if the first network device authenticates the user device The first security capability sent by the second network device is consistent with the second security capability sent by the second network device, and the first network device is enabled to ensure that the security capability of the user equipment after the first network device is verified is not tampering when being sent to the user equipment. In this way, it can be verified whether the security capabilities of the first network device, the second network device and the user device are consistent, whether or not it has been tampered with, thereby reducing the possibility of transmitting data without security guarantee, thereby improving information transmission. Security.

Another embodiment of the present invention provides a mobility management entity MME for performing the method performed by the MME described in the embodiment corresponding to FIG. 7 or FIG. 8. Referring to FIG. 14, the device may be embedded or itself Processing a computer, such as a general-purpose computer, a custom machine, a mobile terminal, or a tablet, the MME 1401 includes: at least one processor 1411, a memory 1412, and a bus 1413. The at least one processor 1411 and the memory 1412 are connected by a bus 1413. And complete the communication with each other.

The bus 1413 may be an ISA (Industry Standard Architecture) bus, a PCI (Peripheral Component) bus, or an EISA (Extended Industry Standard Architecture) bus. The bus 1413 can be divided into an address bus, a data bus, a control bus, and the like. For ease of representation, only one thick line is shown in Figure 14, but it does not mean that there is only one bus or one type of bus. among them:

The memory 1414 is used to execute the application code of the inventive scheme, and the application code for executing the inventive scheme is stored in a memory and controlled by the processor 1411 for execution.

The memory can be a read only memory ROM or other type of static storage device that can store static information and instructions, a random access memory RAM or other type of dynamic storage device that can store information and instructions, or can be electrically erasable or programmable. Read-only memory EEPROM, CD-ROM or other optical disc storage, optical disc storage (including compact discs, laser discs, optical discs, digital versatile discs, Blu-ray discs, etc.), disk storage media or other magnetic storage devices, or can be used for Carry or store with instructions or data knots A desired form of program code and any other medium that can be accessed by a computer, but is not limited thereto. These memories are connected to the processor via a bus.

The processor 1411 may be a central processing unit (CPU), or an application specific integrated circuit (ASIC), or one or more configured to implement the embodiments of the present invention. Integrated circuits.

The processor 1411 is configured to call the program code in the memory 1414. In a possible implementation manner, when the application program is executed by the processor 1411, the following functions are implemented.

The processor 1411 is configured to receive the first security capability sent by the user equipment and the second security capability sent by the service support node SGSN or the visited location register VLR, where the first security capability is forwarded by the evolved node eNB to the MME.

The processor 1411 is further configured to verify whether the first security capability is consistent with the second security capability.

Optionally, the processor 1411 is further configured to: when the first security capability is inconsistent with the second security capability, update the security capability according to the first security capability.

Further, the processor 1411 is further configured to: when the first security capability received by the receiving unit includes a higher priority algorithm, update the algorithm to a higher priority algorithm.

The processor 1411 is further configured to send a higher priority algorithm to the user equipment, so that the user equipment updates the algorithm.

The MME provided by the embodiment verifies that the information transmission is verified by verifying whether the first security capability sent by the user equipment is consistent with the second security capability sent by the SGSN or the VLR. No security, improve the security of information transmission.

An embodiment of the present invention provides a wireless network system, the structure of which is shown in FIG. 15. The wireless network system 151 includes: a first network device 1501 and a second network device 1502.

Optionally, the wireless network system 151 may further include: a third network device 1503 and a user equipment 1504.

The user equipment 1504 is the user equipment described in the embodiment corresponding to FIG. 9.

Or the user equipment 1504 is the user equipment described in the embodiment corresponding to FIG. 12.

In the UMTS system, the first network device is an SRNC or an RNC, the second network device is an SGSN or a VLR, and the user equipment is a UE. In this case, the user equipment 1504 can directly communicate with the second network device 1502. In the LTE system, the network device includes an eNB, an SGSN, and an MME, where the eNB is the first network device, the MME is the second network device, and the SGSN is the third network device. At this time, the user equipment 1504 needs to pass the third network device 1503. And the first network device 1501 can communicate with the second network device 1502.

The wireless network system provided by the embodiment is configured to verify whether the second security capability of the user equipment sent by the second network device is consistent with the first security capability of the user equipment of the user equipment, and verify whether the information transmission is secure and the information is improved. The security of the transmission.

Another embodiment of the present invention provides a wireless network system, the structure of which is shown in FIG. 16. The wireless network system 161 includes: a first network device 1601 and a second network device 1602.

The first network device 1601 is the first network device described in the embodiment corresponding to FIG. 10 .

Alternatively, the first network device 1601 is the first network device described in the embodiment corresponding to FIG.

Optionally, the wireless network system 161 may further include: a third network device 1603 and a user equipment 1604.

In the UMTS system, the first network device is an SRNC or an RNC, the second network device is an SGSN or a VLR, and the user equipment is a UE. In this case, the user equipment 1604 can directly communicate with the second network device 1602. In the LTE system, the eNB is the first network device, the MME is the second network device, and the SGSN is the third network device. At this time, the user The device 1604 needs to communicate with the second network device 1602 through the third network device 1603 and the first network device 1601.

The wireless network system provided by the embodiment is configured to verify whether the first security capability of the user equipment sent by the user equipment is consistent with the second security capability of the user equipment sent by the second network device, and verify whether the information transmission is secure. Improve the security of information transmission.

A further embodiment of the present invention provides a wireless network system, the structure of which is shown in FIG. 17, the wireless network system 171 includes: an MME 1701, an SGSN/VLR 1702.

The MME 1701 is the MME described in the embodiment corresponding to FIG. 11.

Alternatively, the MME 1701 is the MME described in the embodiment corresponding to FIG. 14.

Optionally, the wireless network system 171 may further include: an eNB 1703, and a user equipment 1704.

The wireless network system provided by the embodiment of the present invention verifies whether the first security capability sent by the user equipment is consistent with whether the SGSN or the VLR sends the second security capability, and verifies whether the information transmission is secure, and improves the security of information transmission.

Through the description of the above embodiments, those skilled in the art can clearly understand that the present invention can be implemented in hardware, firmware implementation, or a combination thereof. When implemented in software, the functions described above may be stored in or transmitted as one or more instructions or code on a computer readable medium. Computer readable media includes both computer storage media and communication media including any medium that facilitates transfer of a computer program from one location to another. A storage medium may be any available media that can be accessed by a computer. For example, but not limited to, the computer readable medium may include a RAM (Random Access Memory), a ROM (Read Only Memory), and an EEPROM (Electrically Erasable Programmable Read Only Memory). Read memory), CD-ROM (Compact Disc Read Only Memory) or other optical disk storage, disk storage media or other magnetic storage device, or can be used to carry or store a desired program in the form of an instruction or data structure. Code and any other medium that can be accessed by a computer. Also. Any connection may suitably be a computer readable medium. For example, if the software is making Coaxial cable, fiber optic cable, twisted pair, DSL (Digital Subscriber Line) or wireless technology such as infrared, radio and microwave transmission from a website, server or other remote source, then coaxial cable, Fiber optic cables, twisted pair, DSL, or wireless technologies such as infrared, wireless, and microwaves are included in the fixing of the associated media. As used in the present invention, the disc and the disc include a CD (Compact Disc), a laser disc, a compact disc, a DVD disc (Digital Versatile Disc), a floppy disc, and a Blu-ray disc, wherein the disc is usually magnetically copied, The disc uses a laser to optically replicate the data. Combinations of the above should also be included within the scope of the computer readable media.

The above is only a specific embodiment of the present invention, but the scope of the present invention is not limited thereto, and any person skilled in the art can easily think of changes or substitutions within the technical scope of the present invention. It should be covered by the scope of the present invention. Therefore, the scope of the invention should be determined by the scope of the claims.

Claims

A method for verifying security capabilities, comprising:

Transmitting, by the user equipment, the first security capability of the user equipment to the second network device;

Receiving, by the user equipment, a second security capability sent by the second network device, where the second security capability is forwarded by the first network device to the user equipment;

The user equipment verifies whether the second security capability is consistent with the first security capability.
The method of claim 1 wherein

The first network device is a serving network controller SRNC or a network controller RNC, and the second network device is a service supporting node SGSN or a visited location register VLR;

The method further includes:

Transmitting, by the user equipment, the first security capability to the first network device;

Receiving, by the user equipment, a third security capability sent by the first network device;

The user equipment verifies whether the third security capability is consistent with the first security capability.
The method of claim 2, wherein the method further comprises:

If the third security capability is consistent with the first security capability, the user equipment turns on security protection according to the integrity protection algorithm of the first network device.
The method according to claim 3, wherein after the user equipment turns on the security protection according to the integrity protection algorithm sent by the first network device, the method further includes:

If the second security capability is inconsistent with the first security capability, the user equipment generates a security establishment complete message and sends the security establishment complete message to the first network device, so as to facilitate the first network. And transmitting, by the device, the first security capability to the second network device according to the security establishment complete message.
The method of claim 1 wherein

The first network device is an evolved node eNB, and the second network device is a mobility management entity MME;

The user equipment sends the first security capability of the user equipment to the second network device, including:

Transmitting, by the user equipment, the first security capability to the third network device, so that the third network device acquires the second security capability, and sends the second security capability to the second network device, The third network device is an SGSN or a VLR.
The method of claim 5, wherein the method further comprises:

If the second security capability is inconsistent with the first security capability, the user equipment sends the first security capability to the first network device and the second network device, so as to facilitate the second The network device and the first network device update the security capabilities according to the first security capability.
The method of claim 6 wherein the method further comprises:

Receiving, by the user equipment, the first network device or the second network device, if the first security device received by the first network device or the second network device includes a higher priority algorithm The higher priority algorithm is sent and its own algorithm is updated.
A method for verifying security capabilities, comprising:

Receiving, by the first network device, the first security capability sent by the user equipment and the second security capability sent by the second network device;

The first network device verifies whether the first security capability is consistent with the second security capability.
The method of claim 8 wherein:

The first network device is a serving network controller SRNC or a network controller RNC, and the second network device is a service supporting node SGSN or a visited location register VLR;

The method further includes:

If the second security capability is consistent with the first security capability, the first network device turns on security protection.
The method of claim 9 wherein said first network is After the security is turned on, it also includes:

The first network device sends a third security capability to the user equipment, so that the user equipment verifies that the third security capability is consistent with the first security capability, and then turns on security protection.
The method of claim 8 wherein:

The first network device is an evolved node eNB, and the second network device is a mobility management entity MME;

The method further includes:

And if the second security capability is inconsistent with the first security capability, the first network device updates the security capability according to the first security capability.
The method of claim 11 wherein the method further comprises:

If the first security capability received by the first network device includes a higher priority algorithm, the first network device updates its own algorithm to the higher priority algorithm, and the A higher priority algorithm is sent to the user equipment to facilitate the user equipment update algorithm.
A method for verifying security capabilities, comprising:

The mobility management entity MME receives the first security capability sent by the user equipment and the second security capability sent by the service support node SGSN or the visited location register VLR, wherein the first security capability is forwarded by the evolved node eNB to the MME;

The MME verifies whether the first security capability is consistent with the second security capability.
The method of claim 13 wherein the method further comprises:

If the first security capability is inconsistent with the second security capability, the MME updates the security capability according to the first security capability.
The method of claim 14 wherein the method further comprises:

If the first security capability received by the MME includes a higher priority calculation The first network device updates its own algorithm to the higher priority algorithm, and sends the higher priority algorithm to the user equipment, so that the user equipment updates the algorithm.
A user equipment, comprising:

a sending unit, configured to send, to the second network device, the first security capability of the user equipment;

a receiving unit, configured to receive a second security capability sent by the second network device, where the second security capability is forwarded by the first network device to the user equipment;

And a verification unit, configured to verify whether the second security capability is consistent with the first security capability.
The user equipment according to claim 16, wherein

The first network device is a serving network controller SRNC or a network controller RNC, and the second network device is a service supporting node SGSN or a visited location register VLR;

The sending unit is further configured to send the first security capability to the first network device;

The receiving unit is further configured to receive a third security capability sent by the first network device;

The verification unit is further configured to verify whether the third security capability is consistent with the first security capability.
The user equipment according to claim 17, wherein

The user equipment further includes a protection unit, configured to enable security protection according to the integrity protection algorithm of the first network device when the third security capability is consistent with the first security capability.
User equipment according to claim 18, characterized in that

The verification unit is further configured to generate a security establishment complete message when the second security capability is inconsistent with the first security capability;

The sending unit is further configured to send the security setup complete message generated by the verification unit to the first network device, so that the first network device is configured according to the security The all-establishment completion message sends the first security capability to the second network device.
The user equipment according to claim 16, wherein

The first network device is an evolved node eNB, and the second network device is a mobility management entity MME;

The sending unit is specifically configured to send the first security capability to the third network device, so that the third network device acquires the second security capability, and sends the second security capability to the A network device, wherein the third network device is an SGSN or a VLR.
User equipment according to claim 20, characterized in that

The sending unit is further configured to: when the second security capability is inconsistent with the first security capability, send the first security capability to the first network device and the second network device, so as to facilitate The second network device and the first network device update security capabilities according to the first security capability.
A user equipment according to claim 21, wherein

The receiving unit is further configured to: when the first security device received by the first network device or the second network device includes an algorithm with a higher priority, receive the first network device or the The higher priority algorithm sent by the second network device;

The user equipment further includes a protection unit, configured to update its own algorithm according to the higher priority algorithm received by the receiving unit.
A first network device, comprising:

a receiving unit, configured to receive a first security capability sent by the user equipment and a second security capability sent by the second network device;

And a verification unit, configured to verify whether the first security capability is consistent with the second security capability.
The device according to claim 23, characterized in that

The first network device is a serving network controller SRNC or a network controller RNC, and the second network device is a service supporting node SGSN or a visited location register VLR;

The first network device further includes a protection unit, configured to use the second security capability When the first security capability is consistent, the security protection is turned on.
The device according to claim 24, wherein

The first network device further includes a sending unit, configured to send a third security capability to the user equipment, so that the user equipment verifies that the third security capability is consistent with the first security capability, and then turns on security protection. .
The device according to claim 23, wherein

The first network device is an evolved node eNB, and the second network device is a mobility management entity MME;

The first network device further includes a protection unit, configured to update the security capability according to the first security capability when the second security capability is inconsistent with the first security capability.
The device according to claim 26, wherein

The protection unit is further configured to: when the first security capability received by the receiving unit includes an algorithm with a higher priority, update its own algorithm to the higher priority algorithm;

The sending unit is further configured to send the higher priority algorithm to the user equipment, so that the user equipment updates an algorithm.
A mobility management entity MME, comprising:

a receiving unit, configured to receive a first security capability sent by the user equipment, and a second security capability sent by the service support node SGSN or the visited location register VLR, where the first security capability is forwarded by the evolved node eNB to the MME ;

And a verification unit, configured to verify whether the first security capability is consistent with the second security capability.
The device according to claim 28, characterized in that

The MME further includes a protection unit, configured to update the security capability according to the first security capability when the first security capability is inconsistent with the second security capability.
The device according to claim 29, characterized in that

The protection unit is further configured to: when the first security capability received by the receiving unit includes an algorithm with a higher priority, update its own algorithm to the higher priority algorithm;

The MME further includes a sending unit, configured to send the higher priority algorithm to the user equipment, so that the user equipment updates the algorithm.