WO2015106387A1 - Procédé de vérification de clé, station de base, dispositif d'utilisateur, et élément de réseau central - Google Patents

Procédé de vérification de clé, station de base, dispositif d'utilisateur, et élément de réseau central Download PDF

Info

Publication number
WO2015106387A1
WO2015106387A1 PCT/CN2014/070607 CN2014070607W WO2015106387A1 WO 2015106387 A1 WO2015106387 A1 WO 2015106387A1 CN 2014070607 W CN2014070607 W CN 2014070607W WO 2015106387 A1 WO2015106387 A1 WO 2015106387A1
Authority
WO
WIPO (PCT)
Prior art keywords
base station
secondary base
user equipment
key
key derived
Prior art date
Application number
PCT/CN2014/070607
Other languages
English (en)
Chinese (zh)
Inventor
郭轶
戴明增
张宏平
曾清海
蔺波
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to CN201480000891.9A priority Critical patent/CN105027495B/zh
Priority to PCT/CN2014/070607 priority patent/WO2015106387A1/fr
Publication of WO2015106387A1 publication Critical patent/WO2015106387A1/fr

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
    • H04L2209/80—Wireless
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2463/00—Additional details relating to network architectures or network communication protocols for network security covered by H04L63/00
    • H04L2463/061—Additional details relating to network architectures or network communication protocols for network security covered by H04L63/00 applying further key derivation, e.g. deriving traffic keys from a pair-wise master key

Definitions

  • the present invention relates to the field of communications, and in particular, to a method for verifying a key, a base station, a user equipment, and a core network element.
  • the carrier aggregation of the Long Term Evolution (LTE) system can be roughly divided into intra-base station cell aggregation, inter-base station cell aggregation, and the like.
  • the cell aggregation inside the base station is relatively simple because it is controlled by only one evolved base station (eNB).
  • eNB evolved base station
  • the scheme of inter-base station carrier aggregation is, for example, how to enable dual connectivity of different base stations of a non-ideal backhaul line, that is, how the terminals in the connected state transmit data through the resources of the two base stations to improve the throughput of the terminal.
  • the primary base station needs to establish the bearer of the user equipment (User Equipment, UE) to the secondary base station.
  • UE User Equipment
  • the primary base station or the secondary base station cannot know whether the key associated with the secondary base station derived by the UE is correct.
  • the secret key is incorrect, the service between the UE and the secondary base station is interrupted.
  • the embodiment of the present invention provides a method for verifying a key, a base station, a user equipment, and a core network element, which can verify whether the key between the user equipment and the secondary base station is correct, and can avoid the key and the corresponding algorithm.
  • an embodiment of the present invention provides a base station, where the base station includes: a receiving unit, configured to receive verification information sent by a user equipment, where the verification information is that the user equipment passes the preset data
  • the user-derived key and the information obtained by the preset algorithm are protected, and the preset algorithm includes at least one of an encryption algorithm and an integrity protection algorithm;
  • An acquiring unit configured to use, according to the base station, a key, the preset algorithm, and a Determining data and the verification information to obtain target data;
  • a determining unit configured to determine, according to the preset data, the verification information, and the target data, whether the key derived by the user equipment is the same as the key derived by the base station.
  • the base station further includes: a reset unit, configured to: if the user equipment-derived key is different from the base station-derived key, The user equipment re-derives a key or causes the user equipment to delete the base station.
  • the receiving unit is specifically configured to:
  • the preset data includes at least one of the following:
  • a cell identifier under the secondary base station a physical cell identifier under the secondary base station, a temporary wireless network temporary identifier under the secondary base station, a cell identifier under the primary base station, a physical cell identifier under the primary base station, a temporary wireless network temporary identifier under the primary base station, The identification data stored by the secondary base station and the user equipment, the data transmitted by the primary base station or the secondary base station to the user equipment, and specific numbers.
  • the base station is a secondary base station.
  • the embodiment of the present invention provides another base station, where the base station includes: a receiving unit, configured to receive verification information sent by the user equipment, where the verification information is that the user equipment passes the preset data.
  • the user-derived key and the information obtained by the preset algorithm are protected, and the preset algorithm includes an encryption algorithm and an integrity guarantee. At least one of the algorithms;
  • an acquiring unit configured to acquire target data according to the key derived by the secondary base station, the preset algorithm, the preset data, and the verification information;
  • a determining unit configured to determine, according to the preset data, the verification information, and the target data, whether a key derived by the user equipment is the same as a key derived by the secondary base station, and a determination result is obtained;
  • a sending unit configured to send the determination result to the secondary base station.
  • the base station further includes: a reset unit, configured to: if the key derived by the user equipment is different from the derived key of the secondary base station, And causing the user equipment to delete the secondary base station or cause the user equipment to re-derived a key.
  • the receiving unit is specifically configured to:
  • the preset data includes at least one of the following:
  • a cell identifier under the secondary base station a physical cell identifier under the secondary base station, a temporary wireless network temporary identifier under the secondary base station, a cell identifier under the primary base station, a physical cell identifier under the primary base station, a temporary wireless network temporary identifier under the primary base station, The identification data stored by the secondary base station and the user equipment, the data transmitted by the primary base station or the secondary base station to the user equipment, and specific numbers.
  • an embodiment of the present invention provides a user equipment, where the user equipment includes:
  • a decryption unit configured to decrypt the received downlink data according to the key derived by the user equipment and a preset algorithm
  • a determining unit configured to determine, according to the decrypted data, whether the key derived by the user equipment is the same as the key derived by the secondary base station, including:
  • the Internet Protocol address and/or the port number cannot be identified, it is determined that the key derived by the user equipment is different from the key derived by the secondary base station;
  • a sending unit configured to send the determination result to the secondary base station.
  • the user equipment further includes:
  • a notification unit configured to notify the primary base station to delete the secondary base station if the key derived by the user equipment is different from the key derived by the secondary base station, or notify the primary base station to re-add the secondary base station; or And the primary base station notifies the secondary base station to re-trigger the reconfiguration process; or the primary base station notifies the secondary base station to delete the secondary base station.
  • an embodiment of the present invention provides a core network element, where the core network element includes:
  • a receiving unit configured to receive data that is decrypted by the secondary base station according to the key derived by the secondary base station and the uplink data sent by the user equipment by using a preset algorithm
  • a determining unit configured to determine, according to the decrypted data, whether the key derived by the user equipment is the same as the key derived by the secondary base station, including:
  • the Internet Protocol address and/or the port number cannot be identified, it is determined that the key derived by the user equipment is different from the key derived by the secondary base station;
  • a sending unit configured to send a result of the determining to the secondary base station.
  • the core network element further includes:
  • the notification unit configured to notify the primary base station to delete the secondary base station if the key derived by the user equipment is different from the key derived by the secondary base station, or notify the primary base station to re-add the secondary base station; or And the primary base station notifies the secondary base station to re-trigger the reconfiguration process; or the primary base station notifies the secondary base station to delete the secondary base station.
  • the notification unit is specifically configured to:
  • an embodiment of the present invention provides a method for verifying a key, where the method includes:
  • the secondary base station receives the verification information sent by the user equipment, where the verification information is obtained by the user equipment, and the preset data is protected by a key derived by the user equipment and a preset algorithm, where the preset algorithm is used. Include at least one of an encryption algorithm and an integrity protection algorithm;
  • the secondary base station acquires target data according to the key derived by the secondary base station, the preset algorithm, the preset data, and the verification information;
  • the secondary base station determines, according to the preset data, the verification information, and the target data, whether the key derived by the user equipment is the same as the key derived by the secondary base station.
  • the method further includes: if the user equipment-derived key is different from the secondary base station-derived key, re-derive the user equipment The key or the user equipment is deleted from the secondary base station.
  • the verification information sent by the receiving user equipment includes:
  • the aggregation protocol data carries the verification information.
  • the preset data includes at least one of the following:
  • a cell identifier under the secondary base station a physical cell identifier under the secondary base station, a temporary wireless network temporary identifier under the secondary base station, a cell identifier under the primary base station, a physical cell identifier under the primary base station, a temporary wireless network temporary identifier under the primary base station, The identification data stored by the secondary base station and the user equipment, the data transmitted by the primary base station or the secondary base station to the user equipment, and specific numbers.
  • an embodiment of the present invention provides a method for verifying a key, where the method includes:
  • the primary base station receives the verification information sent by the user equipment, where the verification information is information obtained by the user equipment, and the preset data is protected by a key derived by the user equipment and a preset algorithm, and the preset algorithm is used. Include at least one of an encryption algorithm and an integrity protection algorithm;
  • the primary base station acquires target data according to the key derived by the secondary base station, the preset algorithm, the preset data, and the verification information;
  • the primary base station sends the determination result to the secondary base station.
  • the method further includes: if the user equipment-derived key is different from the derived key of the secondary base station, deleting the user equipment The secondary base station or the user equipment is re-derived by a key.
  • the verification information sent by the receiving user equipment includes:
  • the preset data packet Including at least one of the following:
  • a cell identifier under the secondary base station a physical cell identifier under the secondary base station, a temporary wireless network temporary identifier under the secondary base station, a cell identifier under the primary base station, a physical cell identifier under the primary base station, a temporary wireless network temporary identifier under the primary base station, The identification data stored by the secondary base station and the user equipment, the data transmitted by the primary base station or the secondary base station to the user equipment, and specific numbers.
  • an embodiment of the present invention provides a method for verifying a key, where the method includes:
  • the user equipment decrypts the received downlink data according to the key and the preset algorithm derived by the user equipment;
  • the determining, by the user equipment, whether the key derived by the user equipment and the key derived by the secondary base station are the same according to the decrypted data includes:
  • the user equipment acquires an internet protocol address and a port number of the decrypted data packet
  • the Internet Protocol address and/or the port number cannot be identified, it is determined that the key derived by the user equipment is different from the key derived by the secondary base station.
  • the method further includes:
  • an embodiment of the present invention provides a method for verifying a key, where the method includes: Receiving, by the core network element, the data that the secondary base station decrypts the uplink data sent by the user equipment according to the key derived by the secondary base station and the preset algorithm;
  • the network element of the core network determines, according to the decrypted data, whether the key derived by the user equipment is the same as the key derived by the secondary base station, including:
  • the Internet Protocol address and/or the port number cannot be identified, it is determined that the key derived by the user equipment is different from the key derived by the secondary base station.
  • the method further includes: notifying the primary base station to delete the secondary base station ; or
  • the notifying the primary base station to delete the secondary base station or notifying the primary base station to re-add the secondary base station includes:
  • a ninth aspect provides a base station, where the base station includes: a communication interface, a memory, and a processor; the communication interface is configured to communicate with a network element, the memory is configured to store a computer code; and the processor executes the computer The code is used to:
  • the preset algorithm includes at least one of an encryption algorithm and an integrity protection algorithm, where the preset data is protected by a key derived by the user equipment and a preset algorithm.
  • the executing, by the processor, the computer code is further used to:
  • the user equipment-derived key is different from the base station-derived key, the user equipment is re-derived or the user equipment is deleted.
  • the processor executing the computer code is further configured to:
  • the preset data includes at least one of the following:
  • a cell identifier under the secondary base station a physical cell identifier under the secondary base station, a temporary wireless network temporary identifier under the secondary base station, a cell identifier under the primary base station, a physical cell identifier under the primary base station, a temporary wireless network temporary identifier under the primary base station, The identification data stored by the secondary base station and the user equipment, the data transmitted by the primary base station or the secondary base station to the user equipment, and specific numbers.
  • the base station is a secondary base station.
  • a base station includes: a communication interface, a memory, a processor; the communication interface is configured to communicate with a network element, the memory is configured to store computer code; and the processor executes the computer code to:
  • the executing the computer code by the processor is further used to:
  • the user equipment-derived key is different from the derived key of the secondary base station, the user equipment is deleted or the user equipment is re-derived by the user equipment.
  • the executing the computer code by the processor is further used to:
  • the preset data includes at least one of the following:
  • a cell identifier under the secondary base station a physical cell identifier under the secondary base station, a temporary wireless network temporary identifier under the secondary base station, a cell identifier under the primary base station, a physical cell identifier under the primary base station, a temporary wireless network temporary identifier under the primary base station, The identification data stored by the secondary base station and the user equipment, the data transmitted by the primary base station or the secondary base station to the user equipment, and specific numbers.
  • a user equipment includes: Port, memory, processor; the communication interface for communicating with a network element, the memory for storing computer code; the processor executing the computer code for:
  • the determining, according to the decrypted data, whether the key derived by the user equipment is the same as the key derived by the secondary base station includes:
  • the Internet Protocol address and/or the port number cannot be identified, it is determined that the key derived by the user equipment is different from the key derived by the secondary base station.
  • the processor executing the computer code is further configured to:
  • the primary base station if the key derived by the user equipment is different from the key derived by the secondary base station, notify the primary base station to delete the secondary base station; or notify the primary base station to re-add the secondary base station; or notify by the primary base station
  • the secondary base station re-triggers the reconfiguration process; or the primary base station notifies the secondary base station to delete the secondary base station.
  • the twelfth aspect provides a core network element, where the core network element includes: a communication interface, a memory, and a processor; the communication interface is configured to communicate with a network element, and the memory is used to store a computer code; The processor executes the computer code for: receiving data that the secondary base station decrypts the uplink data sent by the user equipment according to the key derived by the secondary base station and a preset algorithm;
  • the determining, according to the decrypted data, the density derived by the user equipment Whether the key is the same as the key derived by the secondary base station including:
  • the Internet Protocol address and/or the port number cannot be identified, it is determined that the key derived by the user equipment is different from the key derived by the secondary base station.
  • the processor executing the computer code is further configured to:
  • the primary base station if the key derived by the user equipment is different from the key derived by the secondary base station, notify the primary base station to delete the secondary base station; or notify the primary base station to re-add the secondary base station; or notify by the primary base station
  • the secondary base station re-triggers the reconfiguration process; or the primary base station notifies the secondary base station to delete the secondary base station.
  • the processor executing the computer code is further configured to:
  • An embodiment of the present invention provides a method for verifying a key, a base station, a user equipment, and a core network element.
  • the user equipment sends check information to the base station, where the check information is known to the user equipment and the base station.
  • the preset data includes at least one of an encryption algorithm and an integrity protection algorithm, and the base station receives the verification information according to the information obtained by the user equipment.
  • the same preset algorithm, the key derived by the secondary base station, and the verification information obtain target data, and determine, according to the preset data, the verification information, and the target data, whether the key derived by the user equipment is the same as the key derived by the base station; or the user equipment
  • the user equipment After establishing the connection with the secondary base station, after receiving the downlink data packet, the user equipment decrypts the downlink data packet by using the key associated with the secondary base station derived by the user equipment and the corresponding security algorithm, and determines whether the data packet obtained after decryption is correct or not.
  • the core network element receives the decrypted data of the uplink data sent by the user equipment according to the base station-derived key and the preset algorithm, and determines the decrypted data. Whether the data packet is correct or not determines whether the key associated with the secondary base station derived by the user equipment is the same as the key derived by the secondary base station. It can verify whether the key between the user equipment and the secondary base station is correct, and can avoid data errors or even service interruption between the user equipment and the secondary base station due to the incorrect key and the corresponding algorithm.
  • FIG. 1 is a schematic structural diagram 1 of a base station according to an embodiment of the present invention
  • FIG. 2 is a schematic flowchart of a derived key of an LTE system
  • FIG. 3 is a schematic structural diagram 2 of a base station according to an embodiment of the present invention
  • FIG. 4 is a schematic structural diagram 1 of another base station according to an embodiment of the present invention
  • FIG. 6 is a schematic structural diagram of a user equipment according to an embodiment of the present invention.
  • FIG. 7 is a schematic structural diagram of a user equipment according to an embodiment of the present invention.
  • FIG. 8 is a schematic diagram of an embodiment of the present invention.
  • FIG. 9 is a schematic structural diagram of a core network element according to an embodiment of the present invention.
  • FIG. 9 is a flowchart diagram of a method for verifying a key according to an embodiment of the present invention.
  • a flow diagram of a method for verifying a key provided by an embodiment of the present invention Intent four;
  • FIG. 14 is a flow chart 5 of a method for verifying a key according to an embodiment of the present invention.
  • 15 is a flow chart 6 of a method for verifying a key according to an embodiment of the present invention.
  • 16 is a flow chart 7 of a method for verifying a key according to an embodiment of the present invention.
  • 17 is a flow chart 8 of a method for verifying a key according to an embodiment of the present invention.
  • FIG. 18 is a schematic structural diagram of still another base station according to an embodiment of the present invention
  • FIG. 19 is a schematic structural diagram of another base station according to an embodiment of the present invention
  • FIG. 20 is another user provided by an embodiment of the present invention
  • FIG. 21 is a schematic structural diagram of another core network element according to an embodiment of the present invention.
  • the embodiment of the present invention provides a base station 20, which can serve as a secondary base station.
  • the secondary base station 20 includes: a receiving unit 21, an obtaining unit 22, and a determining unit 23.
  • the receiving unit 21 is configured to receive the verification information sent by the user equipment, where the verification information is information obtained by the user equipment after the preset data is protected by the user equipment, and the preset algorithm includes the encryption. At least one of an algorithm and an integrity protection algorithm.
  • the preset data may be at least one of the following:
  • the cell identifier under the secondary base station, the physical cell identifier under the secondary base station, and the secondary base station a temporary identifier of the cell radio network, a cell identifier under the primary base station, a physical cell identifier under the primary base station, a temporary identifier of the cell radio network under the primary base station, identification data stored by the secondary base station and the user equipment, and a primary base station or a secondary base station transmitted to the user Device data, specific numbers.
  • KDF Key derivation Functions
  • K is a key stored in the Universal Subscriber Identity Module (USIM) and Authentication Center (AuC). It is a permanent fixed key and is the basis of all key generation algorithms.
  • USIM Universal Subscriber Identity Module
  • AuC Authentication Center
  • CK is a key derived from K for encryption
  • IK is a key derived from K for integrity protection. Both CK and IK are located in the UE and Home Subscriber Server (HSS).
  • HSS Home Subscriber Server
  • K ASME is a key derived from the UE and HS S using CK and IK.
  • the K eNB is derived from K ASME or derived by the UE and the eNB, and is used to derive various keys of the Access Stratum (AS).
  • AS Access Stratum
  • the next hop (NH) is a key obtained by the UE and the Mobility Management Entity (MME) through K ASME ⁇ i, which is a type of eNB key.
  • the K UPenc UE and the eNB are derived by using the K eNB and the encryption algorithm to protect user plane service data;
  • the K UPint is derived by the UE and the eNB through the K eNB and the integrity protection algorithm, and is used to protect user data between the relay node (RN) and the donor base station (Donor eNB, DeNB).
  • Radio Resource Control (RRC) related keys :
  • K RRCint is derived by the UE and the eNB through the KeNB and the integrity protection algorithm. For protecting RRC messages;
  • the K RRC enc is derived by the UE and the eNB through the KeNB and the encryption algorithm, and is used to protect the RRC message.
  • K NA S enc is a key derived by the UE and the MME according to KASME, and is used to protect the non-access stratum (Non-Access-Stratum, NAS) stream using an encryption algorithm.
  • K NA S in t is a key derived by the UE and the MME according to K ASME , and is used to protect the NAS flow using an integrity protection algorithm.
  • the user equipment-derived key associated with the secondary base station may include at least one of the following: KeNB, KuP enc, KuP int. , KRRCint, RRCenc.
  • the user equipment obtains the verification information by using an encryption algorithm and K UPenc to protect the cell identifier under the secondary base station.
  • the receiving unit 21 may be specifically configured to:
  • the verification information may be included in the RRC Connection Reconfiguration Complete message sent by the UE to the primary base station, and the primary base station sends the base station addition complete message to the secondary base station after receiving the verification information.
  • the verification information is carried in the middle.
  • carrying the verification information in the radio resource connection reconfiguration complete message may be implemented by adding security confirmation information (securityConfirmation).
  • securityConfirmation For example, it can be implemented by the following code:
  • the securityConfirmation can be in the form of a byte stream ( OCTET STRING ) or a bit string (BIT STRING (SIZE (xx)).
  • the UE generates a securityConfirmation, which may be an integrity protection result of using a integrity protection algorithm and an integrity protection algorithm for the security Confirmationlnput; or may be an encryption result of using the encryption algorithm and the encryption algorithm of the encryption algorithm for the securityConfirmationlnput; Or a combination of the two.
  • a securityConfirmation which may be an integrity protection result of using a integrity protection algorithm and an integrity protection algorithm for the security Confirmationlnput; or may be an encryption result of using the encryption algorithm and the encryption algorithm of the encryption algorithm for the securityConfirmationlnput; Or a combination of the two.
  • the securityConfirmation is the result of the K UPenc calculation performed by the UE using the force-to-sense algorithm and the secondary base station, and the primary base station sends a base station adding force completion message to the secondary base station through the X2 interface, wherein the base station adds a force completion message.
  • the sub-base 4 owes i'J securityConfirmation.
  • MAC Medium Access Control
  • a new logical channel identifier (LCID) value can be newly introduced to represent securityConfirmation, for example, using 0101 1 , where L is the length of the securityConfirmation, where the securityConfirmation is a fixed length, and there can be no L. Put in securityConfirmation.
  • the current LCID value can also be reused, the securityConfirmation can be added to the existing MAC message or the securityConfirmation can be directly transmitted by the UE as data transmission or through the physical layer.
  • selecting the preset data in securityConfirmation can be implemented by the following code:
  • the UE generates a securityConfirmation, which may be an integrity protection result of the key calculation used by the security protection algorithm and the integrity protection algorithm of the securityConfirmationlnput; or may be the encryption of the security secret algorithm and the key calculation of the force secret algorithm. The result; or a combination of the two.
  • a securityConfirmation which may be an integrity protection result of the key calculation used by the security protection algorithm and the integrity protection algorithm of the securityConfirmationlnput; or may be the encryption of the security secret algorithm and the key calculation of the force secret algorithm. The result; or a combination of the two.
  • securityConfirmation is the result of the UE using the integrity protection algorithm and the derived K UPint or K RRCint calculation related to the secondary base station, and the securityConfirmation is added to the MAC message sent by the UE to the secondary base station, and the secondary base station receives the securityConfirmation.
  • the verification information may also be included in Packet Data Convergence Protocol (PDCP) data sent by the user equipment.
  • PDCP Packet Data Convergence Protocol
  • the verification information may be securityConfirmation
  • the preset data is securityConfirmationlnput
  • the UE generates a securityConfirmation
  • the securityConfirmationlnput uses the force secret algorithm and the result of the encryption calculated by the key of the force secret algorithm; or a combination of the two.
  • selecting the preset data in securityConfirmation can be implemented by the following code:
  • 4 security securityConfirmation is the use of the force secret algorithm and the secondary and secondary
  • the primary base station sends a base station adding force completion message to the secondary base station through the X2 interface, wherein the base station adding force completion message carries securityConfirmation, and the secondary base occupies 4 owing i'J securityConfirmation.
  • the obtaining unit 22 is configured to acquire target data according to a key derived by the base station, a preset algorithm, preset data, and verification information.
  • the verification information is securityConfirmation
  • the preset data is securityConfirmationlnput
  • the verification information is a result of the calculation of the securityConfirmationlnput by the UE using the power secret algorithm and the derived KUPenc related to the secondary base station
  • the securityConfirmation is added to the primary base station.
  • the base station adds the completion message to the secondary base station.
  • the secondary base station decrypts the securityConfirmation according to the encryption algorithm and its own derived K UPen to obtain a new SecurityConfirmationInstance.
  • the verification information is securityConfirmation
  • the preset data is securityConfirmationlnput
  • the verification information is a result of the UE using the integrity protection algorithm and the derived K UPint or K RRCint related to the security base station, and the securityConfirmationlnput, securityConfirmation
  • the secondary base station receives the securityConfirmation and performs integrity protection calculation on the securityConfirmationlnput saved by the integrity protection algorithm and its own derived K UPint or K RRCint to obtain a new securityConfirmation.
  • the verification information is securityConfirmation
  • the preset data is securityConfirmationlnput
  • the verification information is used by the UE.
  • the secret algorithm and the derived K UPenc related to the secondary base station calculate the result of the securityConfirmationlnput
  • the securityConfirmation is added to the PDCP data sent by the UE to the secondary base station, and the secondary base station receives the securityConfirmation and then according to the encryption algorithm and the self-derived K UPenc pair check information. Perform a decryption calculation to get a new SecurityConfirmationlnpu
  • the determining unit 23 is configured to determine, according to the preset data, the verification information, and the target data, whether the key derived by the user equipment is the same as the derived key of the base station.
  • the verification information is securityConfirmation
  • the preset data is securityConfirmationlnput.
  • the verification information is the result of the UE using the integrity protection algorithm and the derived K UPint related to the security base station.
  • the securityConfirmationlnput is the UE and the secondary base station.
  • the cell identification data of a secondary base station is stored.
  • the secondary base station After receiving the securityConfirmation, the secondary base station performs a security protection calculation on the securityConfirmationlnput according to the integrity protection algorithm and its own derived K UPint to obtain a new securityConfirmation, and determines the new securityConfirmation and the received securityConfirmation. are the same, then the same as if a UE-derived "1111 to the secondary base station and the secondary base station itself associated with the derived K UPin S, or not identical.
  • the verification information is securityConfirmation
  • the preset data is securityConfirmationlnput
  • the verification information is a result of the UE using the integrity protection algorithm and the derived K RRCint related to the security base station to calculate the securityConfirmationlnput
  • the securityConfirmationlnput is the UE and
  • the secondary base station stores the cell identification data of a secondary base station. After receiving the securityConfirmation, the secondary base station performs a security protection calculation on the securityConfirmationlnput according to the integrity protection algorithm and its own derived K RRCint to obtain a new securityConfirmation, and judges the new securityConfirmation and the connection.
  • securityConfirmation to L is the same, if the same description of the same UE-derived K RRCint the secondary base station and the secondary base station associated derived K RRCint itself, or not identical.
  • the verification information is securityConfirmation
  • the preset data is securityConfirmationlnput
  • the verification information is that the UE uses the integrity protection algorithm and the derived KUPint related to the secondary base station to protect the securityConfirmationlnput integrity and obtain the intermediate variable securityConfirmationTemp. Then, using the encryption algorithm and the derived K UPenc securityConfirmationTem associated with the secondary base station, j securityConfirmation is obtained.
  • the secondary base station After the secondary base occupies ⁇ L ⁇ j securityConfirmation, the secondary base station first uses the encryption algorithm and its own derived K UPenc to decrypt the securityConfirmation and obtains the i'j securityConfirmationTem, and then uses the integrity protection algorithm and derived for the securityConfirmationlnput stored by itself.
  • K UPint the new integrity protection securityConfirmationTemp obtained, and then determining new securityConfirmationTem ⁇ $]] the decrypted security Confirmation securityConfirmationTemp are the same, the same as if the UE described shellfish 1 J ⁇ [raw sewage associated with secondary base station K UPenc K UPint is the same as K UPenc and K UPint derived from the secondary base station itself, otherwise it is different.
  • the secondary base station 20 further includes:
  • the resetting unit 24 is configured to: if the key derived by the user equipment is different from the derived key of the base station, enable the user equipment to re-derivate the key or delete the base station by the user equipment.
  • the result of the judgment by the judging unit 23 is that after the integrity protection is performed, the i'J new security Confirmation is different from the i iJ security Confirmation, and the UE-derived sub-base station is associated with the 1 ⁇ 1111 and the auxiliary.
  • the base station itself is different from the 1st 1111.
  • the secondary base station can notify the UE to delete the secondary base station or cause the UE to re-derivate the key associated with the secondary base station.
  • the embodiment of the present invention provides a base station, which receives the verification information sent by the user equipment, and the verification information is information obtained by the user equipment after the preset data is protected by the user equipment, and the preset algorithm is used.
  • the method includes: at least one of an encryption algorithm and an integrity protection algorithm; acquiring target data according to a key derived by the base station, a preset algorithm, preset data, and verification information; determining the user equipment according to the preset data, the verification information, and the target data; Whether the derived key is the same as the key derived by the base station. It is possible to check whether the key between the user equipment and the secondary base station is correct, and the service interruption between the user equipment and the secondary base station due to the incorrect key and the corresponding algorithm can be avoided.
  • the embodiment of the present invention further provides a base station 30, which can serve as a primary base station.
  • the primary base station 30 includes: a receiving unit 3 1 , an obtaining unit 32, a determining unit 33, and a transmitting unit 34.
  • the receiving unit 3 1 is configured to receive the verification information sent by the user equipment, where the verification information is information obtained by the user equipment after the preset data is protected by the user equipment, and the preset algorithm includes an encryption algorithm. At least one of integrity protection algorithms.
  • the primary base station receives the radio resource control that is sent by the UE and includes the verification information.
  • the radio resource control message may be an RRC Connection Reconfiguration Complete Message, where the verification information is included.
  • the preset data includes at least one of the following:
  • a cell identifier under the secondary base station a physical cell identifier under the secondary base station, a temporary wireless network temporary identifier under the secondary base station, a cell identifier under the primary base station, a physical cell identifier under the primary base station, a temporary wireless network temporary identifier under the primary base station, The identification data stored by the secondary base station and the user equipment, the data transmitted by the primary base station or the secondary base station to the user equipment, and specific numbers.
  • the obtaining unit 32 is configured to acquire target data according to a key derived by the secondary base station, a preset algorithm, preset data, and check information.
  • the primary base station performs the check received from the receiving unit 31 according to the encryption algorithm and the K UPenc derived from the secondary base station (where K UPenc is obtained by the primary base station using the same key derivation process as the secondary base station).
  • the information is decrypted to obtain the target data.
  • the determining unit 33 is configured to determine, according to the preset data, the verification information, and the target data, whether the key derived by the user equipment and the derived key of the secondary base station are the same, and the judgment result is obtained.
  • the target data is data that the UE protects the preset data by using the user equipment-derived K UPenc and the encryption algorithm
  • the target data is K UPem derived from the primary base station according to the encryption algorithm and the secondary base station ; (K UPem here) ; is obtained from the primary base station uses the same key derivation process and the secondary base station) for data obtained by the decryption to check information received from the receiving unit 31 to the primary base station determines whether the target data with the preset data to get the same result of determination .
  • the sending unit 34 is configured to send the determination result to the secondary base station.
  • the primary base station notifies the secondary base station of the determination result through the X2 interface.
  • the primary base station 30 further includes:
  • the resetting unit 35 is configured to: if the key derived by the user equipment is different from the derived key of the secondary base station, enable the user equipment to delete the secondary base station or re-derivate the key by the user equipment.
  • An embodiment of the present invention provides a base station, which receives verification information sent by a user equipment, where the verification information is a key derived by the user equipment for the preset data by using the user equipment, and is preset.
  • the data, the verification information, and the target data are determined to determine whether the key derived by the user equipment is the same as the key derived by the secondary base station, and the determination result is obtained; and the determination result is sent to the secondary base station. It is possible to check whether the key between the user equipment and the secondary base station is correct, and the service interruption between the user equipment and the secondary base station due to the incorrect key and the corresponding algorithm can be avoided.
  • the embodiment of the present invention further provides a user equipment 40.
  • the user equipment 40 includes: a decryption unit 41, a determination unit 42, and a transmission unit 43.
  • the decrypting unit 41 is configured to decrypt the received downlink data according to a key derived by the user equipment and a preset algorithm.
  • the preset algorithm may be an encryption algorithm, and a connection is established between the UE and the secondary base station, and the UE decrypts the encrypted downlink data received from the network side according to the key and encryption algorithm derived by the UE, and then obtains
  • IP Internet Protocol
  • the determining unit 42 is configured to determine, according to the decrypted data, whether the key derived by the user equipment is the same as the key derived by the secondary base station.
  • the determining unit 42 is configured to:
  • the Internet Protocol address and port number can be identified, it is determined that the key derived by the user equipment is the same as the key derived by the secondary base station; or
  • the Internet Protocol address and/or port number cannot be identified, it is determined that the user equipment derived key is not the same as the secondary base station derived key.
  • the determining unit 42 receives the IP packet from the decryption unit 41, and obtains the IP address and port number of the IP file. If the IP address and the port number can be identified, the IP packet is sent to the corresponding application, and It is also indicated that the UE-derived key associated with the secondary base station and the secondary base-derived related key are the same; or,
  • the IP packet is an error packet and It is indicated that the UE-derived key associated with the secondary base station is different from the associated key derived by the secondary base station.
  • the sending unit 43 is configured to send a determination result to the secondary base station.
  • the UE sends the judgment result obtained by the determining unit 42 to the secondary base station through the primary base station.
  • the user equipment 40 further includes:
  • the notification unit 44 is configured to notify the primary base station to delete the secondary base station if the key derived by the user equipment is different from the key generated by the secondary base station, or notify the primary base station to re-add the secondary base station, or notify the base station of the secondary base station by using the primary base station.
  • the reconfiguration process is re-triggered; or the secondary base station is notified by the primary base station to delete the secondary base station.
  • the user equipment 40 may notify the primary base station that the secondary base station has a problem, and may indicate which bearer of the secondary base station is out.
  • the problem is that the bearer identifier is carried in the indication, the primary base station determines that the secondary base station has a problem, deletes the secondary base station, or causes the primary base station to re-add the secondary base station; or the user equipment 40 can notify the secondary base station to restart the re-trigger by the primary base station.
  • the connection with the UE is configured; or the user equipment 40 notifies the secondary base station to delete the secondary base station by the primary base station.
  • An embodiment of the present invention provides a user equipment, which decrypts received downlink data according to a key derived by the user equipment and a preset algorithm, and determines, according to the decrypted data, a key derived by the user equipment and a key derived by the secondary base station. Whether they are the same; send the judgment result to the secondary base station. It is possible to check whether the key between the user equipment and the secondary base station is correct, and the service interruption between the user equipment and the secondary base station due to the incorrect key and the corresponding algorithm can be avoided.
  • An embodiment of the present invention provides a core network element 50.
  • the core network element 50 includes:
  • the receiving unit 5 1, the judging unit 52, and the transmitting unit 53 are identical to the receiving unit 5 and the transmitting unit 53.
  • the receiving unit 5 1 is configured to receive data that is decrypted by the secondary base station according to the key derived by the secondary base station and the uplink data sent by the user equipment according to a preset algorithm.
  • the preset data may be an encryption algorithm between the UE and the secondary base station A connection has been established, and the secondary base station decrypts the encrypted uplink data received from the UE according to the key and encryption algorithm derived from the UE to obtain an Internet Protocol (IP) packet, and sends the IP packet to the core network element.
  • IP Internet Protocol
  • the determining unit 52 is configured to determine, according to the decrypted data, whether the key derived by the user equipment is the same as the key derived by the secondary base station.
  • the determining unit 52 is configured to:
  • the Internet Protocol address and port number can be identified, it is determined that the key derived by the user equipment is the same as the key derived by the secondary base station; or
  • the Internet Protocol address and/or port number cannot be identified, it is determined that the key derived by the user equipment is not the same as the key derived by the secondary base station.
  • the determining unit 52 receives the IP packet from the receiving unit 51, and obtains the IP address and the port number of the IP file. If the IP address and the port number can be identified, the IP packet is correct, and the UE-derived The key associated with the secondary base station and the associated key derived by the secondary base station are the same; or,
  • the IP packet is an error packet, and the UE-derived key associated with the secondary base station and the secondary base-derived related key are different.
  • the core network element 50 further includes:
  • the notification unit 54 is configured to: if the key derived by the user equipment is different from the key derived by the secondary base station, the core network element notifies the primary base station to delete the secondary base station; or the core network element notifies the primary base station to re-add the secondary base station; or The core network element notifies the secondary base station to re-trigger the reconfiguration process by the primary base station; or the core network element notifies the secondary base station to delete the secondary base station by the primary base station.
  • the notification unit 54 can be specifically configured to:
  • the core network element 50 may notify the primary base station through the MME or directly notify the primary base station that the secondary base station has a problem. At the same time, it may indicate that the bearer of the secondary base station has a problem, that is, the bearer identifier is carried in the indication, and the primary base station determines that the secondary base station has a problem, deletes the secondary base station, or causes the primary base station to re-add the secondary base station; or the core network element 50 The secondary base station may be notified to re-trigger the reconfiguration of the connection with the UE; or the core network element 50 notifies the secondary base station to delete the secondary base station by the primary base station.
  • An embodiment of the present invention provides a core network element, where the receiving base station decrypts the uplink data sent by the user equipment according to the key derived by the base station and a preset algorithm; and determines the key derived by the user equipment according to the decrypted data. Whether the key derived from the secondary base station is the same; the result of the judgment is sent to the secondary base station. It is possible to verify that the key between the user equipment and the secondary base station is correct, and the service interruption between the user equipment and the secondary base station due to the incorrect key and the corresponding algorithm can be avoided.
  • An embodiment of the present invention provides a method for verifying a key. Based on the secondary base station, as shown in FIG. 10, the method includes:
  • the secondary base station receives the verification information sent by the user equipment.
  • the verification information is obtained by the user equipment, and the preset data includes at least one of an encryption algorithm and a integrity protection algorithm.
  • the secondary base station acquires the target data according to the key, the preset algorithm, the preset data, and the verification information derived by the secondary base station.
  • the secondary base station determines, according to the preset data, the verification information, and the target data, whether the key derived by the user equipment is the same as the key derived by the secondary base station.
  • An embodiment of the present invention provides a method for verifying a key.
  • the secondary base station receives the verification information sent by the user equipment, and the verification information is that the user equipment protects the preset data by using a key derived by the user equipment and a preset algorithm.
  • the obtained information, the preset algorithm includes at least one of an encryption algorithm and an integrity protection algorithm; the secondary base station is derived from the secondary base station itself
  • the key, the preset algorithm, the preset data, and the verification information acquire the target data; the secondary base station determines, according to the preset data, the verification information, and the target data, whether the key derived by the user equipment is the same as the key derived by the secondary base station itself. It is possible to check whether the key between the user equipment and the secondary base station is correct, and the service interruption between the user equipment and the secondary base station due to the incorrect key and the corresponding algorithm can be avoided.
  • the method includes:
  • the secondary base station receives the verification information sent by the user equipment.
  • the verification information is information obtained by the user equipment after the preset data is protected by the user-derived key, encryption algorithm, and/or integrity protection algorithm.
  • the preset data includes at least one of the following:
  • a cell identifier under the secondary base station a physical cell identifier under the secondary base station, a temporary wireless network temporary identifier under the secondary base station, a cell identifier under the primary base station, a physical cell identifier under the primary base station, a temporary wireless network temporary identifier under the primary base station, The identification data stored by the secondary base station and the user equipment, the data transmitted by the primary base station or the secondary base station to the user equipment, and specific numbers.
  • the secondary base station receives the base station addition completion message from the primary base station by using the X2 interface, and the base station addition completion message carries the verification information;
  • the secondary base station receives the media access control message sent by the user equipment, where the media access control message carries the verification information;
  • the packet packet convergence protocol data carrying the verification information.
  • the verification information may be included in the RRC Connection Reconfiguration Complete message sent by the UE to the primary base station. After receiving the verification information, the primary base station sends the verification information to the secondary base station to send the verification information to the secondary base station.
  • carrying the verification information in the radio resource connection reconfiguration complete message may be implemented by adding a security interface securityConfirmation.
  • a security interface securityConfirmation For example, it can be implemented by the following code: RRC Connection Reconfiguration Complete Message
  • RRCConnectionReconfigurationComplete SEQUENCE ⁇ rrc-Transactionldentifier RRC-Transactionldentifier, criticalExtensions CHOICE ⁇
  • the Security Confirmation can be in the form of OCTET STRING or BIT STRING (SIZE (xx).
  • selecting the preset data in securityConfirmation can be passed
  • the following code is implemented: SEQUENCE ⁇ cellldentity Cellldentity : physCellld PhysCellld c-RNTI C-RNTI
  • the UE generates a securityConfirmation, which may be an integrity protection result of the key calculation used by the security protection algorithm and the integrity protection algorithm of the securityConfirmationlnput; or may be the encryption of the security secret algorithm and the key calculation of the force secret algorithm. The result; or a combination of the two.
  • a securityConfirmation which may be an integrity protection result of the key calculation used by the security protection algorithm and the integrity protection algorithm of the securityConfirmationlnput; or may be the encryption of the security secret algorithm and the key calculation of the force secret algorithm. The result; or a combination of the two.
  • the securityConfirmation is the result of the K UPenc calculation performed by the UE using the force-to-sense algorithm and the secondary base station, and the primary base station sends a base station adding force completion message to the secondary base station through the X2 interface, wherein the base station adds a force completion message.
  • the sub-base 4 owes i'J securityConfirmation.
  • the verification information is included in the MAC message sent by the user equipment, specifically by adding a securityConfirmation in the MAC message.
  • a new LCID value can be newly introduced to represent securityConfirmation, for example, using 0101 1 , where L is the length of the securityConfirmation, where the securityConfirmation is a fixed length, and can be directly placed into the securityConfirmation without L.
  • the current LCID value can also be reused, the securityConfirmation can be added to the existing MAC message or the securityConfirmation can be directly transmitted by the UE as data transmission or through the physical layer.
  • selecting the preset data in securityConfirmation can be implemented by the following code:
  • the UE generates a securityConfirmation, which may be an integrity protection result of the key calculation used by the security protection algorithm and the integrity protection algorithm of the securityConfirmationlnput; or may be the encryption of the security secret algorithm and the key calculation of the force secret algorithm. The result; or a combination of the two.
  • a securityConfirmation which may be an integrity protection result of the key calculation used by the security protection algorithm and the integrity protection algorithm of the securityConfirmationlnput; or may be the encryption of the security secret algorithm and the key calculation of the force secret algorithm. The result; or a combination of the two.
  • securityConfirmation is the result of the UE using the integrity protection algorithm and the derived K UPint or K RRCint calculation related to the secondary base station, and the securityConfirmation is added to the MAC message sent by the UE to the secondary base station, and the secondary base station receives the securityConfirmation.
  • the verification information may also be included in Packet Data Convergence Protocol (PDCP) data sent by the user equipment.
  • PDCP Packet Data Convergence Protocol
  • the verification information may be a securityConfirmation
  • the UE generates a securityConfirmation, which may be an integrity protection result of the key calculation used by the securityConfirmationlnput: 3 ⁇ 4 integrity protection algorithm and the integrity protection algorithm; or may be a security secret to the securityConfirmationlnput
  • a securityConfirmation which may be an integrity protection result of the key calculation used by the securityConfirmationlnput: 3 ⁇ 4 integrity protection algorithm and the integrity protection algorithm; or may be a security secret to the securityConfirmationlnput
  • the algorithm and the result of the encryption of the key calculation of the force-to-mouth algorithm or a combination of the two.
  • selecting the preset data in securityConfirmation can be implemented by the following code:
  • the securityConfirmation is the result of the K UPenc calculation performed by the UE using the force-to-sense algorithm and the secondary base station, and the primary base station sends a base station adding force completion message to the secondary base station through the X2 interface, wherein the base station adds a force completion message.
  • the sub-base 4 owes i'J securityConfirmation.
  • the secondary base station acquires target data according to a key, a preset algorithm, preset data, and check information derived by the secondary base station.
  • the verification information is securityConfirmation
  • the preset data is securityConfirmationlnput
  • the verification information is a result of the calculation of the securityConfirmationlnput by the UE using the power secret algorithm and the derived KUPenc related to the secondary base station
  • the securityConfirmation is added to the primary base station.
  • the base station adds the completion message to the secondary base station.
  • the secondary base station decrypts the securityConfirmation according to the encryption algorithm and its own derived K UPenc to obtain a new SecurityConfirmationInstance.
  • the verification information is securityConfirmation
  • the preset data is securityConfirmationlnput
  • the verification information is a result of the UE using the integrity protection algorithm and the derived K UPint or K RRCint related to the security base station, and the securityConfirmationlnput, securityConfirmation
  • the secondary base station receives the securityConfirmation and performs integrity protection calculation on the securityConfirmationlnput saved by the integrity protection algorithm and its own derived K UPint or K RRCint to obtain a new securityConfirmation.
  • the verification information is securityConfirmation
  • the preset data is securityConfirmationlnput
  • the verification information is used by the UE.
  • the secret algorithm and the derived K UPenc related to the secondary base station calculate the result of the securityConfirmationlnput
  • the securityConfirmation is added to the PDCP data sent by the UE to the secondary base station
  • the secondary base station receives the securityConfirmation and derives according to the encryption algorithm and itself.
  • the K UPenc checksum is decrypted to obtain a new SecurityConfirmationlnput.
  • the secondary base station determines, according to the preset data, the verification information, and the target data, whether the key derived by the user equipment is the same as the key derived by the secondary base station itself.
  • the verification information is securityConfirmation
  • the preset data is securityConfirmationlnput.
  • the verification information is the result of the UE using the integrity protection algorithm and the derived K UPint related to the security base station.
  • the securityConfirmationlnput is the UE and the secondary base station.
  • the cell identification data of one secondary base station is stored, and after receiving the securityConfirmation, the secondary base station performs a complete securityConfirmation on the securityConfirmationlnput according to the integrity protection algorithm and the self-derived K UPint to obtain a new securityConfirmation, and determines the new securityConfirmation and the received Whether the securityConfirmation is the same, if it is, it indicates that the UE-derived K UPint related to the secondary base station is the same as the K UPin S derived by the secondary base station itself, otherwise it is different.
  • the verification information is securityConfirmation
  • the preset data is securityConfirmationlnput
  • the verification information is a result of the UE using the integrity protection algorithm and the derived K RRCint related to the security base station to calculate the securityConfirmationlnput
  • the securityConfirmationlnput is the UE and
  • the secondary base station stores the cell identification data of a secondary base station. After receiving the securityConfirmation, the secondary base station performs a security protection calculation on the securityConfirmationlnput according to the integrity protection algorithm and its own derived K RRCint to obtain a new securityConfirmation, and judges the new securityConfirmation and the connection.
  • securityConfirmation to L is the same, if the same description of the same UE-derived K RRCint the secondary base station and the secondary base station associated derived K RRCint itself, or not identical.
  • the verification information is securityConfirmation
  • the preset data is securityConfirmationlnput
  • the verification information is that the UE uses the integrity protection algorithm and the derived KUPint related to the secondary base station to protect the securityConfirmationlnput integrity and obtain the intermediate variable securityConfirmationTemp. Then, using the encryption algorithm and the derived K UPenc securityConfirmationTem associated with the secondary base station, j securityConfirmation is obtained.
  • the secondary base station uses the encryption algorithm and its own derived K UPenc to decrypt the securityConfirmation and obtain the i'j securityConfirmationTem, and then uses the integrity protection algorithm and the derived K UPint integrity protection for the stored securityConfirmationlnput to obtain a new securityConfirmationTemp.
  • new securityConfirmationTem ⁇ are the same and the ground i'J securityConfirmation obtained decrypted securityConfirmationTemp, if the same shellfish described the UE 1 J ⁇ [associated with secondary base station K UPenc raw sewage, K UPint to the secondary station itself derived K UPenc, K UPint corresponds to the same, otherwise it is not the same.
  • the secondary base station causes the user equipment to delete the secondary base station or re-derivate the key.
  • the secondary base station may notify the UE to delete the secondary base station or cause the UE to re-derived the key associated with the secondary base station.
  • An embodiment of the present invention provides a method for verifying a key.
  • the secondary base station receives the verification information sent by the user equipment, and the verification information is that the user equipment protects the preset data by using a key derived by the user equipment and a preset algorithm.
  • the obtained information, the preset algorithm includes at least one of an encryption algorithm and an integrity protection algorithm;
  • the secondary base station acquires target data according to a key derived by the secondary base station itself, a preset algorithm, preset data, and check information;
  • the preset data, the verification information, and the target data determine whether the key derived by the user equipment is the same as the key derived by the secondary base station itself. It is possible to check whether the key between the user equipment and the secondary base station is correct, and the service interruption between the user equipment and the secondary base station due to the incorrect key and the corresponding algorithm can be avoided.
  • An embodiment of the present invention provides a method for verifying a key. Based on a primary base station, as shown in FIG. 12, the method includes:
  • the primary base station receives the verification information sent by the user equipment.
  • the verification information is information obtained by the user equipment after the preset data is protected by the user equipment-derived key and the preset algorithm, and the preset algorithm includes an encryption algorithm. At least one of the integrity protection algorithms.
  • the primary base station acquires target data according to a key derived by the secondary base station, a preset algorithm, preset data, and check information.
  • the primary base station determines, according to the preset data, the verification information, and the target data, whether the key derived by the user equipment is the same as the key derived by the secondary base station, and the determination result is obtained.
  • the primary base station sends the determination result to the secondary base station.
  • An embodiment of the present invention provides a method for verifying a key.
  • the primary base station receives the verification information sent by the user equipment, and the verification information is that the user equipment protects the preset data by using a key derived by the user equipment and a preset algorithm.
  • the obtained information, the preset algorithm includes at least one of an encryption algorithm and an integrity protection algorithm;
  • the primary base station acquires target data according to a key derived from the secondary base station, a preset algorithm, preset data, and check information;
  • the data, the verification information, and the target data are determined to determine whether the key derived by the user equipment is the same as the key derived by the secondary base station, and the judgment result is obtained; the primary base station sends the determination result to the secondary base station. It can verify whether the key between the user equipment and the secondary base station is correct, and can avoid data errors or even service interruption between the user equipment and the secondary base station due to the incorrect key and the corresponding algorithm.
  • a method for providing a verification key based on a primary base station is described in detail below by using a specific embodiment, as shown in FIG. As shown, the method includes:
  • the primary base station receives the verification information sent by the user equipment.
  • the verification information is obtained by the user equipment, and the preset data includes at least one of an encryption algorithm and a integrity protection algorithm.
  • the preset data includes at least one of the following:
  • the primary base station receives the radio resource control message that is sent by the UE and includes the verification information.
  • the radio resource control message may be an RRC Connection Reconfiguration Complete Message, where the verification information is included.
  • the verification information may be included in the RRC Connection Reconfiguration Complete message sent by the UE to the primary base station. After receiving the verification information, the primary base station sends the verification information to the secondary base station to send the verification information to the secondary base station.
  • carrying the verification information in the radio resource connection reconfiguration complete message may be implemented by adding a security interface.
  • RRCConnectionReconfigurationComplete SEQUENCE ⁇ rrc-Transactionldentifier RRC-Transactionldentifier, criticalExtensions CHOICE ⁇
  • the Security Confirmation can be in the form of OCTET STRING or BIT STRING (SIZE (xx).
  • securityConfirmationlnput SEQUENCE ⁇ cellldentity Cellldentity, physCellld PhysCellld, c-RNTI C-RNTI
  • the UE generates a securityConfirmation, which may be an integrity protection result of the key calculation used by the security protection algorithm and the integrity protection algorithm of the securityConfirmationlnput; or may be the encryption of the security secret algorithm and the key calculation of the force secret algorithm. The result; or a combination of the two.
  • a securityConfirmation which may be an integrity protection result of the key calculation used by the security protection algorithm and the integrity protection algorithm of the securityConfirmationlnput; or may be the encryption of the security secret algorithm and the key calculation of the force secret algorithm. The result; or a combination of the two.
  • security securityConfirmation is the result of the K UPenc calculation performed by the UE using the power secret algorithm and the secondary base station, and the UE sends an RRC Connection Reconfiguration Complete Message to the primary base station, where the RRC Connection Reconfiguration Complete Message carries the securityConfirmation, and the primary base station receives Go to securityConfirmation.
  • the primary base station acquires target data according to a key derived by the secondary base station, a preset algorithm, preset data, and check information.
  • the verification information is securityConfirmation
  • the preset data is securityConfirmationlnput
  • the verification information is a result of the UE using the integrity protection algorithm and the derived K UPint related to the secondary base station to calculate the securityConfirmationlnput
  • the securityConfirmation is In the RRC Connection Reconfiguration Complete Message sent by the UE to the primary base station, the primary base station receives the securityConfirmation according to the integrity protection algorithm and the K UPint derived from the secondary base station itself (where K UPint is used by the primary base station to use the same key as the secondary base station) The derived process gets) The integrity protection of securityConfirmationlnput gets a new securityConfirmation.
  • the primary base station determines, according to the preset data, the target data, and the check information, whether the key derived by the user equipment is the same as the key derived by the secondary base station, and the judgment result is obtained.
  • the verification information is securityConfirmation
  • the preset data is securityConfirmationlnput.
  • the verification information is the result of the UE using the integrity protection algorithm and the derived K UPint related to the security base station.
  • the securityConfirmationlnput is the UE and the secondary base station.
  • the cell identification data of one secondary base station is stored.
  • the primary base station uses the KUPint derived from the integrity protection algorithm and the secondary base station itself (here! ⁇ is the same key used by the primary base station as the secondary base station)
  • the derivation process obtains a security protection for the securityConfirmationlnput to obtain a new securityConfirmation, and judges whether the new securityConfirmation is the same as the received securityConfirmation. If they are the same, the UE-derived sub-base station-related 1 -1111 and the secondary base station-derived K are derived. UPin S is the same, otherwise it is not the same.
  • the primary base station sends the determination result to the secondary base station.
  • the primary base station sends the result of the step S303 to the secondary base station through the X2 interface.
  • S405 If the key derived by the user equipment is different from the derived key of the secondary base station, the user equipment is deleted or the user equipment is re-derived. Exemplarily, it is assumed that the result that the primary base station determines to the secondary base station is: the UE-derived K UPint associated with the secondary base station and the secondary base station itself are derived! ⁇ is not the same, then the secondary base station can notify the UE to delete the secondary base station or cause the UE to regenerate the key associated with the secondary base station.
  • An embodiment of the present invention provides a method for verifying a key, which receives verification information sent by a user equipment, and the verification information is obtained by the user equipment protecting the preset data by using a key derived by the user equipment and a preset algorithm.
  • the information, the preset algorithm includes at least one of an encryption algorithm and an integrity protection algorithm; acquiring target data according to a key derived from the secondary base station, a preset algorithm, preset data, and verification information; according to preset data, verification information And determining, by the target data, whether the key derived by the user equipment is the same as the key derived by the secondary base station, and obtaining a determination result; and sending the determination result to the secondary base station. It can verify whether the key between the user equipment and the secondary base station is correct, and can avoid data errors or even service interruption between the user equipment and the secondary base station due to the incorrect key and the corresponding algorithm.
  • An embodiment of the present invention provides a method for verifying a key. Based on the UE, as shown in FIG. 14, the method includes:
  • the S50 user equipment decrypts the received downlink data according to the key derived by the user equipment and a preset algorithm.
  • the user equipment determines, according to the decrypted data, whether the key derived by the user equipment is the same as the key derived by the secondary base station.
  • the user equipment determines, according to the decrypted data, whether the key derived by the user equipment is the same as the key derived by the secondary base station, including:
  • the user equipment obtains the Internet Protocol address and the port number of the decrypted data packet; if the Internet Protocol address and the port number can be identified, it is determined that the key derived by the user equipment is the same as the key derived by the secondary base station; or
  • the Internet Protocol address and/or port number cannot be identified, it is determined that the user equipment derived key is not the same as the secondary base station derived key.
  • the user equipment sends a determination result to the secondary base station.
  • An embodiment of the present invention provides a method for verifying a key, where the user equipment decrypts the received downlink data according to a key derived by the user equipment and a preset algorithm; The device determines whether the key derived by the user equipment is the same as the key derived by the secondary base station according to the decrypted data; the user equipment sends the determination result to the secondary base station. It can verify whether the key between the user equipment and the secondary base station is correct, and can avoid data errors or even service interruption between the user equipment and the secondary base station due to the incorrect key and the corresponding algorithm.
  • the user equipment decrypts the received downlink data according to a key derived by the user equipment and a preset algorithm.
  • the preset algorithm may be an encryption algorithm, and a connection is established between the UE and the secondary base station, and the UE decrypts the encrypted downlink data received from the network side according to the key and encryption algorithm derived by the UE, and then obtains IP packet.
  • the user equipment obtains an internet protocol address and a port number of the decrypted data packet.
  • the UE parses the decrypted IP packet to obtain an IP address and a port number of the packet.
  • the user equipment determines, according to the Internet Protocol address and the port number of the data packet, whether the key derived by the user equipment is the same as the key derived by the secondary base station, and the judgment result is obtained.
  • the UE has an IP address and a port number to determine whether the key generated by the UE is the same as the key generated by the secondary base station. If the IP address and the port number can be identified, the IP packet is sent to the corresponding application, and The UE-derived key associated with the secondary base station and the secondary base-derived key are the same; if the IP address and/or port number cannot be identified, the IP packet is an error packet, and the UE-derived The key associated with the secondary base station is different from the associated key derived by the secondary base station.
  • the user equipment sends a determination result to the secondary base station.
  • U E sends the result of the judgment to the secondary base station through the primary base station.
  • the user equipment notifies the primary base station to delete the secondary base station, or the user equipment notifies the primary base station to re-add the secondary base station; or the user equipment notifies the secondary base station to notify the secondary base station.
  • Base station re-trigger reconfiguration flow The user equipment notifies the secondary base station to delete the secondary base station through the primary base station.
  • the UE may notify the primary base station that the secondary base station has a problem, and may indicate which of the secondary base station has a problem.
  • the bearer identifier is carried in the indication, the primary base station determines that the secondary base station has a problem, deletes the secondary base station, or causes the primary base station to re-add the secondary base station; or the UE may notify the secondary base station to re-trigger the reconfiguration with the UE by the primary base station. Connected; or the UE notifies the secondary base station to delete the secondary base station through the primary base station.
  • An embodiment of the present invention provides a method for verifying a key.
  • the user equipment decrypts the received downlink data according to a key derived by the user equipment and a preset algorithm.
  • the user equipment determines the density of the user equipment according to the decrypted data. Whether the key is the same as the key derived by the secondary base station; the judgment result is sent to the secondary base station. It can verify whether the key between the user equipment and the secondary base station is correct, and can avoid data errors or even service interruption between the user equipment and the secondary base station caused by the key and the corresponding algorithm being incorrect.
  • An embodiment of the present invention provides a method for verifying a key. Based on a core network element, as shown in FIG. 16, the method includes:
  • the S70 core network element receives the data that the secondary base station decrypts the uplink data sent by the user equipment according to the key derived by the secondary base station and the preset algorithm.
  • the core network element determines, according to the decrypted data, whether the key derived by the user equipment is the same as the key derived by the secondary base station.
  • the core network element determines, according to the decrypted data, whether the key derived by the user equipment and the key derived by the secondary base station are the same:
  • the Internet Protocol address and port number can be identified, it is determined that the key derived by the user equipment is the same as the key derived by the secondary base station; or
  • the Internet Protocol address and/or port number cannot be identified, it is determined that the user equipment derived key is not the same as the secondary base station derived key.
  • the core network element sends a result of the judgment to the secondary base station.
  • An embodiment of the present invention provides a method for verifying a key, where a core network element receives a number of uplinks sent by a secondary base station to a user equipment according to a key derived by the secondary base station and a preset algorithm. According to the decrypted data, the core network element determines whether the key derived by the user equipment is the same as the key derived by the secondary base station according to the decrypted data; the core network element sends the result of the judgment to the secondary base station. It can verify whether the key between the user equipment and the secondary base station is correct, and can avoid data errors or even service interruption between the user equipment and the secondary base station due to the incorrect key and the corresponding algorithm.
  • the method includes:
  • the core network element receives the data that the secondary base station decrypts the uplink data sent by the user equipment according to the key derived by the secondary base station and the preset algorithm.
  • the preset data may be an encryption algorithm
  • a connection is established between the UE and the secondary base station, and the secondary base station decrypts the encrypted uplink data received from the UE according to the key and encryption algorithm derived by the secondary base station to obtain an IP report. If the IP packet is sent to the core network element, the core network element is connected to the IP address.
  • the core network element obtains an internet protocol address and a port number of the decrypted data packet.
  • the core network element parses the received IP packet to obtain the IP address and port number of the packet.
  • the core network element determines, according to the Internet protocol address and the port number of the data packet, whether the key derived by the user equipment is the same as the key derived by the secondary base station, and the judgment result is obtained.
  • the core network element has an IP address and a port number to determine whether the key of the UE 4 is the same as the key derived by the secondary base station. If the IP address and the port number can be identified, the IP packet is sent to the corresponding one.
  • the application also shows that the UE-derived key associated with the secondary base station and the secondary base-derived related key are the same; if the IP address and/or port number cannot be identified, the IP packet is an error packet, and It is indicated that the UE-derived key associated with the secondary base station and the secondary base-derived related key are different.
  • the core network element sends a determination result to the secondary base station.
  • the core network element sends the result of the judgment to the secondary base station. S 805. If the key derived by the user equipment is different from the key generated by the secondary base station, the core network element notifies the primary base station to delete the secondary base station; or the core network element notifies the primary base station to re-add the secondary base station; or the core network The element notifies the secondary base station to re-trigger the reconfiguration process by the primary base station; or the core network element notifies the secondary base station to delete the secondary base station by the primary base station.
  • the core network element may notify the primary base station through the MME or directly notify the primary base station that the secondary base station has a problem, and
  • the bearer may be instructed to carry the problem, that is, the bearer identifier is carried in the indication, and the primary base station determines that the secondary base station has a problem, deletes the secondary base station, or causes the primary base station to re-add the secondary base station; or the core network element passes the primary base station.
  • the secondary base station is notified to delete the secondary base station.
  • An embodiment of the present invention provides a method for verifying a key, where a core network element receives data decrypted by a secondary base station according to a key derived by a secondary base station and a preset algorithm for decrypting uplink data sent by the user equipment; Determining, according to the decrypted data, whether the key derived by the user equipment is the same as the key derived by the secondary base station; the core network element sends the result of the judgment to the secondary base station. It can verify whether the key between the user equipment and the secondary base station is correct, and can avoid data errors or even service interruption between the user equipment and the secondary base station due to the incorrect key and the corresponding algorithm.
  • An embodiment of the present invention provides a base station 60.
  • the user equipment 60 includes: a bus 64; and a processor 61, a memory 62, and an interface 63 connected to the bus 64, wherein the interface 63 is used for communication;
  • the memory 62 is for storing computer code
  • the processor 61 is configured to execute the computer code for:
  • Receiving the verification information sent by the user equipment, and the verification information is information obtained by the user equipment after the preset data is protected by the user equipment-derived key and the preset algorithm, and the preset algorithm includes an encryption algorithm and an integrity protection algorithm. At least one
  • the user equipment-derived key is determined to be the same as the base station-derived key according to the preset data, the verification information, and the target data.
  • the processor 61 executes the computer code and is further configured to: If the key derived by the user equipment is different from the key derived by the base station, the user equipment is re-derived or the user equipment is deleted.
  • the processor 61 executes the computer code for receiving the verification information sent by the user equipment, specifically for:
  • the preset data includes at least one of the following:
  • a cell identifier under the secondary base station a physical cell identifier under the secondary base station, a temporary wireless network temporary identifier under the secondary base station, a cell identifier under the primary base station, a physical cell identifier under the primary base station, a temporary wireless network temporary identifier under the primary base station, The identification data stored by the secondary base station and the user equipment, the data transmitted by the primary base station or the secondary base station to the user equipment, and specific numbers.
  • the base station is a secondary base station.
  • the embodiment of the present invention provides a base station, which receives the verification information sent by the user equipment, and the verification information is information obtained by the user equipment after the preset data is protected by the user equipment, and the preset algorithm is used.
  • the method includes: at least one of an encryption algorithm and an integrity protection algorithm; acquiring target data according to a key derived by the base station, a preset algorithm, preset data, and verification information; determining the user equipment according to the preset data, the verification information, and the target data; Whether the derived key is the same as the key derived by the base station. It is possible to check whether the key between the user equipment and the base station is correct, and the service interruption between the user equipment and the secondary base station due to the incorrect key and the corresponding algorithm can be avoided.
  • the base station 70 includes: a bus 74; and a processor 71, a memory 72, and an interface 73 connected to the bus 74, wherein the interface 73 is used for communication;
  • the memory 72 is for storing computer code
  • the processor 71 is configured to execute the computer code for: Receiving the verification information sent by the user equipment, and the verification information is information obtained by the user equipment after the preset data is protected by the user equipment-derived key and the preset algorithm, and the preset algorithm includes an encryption algorithm and an integrity protection algorithm. At least one
  • the processor 71 executes the computer code and is further configured to:
  • the user equipment deletes the secondary base station or causes the user equipment to re-derived the key.
  • the processor 71 executes the computer code for receiving the verification information sent by the user equipment, specifically for:
  • the preset data includes at least one of the following:
  • a cell identifier under the secondary base station a physical cell identifier under the secondary base station, a temporary wireless network temporary identifier under the secondary base station, a cell identifier under the primary base station, a physical cell identifier under the primary base station, a temporary wireless network temporary identifier under the primary base station, The identification data stored by the secondary base station and the user equipment, the data transmitted by the primary base station or the secondary base station to the user equipment, and specific numbers.
  • the embodiment of the present invention provides a base station, which receives the verification information sent by the user equipment, and the verification information is information obtained by the user equipment after the preset data is protected by the user equipment, and the preset algorithm is used.
  • the method includes: at least one of an encryption algorithm and an integrity protection algorithm; acquiring target data according to a key derived by the secondary base station, a preset algorithm, preset data, and verification information; determining the user according to the preset data, the verification information, and the target data Whether the key derived by the device is the same as the key derived by the secondary base station, and the judgment result is obtained; the judgment result is sent to the secondary base station. It can check whether the key between the user equipment and the secondary base station is correct, and can avoid the key and the corresponding algorithm being incorrect. Data errors and even business interruptions between the user equipment and the secondary base station.
  • An embodiment of the present invention provides a user equipment 80.
  • the user equipment 80 includes: a bus 84; and a processor 81, a memory 82, and an interface 83 connected to the bus 84, wherein the interface 83 is used for communication.
  • the memory 82 is for storing computer code
  • the processor 81 is configured to execute the computer code for:
  • the determining, according to the decrypted data, whether the key derived by the user equipment is the same as the key derived by the secondary base station includes:
  • the Internet Protocol address and port number can be identified, it is determined that the key derived by the user equipment is the same as the key derived by the secondary base station; or
  • the Internet Protocol address and/or port number cannot be identified, it is determined that the user equipment derived key is not the same as the secondary base station derived key.
  • the processor 81 executes the computer code and is further configured to:
  • the primary base station If the key derived by the user equipment is different from the key derived by the secondary base station, notify the primary base station to delete the secondary base station; or notify the primary base station to re-add the secondary base station; or notify the secondary base station to re-trigger the reconfiguration process by the primary base station; or pass the primary base station.
  • the secondary base station is notified to delete the secondary base station.
  • the embodiment of the present invention provides a user equipment, where the user equipment decrypts the received downlink data according to a key derived by the user equipment and a preset algorithm; the user equipment determines, according to the decrypted data, the key derived by the user equipment and the secondary base station. Whether the derived keys are the same; the user equipment sends the judgment result to the secondary base station. It can verify whether the key between the user equipment and the secondary base station is correct, and can avoid data errors or even service interruption between the user equipment and the secondary base station due to the incorrect key and the corresponding algorithm.
  • the embodiment of the present invention provides a core network element 90.
  • the core network element 90 includes: a bus 94; and a processor 91 connected to the bus 94, and stores And an interface 93, wherein the interface 93 is for communication; the memory 92 is for storing computer code, and the processor 91 is configured to execute the computer code for:
  • the Internet Protocol address and port number can be identified, it is determined that the key derived by the user equipment is the same as the key derived by the secondary base station; or
  • the Internet Protocol address and/or port number cannot be identified, it is determined that the user equipment derived key is not the same as the secondary base station derived key.
  • the processor 91 executes the computer code and is further configured to:
  • the primary base station If the key derived by the user equipment is different from the key derived by the secondary base station, notify the primary base station to delete the secondary base station; or notify the primary base station to re-add the secondary base station; or notify the secondary base station to re-trigger the reconfiguration process by the primary base station; or pass the primary base station.
  • the secondary base station is notified to delete the secondary base station.
  • the processor 91 executes the computer code to notify the primary base station to delete the secondary base station or notify the primary base station to re-add the secondary base station, specifically for:
  • An embodiment of the present invention provides a network element of a core network, which receives data obtained by decrypting uplink data sent by a user equipment according to a key derived by a secondary base station and a preset algorithm, and determining, according to the decrypted data, a user equipment derivative. Whether the key is the same as the key derived by the secondary base station; the result of the judgment is sent to the secondary base station. It can verify whether the key between the user equipment and the secondary base station is correct, and can avoid data errors or even service interruption between the user equipment and the secondary base station due to the incorrect key and the corresponding algorithm.
  • the disclosed system, apparatus, and method may be implemented in other manners.
  • the device embodiments described above are merely illustrative.
  • the division of the unit is only a logical function division.
  • there may be another division manner for example, multiple units or components may be combined or Can be integrated into another system, or some features can be ignored, or not executed.
  • the coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or unit, and may be electrical, mechanical or otherwise.
  • the units described as separate components may or may not be physically separated, and the components displayed as the units may or may not be physical units, and may be located in one place or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the objectives of the embodiment of the present embodiment.
  • each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may be physically included separately, or two or more units may be integrated into one unit.
  • the above integrated unit can be implemented in the form of hardware or in the form of hardware plus software functional units.
  • the integrated unit is implemented in the form of a software functional unit and is independent When the product is sold or used, it can be stored on a computer readable storage medium.
  • the instructions include a plurality of instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) or a processor to perform all or part of the steps of the methods of the various embodiments of the present invention.
  • the foregoing storage medium includes: a U disk, a removable hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and the like, which can store program codes. .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

L'invention concerne un procédé de vérification de clé, une station de base, un dispositif d'utilisateur, et un élément de réseau central. En vérifiant si des clés entre un dispositif d'utilisateur et une station de base auxiliaire sont correctes, le procédé empêche une perte de données voire une interruption de service entre le dispositif d'utilisateur et la station de base auxiliaire provoquées par le fait que des clés et des algorithmes correspondant sont incorrects. Le procédé comprend les étapes suivantes : un dispositif d'utilisateur envoie des informations de vérification à une station de base, les informations de vérification étant des informations obtenues après que le dispositif d'utilisateur a exécuté une protection sur des données prédéfinies connues du dispositif d'utilisateur et de la station de base via une clé calculée par le dispositif d'utilisateur et un algorithme prédéfini, l'algorithme prédéfini comprenant un algorithme de chiffrement et/ou un algorithme de protection d'intégrité ; la station de base reçoit les informations de vérification, obtient des données cible d'après le même algorithme prédéfini, une clé calculée par une station de base auxiliaire et les informations de vérification, et détermine, d'après les données prédéfinies, les informations de vérification et les données cible, si la clé calculée par le dispositif d'utilisateur et la clé calculée par la station de base sont identiques. La présente invention est utilisé pour vérifier des clés entre un dispositif d'utilisateur et une station de base.
PCT/CN2014/070607 2014-01-14 2014-01-14 Procédé de vérification de clé, station de base, dispositif d'utilisateur, et élément de réseau central WO2015106387A1 (fr)

Priority Applications (2)

Application Number Priority Date Filing Date Title
CN201480000891.9A CN105027495B (zh) 2014-01-14 2014-01-14 一种校验密钥的方法、基站、用户设备和核心网网元
PCT/CN2014/070607 WO2015106387A1 (fr) 2014-01-14 2014-01-14 Procédé de vérification de clé, station de base, dispositif d'utilisateur, et élément de réseau central

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2014/070607 WO2015106387A1 (fr) 2014-01-14 2014-01-14 Procédé de vérification de clé, station de base, dispositif d'utilisateur, et élément de réseau central

Publications (1)

Publication Number Publication Date
WO2015106387A1 true WO2015106387A1 (fr) 2015-07-23

Family

ID=53542265

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2014/070607 WO2015106387A1 (fr) 2014-01-14 2014-01-14 Procédé de vérification de clé, station de base, dispositif d'utilisateur, et élément de réseau central

Country Status (2)

Country Link
CN (1) CN105027495B (fr)
WO (1) WO2015106387A1 (fr)

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113573423B (zh) * 2018-05-30 2024-01-16 华为技术有限公司 一种通信方法及装置
CN113132924B (zh) * 2021-04-19 2022-01-21 北京达源环保科技有限公司 用于高部署密度的污泥厌氧消化监测终端的信息传输方法及系统
CN114069826A (zh) * 2021-10-30 2022-02-18 国网湖南省电力有限公司 一种备自投装置5g通讯安全校核方法、系统及介质

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1859772A (zh) * 2006-01-07 2006-11-08 华为技术有限公司 一种基于通用鉴权框架的安全业务通信方法
CN101102186A (zh) * 2006-07-04 2008-01-09 华为技术有限公司 通用鉴权框架推送业务实现方法
US20120155647A1 (en) * 2010-12-21 2012-06-21 General Instrument Corporation Cryptographic devices & methods

Family Cites Families (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101309503A (zh) * 2007-05-17 2008-11-19 华为技术有限公司 无线切换方法、基站及终端
EP2028890B1 (fr) * 2007-08-12 2019-01-02 LG Electronics Inc. Procédé de transfert avec récupération d'un échec de lien, dispositif sans fil et station de base pour mettre en 'uvre ce procédé
CN101400059B (zh) * 2007-09-28 2010-12-08 华为技术有限公司 一种active状态下的密钥更新方法和设备
CN102625302B (zh) * 2008-06-23 2016-03-30 华为技术有限公司 密钥衍生方法、设备及系统
US9002357B2 (en) * 2009-06-26 2015-04-07 Qualcomm Incorporated Systems, apparatus and methods to facilitate handover security
CN101715188B (zh) * 2010-01-14 2015-11-25 中兴通讯股份有限公司 一种空口密钥的更新方法及系统
CN102215485B (zh) * 2010-04-04 2015-07-22 中兴通讯股份有限公司 多载波通信系统中保证多载波切换或重建安全性的方法

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1859772A (zh) * 2006-01-07 2006-11-08 华为技术有限公司 一种基于通用鉴权框架的安全业务通信方法
CN101102186A (zh) * 2006-07-04 2008-01-09 华为技术有限公司 通用鉴权框架推送业务实现方法
US20120155647A1 (en) * 2010-12-21 2012-06-21 General Instrument Corporation Cryptographic devices & methods

Also Published As

Publication number Publication date
CN105027495A (zh) 2015-11-04
CN105027495B (zh) 2018-12-14

Similar Documents

Publication Publication Date Title
US10958631B2 (en) Method and system for providing security from a radio access network
JP7074847B2 (ja) セキュリティ保護方法、装置及びシステム
CN104581843B (zh) 用于无线通信系统的网络端的处理交递方法及其通信装置
CN110035054B (zh) 用于使能用于enb间的传输的安全通信的方法和系统
KR102062020B1 (ko) 분리된 사용자 및 제어 평면들에 의한 셀룰러 시스템에서의 보안 통신들
US20170359719A1 (en) Key generation method, device, and system
WO2019019736A1 (fr) Procédé de mise en œuvre de sécurité, et appareil et système associés
US10320754B2 (en) Data transmission method and apparatus
WO2011032497A1 (fr) Procédé, dispositif et système de reconfiguration de cellule d'agrégation
EP3944649A1 (fr) Procédé de vérification, appareil, et dispositif
CN109246696B (zh) 密钥处理方法以及相关装置
CN113225784B (zh) 消息的识别方法和装置
CN103888936B (zh) 小区优化方法及装置
CN112105015B (zh) 二级认证的方法和装置
WO2018227638A1 (fr) Procédé et appareil de communication
CN111641947A (zh) 密钥配置的方法、装置和终端
CN110831258A (zh) 一种数据传输的方法及装置
TWI501605B (zh) 執行直接通訊的方法及通訊裝置
KR20150103063A (ko) Scell 및 ue 사이의 암호화 정보 동기 방법
WO2020056433A2 (fr) Communication sécurisée de demande de commande de ressource radio (rrc) sur porteuse radio de signal zéro (srb0)
US20220345883A1 (en) Security key updates in dual connectivity
WO2015131379A1 (fr) Procédé de protection d'informations, station de base, équipement utilisateur et entité de gestion de mobilité
CN104812010A (zh) 一种在小小区增强场景下支持ue恢复的方法
WO2015106387A1 (fr) Procédé de vérification de clé, station de base, dispositif d'utilisateur, et élément de réseau central
CN113302959A (zh) 一种数据传输方法及装置

Legal Events

Date Code Title Description
WWE Wipo information: entry into national phase

Ref document number: 201480000891.9

Country of ref document: CN

121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 14879084

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 14879084

Country of ref document: EP

Kind code of ref document: A1