WO2015113197A1

WO2015113197A1 - Apparatus and method for encrypting data

Info

Publication number: WO2015113197A1
Application number: PCT/CN2014/071651
Authority: WO
Inventors: 张丽佳; 张冬梅
Original assignee: 华为技术有限公司
Priority date: 2014-01-28
Filing date: 2014-01-28
Publication date: 2015-08-06
Also published as: CN105103577A; CN105103577B

Abstract

The present invention relates to the field of wireless communications. Disclosed are an apparatus and a method for encrypting data. The method comprises: receiving a handover trigger message sent by a first Mobility Management Entity (MME), wherein the handover trigger message carries an identifier of a user equipment (UE); receiving a handover request message sent by a second MME; and keeping a key KeNB shared between an evolved Node B (eNB) and the UE unchanged and encrypting data communicated between the eNB and the UE based on the KeNB. The apparatus comprises a first receiving module, a second receiving module, a keeping module and an encryption module. In the present invention, a handover reason is determined to be handover triggered by a core network based on the handover trigger message or the handover request message, and the eNB obtains the KeNB that is currently shared with the UE, keeps the KeNB between the eNB and the UE unchanged, and thus ensures KeNB synchronization at an eNB side and an UE side.

Description

Apparatus and method for encrypting data

The present invention relates to the field of wireless communications, and in particular, to an apparatus and method for encrypting data. Background technique

When a user equipment (UE) performs a specific service, such as an MTC (Machine Type Communication) service, it consumes a large amount of network resources, and an evolved Node B (eNB) prevents the UE from performing specific services. The impact on the normal network will redirect the UE performing the specific service from the normal network to the specific network, and encrypt the data communicated between the eNB and the UE.

Currently, a method for encrypting data is provided, which may be: when a UE is attached to a common network, the first MME (Mobility Management Entity) of the common network learns from the subscription information of the UE that the UE needs to be normal. When the network is redirected to the specific network, the first MME sends a handover trigger message to the eNB, where the message includes the cause value of the handover (the core network triggered handover); the eNB sends a handover requirement message to the first MME, and the first MME calculates the first NCC. (Next hop Chaining Counter, the next hop chain counter) and the first NH (Next Hop), the first NCC is obtained according to the current second NCC, and the first NH is based on the current second. Calculated by the NH; the first MME sends a forward relocation request message to the second MME of the specific network, where the forward relocation request message carries the first NCC and the first NH; and the second MME receives the direction sent by the first MME Re-requesting the request message, and sending a handover request message to the eNB, where the handover request message carries the first NCC and the first NH, and the eNB receives the handover request message sent by the second MME, According to the first update computation NH NCC and a first key KeNB *, KeNB * according to data for the communication between the eNB and the UE encryption.

In the process of implementing the present invention, the inventor has found that the prior art has at least the following problems: In the prior art, the handover procedure is performed, and the eNB does not send a handover command message to the UE.

The UE cannot obtain the first NCC according to the handover command message, and can not calculate the updated key KeNB*, so that the KeNB on the eNB side and the KeNB on the UE side are not synchronized. Summary of the invention

In order to solve the problems of the prior art, the present invention provides an apparatus and method for encrypting data. The technical solution is as follows:

In a first aspect, the present invention provides an apparatus for encrypting data, the apparatus comprising:

a first receiving module, configured to receive a handover trigger message sent by the first mobility management entity MME, where the handover trigger message carries an identifier of the user equipment UE;

a second receiving module, configured to receive a handover request message sent by the second MME;

a maintaining module, configured to keep the key KeNB shared between the evolved base station eNB and the UE unchanged;

And an cryptographic module, configured to perform a strong port key according to the data communicated between the eNB and the UE by the KeNB.

With reference to the first aspect, in a first possible implementation manner of the first aspect, the device further includes: a determining module, configured to determine, according to the handover trigger message, that the handover cause is a core network triggered switch;

a first sending module, configured to send a handover required message to the first MME, where the handover request message carries the handover reason, so that the first MME sends a forward relocation request message to the second MME, where The forward relocation request message carries the handover reason, so that the second MME sends the handover request message to the eNB.

With reference to the first aspect, in a second possible implementation manner of the first aspect, the handover request message carries a first next hop chain counter NCC and a first next hop NH, where the first NCC is Obtained by the MME according to the second NCC, the first NH is calculated by the first MME according to the second NH, the second NCC is the current NCC, and the second NH is the current NH. Or,

The handover request message carries a second next hop chain counter NCC and a second next hop NH, the second NCC is the current NCC, and the second NH is the current NH.

With reference to the first aspect of the first aspect, in a third possible implementation manner of the first aspect, the forward relocation request message carries a first next hop chain counter NCC and a first next hop NH, The first NCC is obtained by adding the first NMC according to the second NCC, the first NH is calculated by the first MME according to the second NH, and the second NCC is the current NCC. Said second NH is the current NH; or

The forward relocation request carries a second next hop chain counter NCC and a second next hop NH, The second NCC is the current NCC, and the second NH is the current NH.

With reference to the first aspect, in a fourth possible implementation manner of the first aspect, the holding module includes:

a determining unit, configured to determine, according to the handover trigger message or the handover request message, that the handover reason is a core network triggered handover;

a holding unit, configured to keep the KeNB unchanged. In a second aspect, the present invention provides an apparatus for encrypting data, the apparatus comprising:

a second sending module, configured to send a handover trigger message to the evolved base station eNB, where the handover trigger message carries an identifier of the user equipment UE, so that the eNB sends a handover required message to the first mobility management entity according to the handover trigger message. MME;

a third receiving module, configured to receive the handover required message sent by the eNB;

The acquiring module is configured to obtain a second next hop chain counter NCC and a second next hop NH, where the second NCC is the current NCC, and the second NH is the current NH;

a third sending module, configured to send a forward relocation request message to the second mobility management entity

The MME, the forward relocation request message carries a handover reason, and causes the second MME to send a handover request message to the eNB, so that the eNB keeps a key shared between the eNB and the UE.

The KeNB is unchanged, and the data communicated between the eNB and the UE is encrypted according to the KeNB.

With reference to the second aspect, in a first possible implementation manner of the second aspect, the handover request message carries a first NCC and a first NH, where the first NCC is a first MME, and the first MME is added according to the second NCC. After the first NH is calculated by the first MME according to the second NH; or

The handover request message carries the second NCC and the second NH.

With reference to the second aspect, in a second possible implementation manner of the second aspect, the forward relocation request message carries a first NCC and a first NH, where the first NCC is the first MME according to the After the second NCC is added, the first NH is calculated by the first MME according to the second NH; or

The forward relocation request message carries the second NCC and the second NH.

With reference to the second aspect, in a third possible implementation manner of the second aspect, the device further includes: a first carrying module, configured to set a next hop indication NHI of the forward relocation request message to Presetting the identifier, and carrying the second NCC and the second NH, or

a second carrying module, configured to set a next hop indication NHI_old of the old evolved packet system EPS security context of the forward relocation request message to the preset identifier, and carry the second NCC and the second HN. In a third aspect, the present invention provides a method of encrypting data, the method comprising:

Receiving a handover trigger message sent by the first mobility management entity MME, where the handover trigger message carries an identifier of the user equipment UE;

Receiving a handover request message sent by the second MME;

The key KeNB shared between the evolved base station eNB and the UE is kept unchanged, and data communicated between the eNB and the UE is encrypted according to the KeNB.

With reference to the third aspect, in a first possible implementation manner of the third aspect, after the receiving the handover trigger message sent by the first mobility management entity MME, the method further includes:

Determining, according to the handover trigger message, that the handover reason is a handover triggered by the core network;

Sending a handover request message to the first MME, the handover request message carrying the handover reason, and causing the first MME to send a forward relocation request message to the second MME, the forward relocation request message Carrying the handover reason, so that the second MME sends the handover request message to the eNB.

With the first possibility of the third aspect, in a second possible implementation manner of the third aspect, the handover request message carries a first next hop chain counter NCC and a first next hop NH, where the first The NCC is obtained by the first MME according to the second NCC, the first NH is calculated by the first MME according to the second NH, the second NCC is the current NCC, and the second NH is the current NH; or,

With reference to the first possibility of the third aspect, in a third possible implementation manner of the third aspect, the forward relocation request message carries a first next hop chain counter NCC and a first next hop NH, The first NCC is obtained by adding the first NMC according to the second NCC, the first NH is calculated by the first MME according to the second NH, and the second NCC is the current NCC. Said second NH is the current NH; or

The forward relocation request message carries a second next hop chain counter NCC and a second next hop NH, the second NCC is the current NCC, and the second NH is the current NH. With reference to the third aspect, in a fourth possible implementation manner of the third aspect, the key KeNB shared by the eNodeB eNB and the UE is unchanged, and includes:

Determining, according to the handover trigger message or the handover request message, that the handover reason is a handover triggered by the core network, keeping the KeNB unchanged. In a fourth aspect, the present invention provides a method for encrypting data, where the method includes: sending a handover trigger message to an evolved base station eNB, where the handover trigger message carries a user equipment

The identifier of the UE, causing the eNB to send a handover required message to the first mobility management entity MME according to the handover trigger message;

Receiving the handover required message sent by the eNB, and acquiring a second next hop chain counter NCC and a second next hop NH, the second NCC is the current NCC, and the second NH is the current NH;

Sending a forward relocation request message to the second MME, where the forward relocation request message carries a handover reason, so that the second MME sends a handover request message to the eNB, so that the eNB maintains the eNB and the eNB The key KeNB shared between the UEs is unchanged, and the KeNB encrypts data communicated between the eNB and the UE.

With reference to the fourth aspect, in a first possible implementation manner of the fourth aspect, the handover request message carries a first NCC and a first NH, and the first NCC is the first MME according to the second After the NCC is added, the first NH is calculated by the first MME according to the second NH; or

The handover request message carries the second NCC and the second NH.

With reference to the fourth aspect, in a second possible implementation manner of the fourth aspect, the forward relocation request message carries a first NCC and a first NH, where the first NCC is the first MME according to the After the second NCC is added, the first NH is calculated by the first MME according to the second NH; or

With reference to the fourth aspect, in a third possible implementation manner of the fourth aspect, before the sending the relocation request message to the second mobility management entity (MME), the method further includes:

Setting a next hop indication NHI of the forward relocation request message as a preset identifier, and carrying the second NCC and the second NH, or

The next hop of the old evolved packet system EPS security context of the forward relocation request message Instructing NHI_old to be set to the preset identifier, and carrying the second NCC and the second HN. In a fifth aspect, the present invention provides an apparatus for encrypting data, the apparatus comprising: a first memory and a first processor, a method for performing encrypted data according to any of the preceding claims. In a sixth aspect, the present invention provides an apparatus for encrypting data, the apparatus comprising: a second memory and a second processor, a method for performing encrypted data according to any of the claims of the fourth aspect.

In the embodiment of the present invention, the eNB receives the handover trigger message sent by the first MME, and receives the handover request message sent by the second MME, and determines, according to the handover trigger message or the handover request message, that the handover reason is a handover triggered by the core network, and the eNB acquires the current The KeNB shared with the UE, and the KeNB* is used as the key KeNB* updated after the handover of the MME, that is, the KeNB between the eNB and the UE is kept unchanged, and the data communicated between the eNB and the UE is performed according to the KeNB or KeNB*. Encryption ensures that the eNB side synchronizes with the KeNB on the UE side. DRAWINGS

In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings used in the description of the embodiments will be briefly described below. It is obvious that the drawings in the following description are only some embodiments of the present invention. Other drawings may also be obtained from those of ordinary skill in the art in light of the inventive work.

1 is a schematic structural diagram of an apparatus for encrypting data according to Embodiment 1 of the present invention;

2 is a schematic structural diagram of an apparatus for encrypting data according to Embodiment 2 of the present invention;

3 is a flowchart of a method for encrypting data according to Embodiment 3 of the present invention;

4 is a flowchart of a method for encrypting data according to Embodiment 4 of the present invention;

FIG. 5 is a flowchart of a method for encrypting data according to Embodiment 5 of the present invention; FIG.

6 is a flowchart of a method for encrypting data according to Embodiment 6 of the present invention;

7 is a schematic structural diagram of an apparatus for encrypting data according to Embodiment 7 of the present invention;

FIG. 8 is a schematic structural diagram of an apparatus for encrypting data according to Embodiment 8 of the present invention. detailed description

The embodiments of the present invention will be further described in detail below with reference to the accompanying drawings. Example 1

Embodiments of the present invention provide an apparatus for encrypting data. Referring to FIG. 1 , the apparatus includes: a first receiving module 101, configured to receive a handover trigger message sent by a first MME, where the handover trigger message carries an identifier of a user equipment UE;

The first MME obtains the identifier of the UE, and sends a handover trigger message to the first receiving module 101, when the first MME needs to switch from the first MME of the common network to the second MME of the specific network. The handover trigger message carries the identity of the UE. The eNB receives the handover trigger message sent by the first MME.

The identifier of the UE is any identifier that can identify the UE. In the embodiment of the present invention, the identifier of the UE is not specifically limited. For example, the identity of the UE is the MME UE S1AP (Access Point) ID (identity identification number), that is, the MME uniquely identifies the identity of the UE on the S1 interface or the eNB UE S1AP ID, that is, the eNB uniquely identifies on the SI interface. The identity of the UE, etc. The first MME is an MME to which the UE is currently attached.

It should be noted that, before the first MME learns from the subscription information of the UE that the UE needs to be handed over from the first MME of the common network to the second MME of the specific network, the UE initiates an attach procedure to the normal network, and the network side A S-GW (Serving Gateway) or a P-GW (PDN Gateway) establishes a PDN (Public Data Network) connection.

The second receiving module 102 is configured to receive a handover request message sent by the second MME.

The second MME sends a handover request message to the second receiving module 102, and the second receiving module 102 receives the handover request message sent by the second MME, in order to redirect the UE from the first MME to the second MME.

Further, when receiving the handover request message sent by the second MME, the second receiving module 102 sends a handover confirmation message to the second MME. The handover confirmation message is used to notify the second MME that the handover can be performed.

The maintaining module 103 is configured to keep the key KeNB shared between the evolved base station eNB and the UE unchanged;

The holding module 103 includes:

The determining unit is configured according to the first MME, because the handover trigger message is sent by the first MME. The handover triggering message may be used to determine that the handover reason is a handover triggered by the core network. Alternatively, the handover request message carries the handover cause, and the determining unit may determine, according to the handover reason, that the handover cause is a handover triggered by the core network.

The handover triggered by the core network only switches the MME to which the UE is attached, and the 'J, the area, and the base station where the UE is located do not change.

The holding unit is used to keep the KeNB unchanged.

The holding unit acquires the KeNB shared between the current eNB and the UE, and uses the KeNB as the key KeNB* after the MME is switched.

The encryption module 104 is configured to encrypt data communicated between the eNB and the UE according to the KeNB or the KeNB*.

Specifically, the encryption module 104 calculates the first key and the second key according to the KeNB*, and performs encryption and integrity protection on the data communicated between the eNB and the UE by using the first key and the second key.

It should be noted that, if the handover request message carries the first {NCC, NH} pair, the eNB ignores the first {NCC, NH} pair and keeps the KeNB unchanged.

Further, the device further includes:

a determining module, configured to determine, according to the handover trigger message, that the handover reason is a core network triggered handover;

The first sending module is configured to send a handover required message to the first MME, where the handover request message carries a handover reason, so that the first MME sends a forward relocation request message to the second MME, where the forward relocation request message carries the handover reason So that the second MME sends the handover request message to the eNB.

Specifically, after the first receiving module 101 receives the handover trigger message sent by the first MME, the determining module determines, according to the handover trigger message, that the handover reason is a handover triggered by the core network, and the first sending module sends a handover required message to the first MME. The handover requires the message to carry the handover reason; the first MME receives the handover required message sent by the first sending module, and sends a forward relocation request message to the second MME, where the forward relocation request message carries the handover reason; A forward relocation request message sent by the first MME, and sending a handover request message to the second receiving module 102.

The reason for the handover carried in the forward relocation request message is used to notify the second MME to switch to the core network triggered handover. The forward relocation request message may also carry Kasme and KSI (Key Set Identifier), and the Kasme and KSI are used to derive the non-access stratum NAS key.

Further, the handover request message may not carry any {NCC, NH} pair information; the handover The request message may also carry a first next hop chain counter NCC and a first next hop NH, where the first NCC is obtained by adding the first MME according to the second NCC, and the first NH is calculated by the first MME according to the second NH. The second NCC is the current NCC, and the second NH is the current NH; or the handover request message carries the second next hop chain counter NCC and the second next hop NH, and the second NCC is the current NCC. The second NH is the current NH.

The first MME obtains the second NCC and the second NH when receiving the handover required message; when the first MME calculates the first NCC and the first NH according to the second NCC and the second NH, the handover request message carries the first The NCC and the first NH, if the first MME does not calculate the first NCC and the first NH according to the second NCC and the second NH, the handover request message carries the second NCC and the second NH.

Further, the handover request message may further carry a handover reason.

The first relocation request message carries the first NCC and the first NH. The first NCC is obtained by adding the first MME according to the second NCC, and the first NH is calculated by the first MME according to the second NH. The second NCC is the current NCC, and the second NH is the current NH; or the forward relocation request message carries the second NCC and the second NH, the second NCC is the current NCC, and the second NH is the current NH.

Further, after the MME to which the UE is attached is switched from the first MME to the second MME, the second MME sends a forward relocation response message to the first MME.

Further, when the handover request message does not carry any {NCC, NH} pair information, after the eNB switches the MME attached by the UE from the first MME to the second MME, the second MME obtains one according to the second NCC. The first NCC calculates the first NH according to the second NH, and sends a path change message to the eNB, where the path change message carries the first {NCC, NH} pair. The eNB receives the path change message sent by the second MME, and acquires the first {NCC, NH} pair.

In the embodiment of the present invention, the eNB receives the handover trigger message sent by the first MME, and receives the handover request message sent by the second MME, and determines, according to the handover trigger message or the handover request message, that the handover reason is a handover triggered by the core network, and the eNB acquires the current The KeNB shared with the UE, and the KeNB* is used as the key KeNB* updated after the handover of the MME, that is, the KeNB between the eNB and the UE is kept unchanged, and the data communicated between the eNB and the UE is performed according to the KeNB or KeNB*. Encryption ensures that the eNB side synchronizes with the KeNB on the UE side. Example 2

Embodiments of the present invention provide an apparatus for encrypting data. Referring to Figure 2, the device includes: The second sending module 201 is configured to send a handover trigger message to the evolved base station eNB, where the handover trigger message carries the identifier of the user equipment UE, so that the eNB sends a handover requirement message according to the handover trigger message;

The first MME obtains the identifier of the UE when the UE needs to switch from the first MME of the common network to the second MME of the specific network, and the second sending module 201 sends a handover trigger message to the first receiving. Module 101, the handover trigger message carries an identifier of the UE. The eNB receives the handover trigger message sent by the first MME.

The identifier of the UE is any identifier that can identify the UE. In the embodiment of the present invention, the identifier of the UE is not specifically limited. For example, the identifier of the UE is the MME UE S1AP ID, that is, the identifier of the MME that uniquely identifies the UE on the S1 interface, or the eNB UE S1AP ID, that is, the identifier of the eNB that uniquely identifies the UE on the SI interface. The first MME is an MME to which the UE is currently attached.

It should be noted that, before the first MME learns from the subscription information of the UE that the UE needs to be handed over from the first MME of the common network to the second MME of the specific network, the UE initiates an attach procedure to the normal network, and the network side The S-GW or P-GW establishes a PDN connection.

The third receiving module 202 is configured to receive the handover required message sent by the eNB;

The eNB sends a handover required message to the third receiving module 202 according to the handover trigger message, and the third receiving module 202 receives the handover required message sent by the eNB.

An acquiring module, configured to obtain a second next hop chain counter NCC and a second next hop NH, where the second NCC is the current NCC, and the second NH is the current NH;

The third sending module 203 is configured to send a forward relocation request message to the second mobility management entity MME, where the forward relocation request message carries a handover reason, so that the second MME sends a handover request message to the eNB, so that the eNB keeps The key KeNB shared between the eNB and the UE is unchanged, and the data communicated between the eNB and the UE is encrypted according to the KeNB.

Further, the handover request message carries the first NCC and the first NH, where the first NCC is obtained by adding the first MME according to the second NCC, and the first NH is calculated by the first MME according to the second NH; or The handover request message carries a second NCC and a second NH.

Further, the handover request message may further carry a handover reason.

The third receiving module 202 receives the handover required message sent by the eNB, and confirms that the handover reason is triggered by the core network according to the handover reason in the handover required message, and acquires the second {NCC, NH} pair according to the second { The NCC, NH} pairs calculate the first {NCC, NH} pair, that is, the second NCC is incremented by one to obtain the first NCC, and the first NH is calculated according to the second NH. Wherein the second {NCC, NH} pair is the current {NCC, NH} pair, or the old {NCC, NH} pair, the second {NCC, NH} pair includes the second NCC and the second NH; first { The NCC, NH} pairs are fresh {NCC, NH} pairs, and the first {NCC, NH} pair includes the first NCC and the first NH.

The second NCC is the current NCC; the second NH is the current NH.

Further, the first MME sends a forward relocation request message to the second MME, where the forward relocation request message carries the handover reason and the first {NCC, NH} pair, or the forward relocation request message carries the handover reason And the second {NCC, NH} pair. The second MME receives the forward relocation request message sent by the first MME, and sends a handover request message to the eNB.

The reason for the handover carried in the forward relocation request message is used to notify the second MME to switch to the core network triggered handover. The forward relocation request message may also carry Kasme and KSI, and the Kasme and KSI are used to derive the non-access stratum NAS key.

The second MME receives the forward relocation request message sent by the first MME, and determines that the handover is triggered by the core network according to the handover reason in the forward relocation request message, and the handover request message sent by the second MME to the eNB is not Carrying any {NCC, NH} pair information; or, if the forward relocation request message carries the first {NCC, NH} pair, the second MME receives the forward relocation request message sent by the first MME, the second MME And determining, according to the handover reason in the forward relocation request message, a handover triggered by the core network, and acquiring a first {NCC, NH} pair from the forward relocation request message, where the second MME sends the handover request message to the eNB. The first {NCC, NH} pair; or, if the forward relocation request message carries the second { NCC , NH } pair, the second MME receives the forward positioning request message sent by the first MME, and the second MME according to the The handover reason in the pre-relocation request message is determined to be a handover triggered by the core network, and the second { NCC , NH } pair is obtained from the forward relocation request message, and the second MME sends the handover request message to the eNB. Carry the second {NCC, NH} pair.

The second MME is any MME other than the first MME. In the embodiment of the present invention, the second MME is not specifically limited. For example, the second MME is a specific MME.

Further, the eNB receives the handover request message sent by the second MME, and sends a handover confirmation message to the second MME; the eNB keeps the key KeNB shared between the eNB and the UE unchanged, and performs communication between the eNB and the UE according to the KeNB. The data is encrypted.

Specifically, the eNB determines, according to the handover trigger message or the handover request message, that the handover reason is a handover triggered by the core network, acquires the KeNB shared between the current eNB and the UE, and uses the KeNB as the key KeNB* after the handover MME; The KeNB* calculates the first key and the second key, and performs encryption and integrity protection on the data communicated between the eNB and the UE by using the first key and the second key. The handover confirmation message is used to notify the second conference that the handover can be performed.

It should be noted that, if the handover request message carries the first {NCC, ΝΗ} pair, the eNB ignores the first {NCC, NH} pair and keeps the KeNB unchanged.

Further, the second MME sends a forward relocation response message to the first MME.

Further, the device further includes:

a first carrying module, configured to set a next hop indication NHI of the forward relocation request message to a preset identifier, and carry a second NCC and a second NH, or

And a second carrying module, configured to set the next hop indication NHI_old of the old evolving packet system EPS security context of the forward relocation request message to a preset identifier, and carry the second NCC and the second HN.

In the embodiment of the present invention, the eNB receives the handover trigger message sent by the first MME, and receives the handover request message sent by the second MME, and determines, according to the handover trigger message or the handover request message, that the handover reason is a handover triggered by the core network, and the eNB acquires the current The KeNB shared with the UE, and the KeNB* is used as the key KeNB* updated after the handover of the MME, that is, the KeNB between the eNB and the UE is kept unchanged, and the data communicated between the eNB and the UE is performed according to the KeNB or KeNB*. Encryption ensures that the eNB side synchronizes with the KeNB on the UE side. Example 3

Embodiments of the present invention provide a method of encrypting data. Referring to FIG. 3, the method includes: Step 301: Receive a handover trigger message sent by a first MME, where the handover trigger message carries an identifier of the UE;

Step 302: Receive a handover request message sent by the second MME.

Step 303: Keep the key KeNB shared between the eNB and the UE unchanged, and encrypt the data communicated between the eNB and the UE according to the KeNB.

In the embodiment of the present invention, the eNB receives the handover trigger message sent by the first MME, and receives the handover request message sent by the second MME, and determines, according to the handover trigger message or the handover request message, that the handover reason is a handover triggered by the core network, and the eNB acquires the current KeNB shared with the UE, and the KeNB As the key KeNB* updated after the MME is switched, that is, the KeNB between the eNB and the UE is kept unchanged, and the data communicated between the eNB and the UE is encrypted according to the KeNB or KeNB*, thereby ensuring the eNB side and the UE side. KeNB synchronization. Example 4

Embodiments of the present invention provide a method of encrypting data. Referring to FIG. 4, the method includes: Step 401: A first MME sends a handover trigger message to an eNB, where the handover trigger message carries an identifier of the UE;

Specifically, when the first MME learns that the UE needs to be handed over from the first MME of the common network to the second MME of the specific network, the first MME acquires the identifier of the UE, and sends a handover trigger message to the eNB, where the handover trigger message is sent. Carry the identity of the UE.

It should be noted that, before step 401, the UE initiates an attach procedure to the normal network and establishes a PDN connection with the S-GW or the P-GW on the network side.

Step 402: The eNB receives a handover trigger message sent by the first MME, and determines, according to the handover trigger message, that the handover reason is a handover triggered by the core network.

The eNB may determine that the handover reason is a handover triggered by the core network according to the handover trigger message sent by the first MME, and the MME that is triggered by the UE is only the MME attached by the UE. The handover is performed, and the cell and the base station where the UE is located do not change.

Step 403: The eNB sends a handover required message to the first MME, where the handover needs the message carrying the reason for the handover;

Step 404: The first MME receives a handover required message sent by the eNB, and calculates a first NCC and a first NH according to the handover required message.

Specifically, the first MME receives the handover required message sent by the eNB, and confirms that the handover reason is a handover triggered by the core network according to the handover requirement message, and acquires a second {NCC, NH} pair according to the second {NCC, NH} pair. The first {NCC, NH} pair is calculated, that is, the second NCC is incremented by one to obtain the first NCC, and the first NH is calculated based on the second NH. Wherein the second {NCC, NH} pair is the current {NCC, NH} pair, or the old {NCC, NH} pair, the second {NCC, NH} pair includes the second NCC and the second NH; first { The NCC, NH} pairs are fresh {NCC, NH} pairs, and the first {NCC, NH} pair includes the first NCC and the first NH.

The second NCC is the current NCC; the second NH is the current NH.

Step 405: The first MME sends a forward relocation request message to the second MME, where the forward relocation request message carries the handover reason and the first {NCC, NH} pair;

The reason for the handover carried in the forward relocation request message is used to notify the second MME to switch to the core network triggered handover.

Further, the forward relocation request message may further carry a Kasme and a KSI (Key Set Identifier), where the Kasme and the KSI are used to derive a non-access stratum NAS key.

Step 406: The second MME receives the forward relocation request message sent by the first MME, and sends a handover request message to the eNB.

Specifically, the second MME receives the forward relocation request message sent by the first MME, and determines, according to the handover reason in the forward relocation request message, that the handover is triggered by the core network, and the second MME sends the handover request message to the eNB. The second MME receives the forward relocation request message sent by the first MME, and the second MME is triggered by the core network according to the handover reason in the forward relocation request message. The first {NCC, NH} pair is obtained from the forward relocation request message, and the first {NCC, NH} pair is carried in the handover request message sent by the second MME to the eNB.

Further, the handover request message may further carry a handover reason.

Step 407: The eNB receives the handover request message sent by the second MME, and sends a handover confirmation message to the second MME.

The handover confirmation message is used to notify the second MME that the handover can be performed.

Step 408: The eNB keeps the key KeNB shared between the eNB and the UE unchanged, and encrypts data communicated between the eNB and the UE according to the KeNB or KeNB*.

Specifically, the eNB determines, according to the handover trigger message or the handover request message, that the handover reason is a handover triggered by the core network, acquires the KeNB shared between the current eNB and the UE, and uses the KeNB as the key KeNB* after the handover MME; The KeNB* calculates the first key and the second key, and performs encryption and integrity protection on the data communicated between the eNB and the UE by using the first key and the second key. It should be noted that, if the handover request message carries the first {NCC, NH} pair, the eNB ignores the first {NCC, NH} pair and keeps the KeNB unchanged.

Step 409: The second MME sends a forward relocation response message to the first MME.

Further, when the first {NCC, NH} pair is not carried in the handover request message, after the eNB switches the MME attached by the UE from the first MME to the second MME, the second MME sends a path change message to the eNB. The path change message carries the first { NCC , NH } pair. The eNB receives the path change message sent by the second MME, and acquires the first {NCC, NH} pair.

In the embodiment of the present invention, the eNB receives the handover trigger message sent by the first MME, and receives the handover request message sent by the second MME, and determines, according to the handover trigger message or the handover request message, that the handover reason is a handover triggered by the core network, and the eNB acquires the current The KeNB shared with the UE, and the KeNB* is used as the key KeNB* updated after the handover of the MME, that is, the KeNB between the eNB and the UE is kept unchanged, and the data communicated between the eNB and the UE is performed according to the KeNB or KeNB*. Encryption ensures that the eNB side synchronizes with the KeNB on the UE side. Example 5

Embodiments of the present invention provide a method of encrypting data. Referring to FIG. 5, the method includes: Step 501: Send a handover trigger message to an eNB, where the handover trigger message carries an identifier of the UE, so that the eNB sends a handover required message to the first MME according to the handover trigger message;

Step 502: Receive the handover required message sent by the eNB, and obtain a second NCC and a second NH, where the second NCC is the current NCC, and the second NH is the current NH;

Step 503: Send a forward relocation request message to the second MME, where the forward relocation request message carries a handover reason, so that the second MME sends a handover request message to the eNB, so that the eNB keeps the key shared between the eNB and the UE. The KeNB is unchanged, and the data communicated between the eNB and the UE is encrypted according to the KeNB.

In the embodiment of the present invention, the eNB receives the handover trigger message sent by the first MME, and receives the handover request message sent by the second MME, and determines, according to the handover trigger message or the handover request message, that the handover reason is a handover triggered by the core network, and the eNB acquires the current The KeNB shared with the UE, and the KeNB* is used as the key KeNB* updated after the handover of the MME, that is, the KeNB between the eNB and the UE is kept unchanged, and the data communicated between the eNB and the UE is performed according to the KeNB or KeNB*. Encryption ensures that the eNB side synchronizes with the KeNB on the UE side. Example 6

Embodiments of the present invention provide a method of encrypting data. Referring to FIG. 6, the method includes: Step 601: The first MME sends a handover trigger message to the eNB, where the handover trigger message carries the identifier of the UE.

It should be noted that, before step 601, the UE initiates an attach procedure to the normal network, and establishes a PDN connection with the S-GW or the P-GW on the network side.

Step 602: The eNB receives a handover trigger message sent by the first MME, and determines, according to the handover trigger message, that the handover cause is a handover triggered by the core network.

Step 603: The eNB sends a handover required message to the first MME, where the handover needs the message carrying the reason for the handover;

The reason for the handover is used to indicate that the MME to which the UE is attached is to be switched, and the reason for the handover may be any indication message. In the embodiment of the present invention, the reason for the handover is not specifically limited. For example, the reason for the handover may be a handover reason ( Core network triggered switching).

Step 604: The first MME receives the handover required message sent by the eNB, and sends a forward relocation request message to the second MME according to the handover required message.

Specifically, the first MME receives the handover required message sent by the eNB, and determines, according to the handover reason in the handover required message, that the handover is triggered by the core network, and sends a forward relocation request message to the second MME, where the forward relocation request is sent. The message carries the reason for the handover, the second {NCC, NH} pair;

Wherein the second {NCC, NH} pair is the current {NCC, NH} pair, or the old {NCC, NH} pair, the second {NCC, NH} pair includes the second NCC and the second NH; the second NCC For the current NCC; The second NH is the current NH.

Further, the forward relocation request message may further carry Kasme and KSI, and the Kasme and KSI are used to derive a non-access stratum NAS key.

Step 605: The second MME receives the forward relocation request message sent by the first MME, and sends a handover request message to the eNB.

Specifically, the second MME receives the forward relocation request message sent by the first MME, and determines, according to the handover reason in the forward relocation request message, that the handover is triggered by the core network, and the second MME sends the handover request message to the eNB. The information of the {NCC, NH} pair is not carried; or the second MME receives the forward relocation request message sent by the first MME, and the second MME determines that the handover is triggered by the core network according to the handover reason in the forward relocation request message. The second { NCC , NH } pair is obtained from the forward relocation request message, and the second { NCC , NH} pair is carried in the handover request message sent by the second MME to the eNB.

Further, the handover request message may further carry a handover reason.

The NHI (Next Hop Indicator) of the forward relocation request message is set to a preset identifier, and carries the second NCC and the second NH, or NHI_old of the forward relocation request message. (Next Hop Indicator for Old EPS (Evolved Packet System) Security Context, the next hop indication of the old EPS security context) is set as a preset identifier, and carries the second NCC and the second HN.

The preset identifier is any identifier that can identify the NHI or the NHI_old. In the embodiment of the present invention, the preset identifier is not specifically limited, for example, the preset identifier is 1.

Step 606: The eNB receives the handover request message sent by the second MME, and sends a handover confirmation message to the second MME.

Step 607: The eNB keeps the key KeNB shared between the eNB and the UE unchanged, and encrypts data communicated between the eNB and the UE according to the KeNB or KeNB*.

Specifically, the eNB determines, according to the handover trigger message or the handover request message, that the handover reason is a handover triggered by the core network, acquires a KeNB shared between the current eNB and the UE, and uses the KeNB as a cut. The key KeNB* after the MME is changed; the eNB calculates the first key and the second key according to the KeNB*, and performs encryption and integrity protection on the data communicated between the eNB and the UE by using the first key and the second key. .

It should be noted that if the handover request message carries the second {NCC, NH} pair, the eNB ignores the second {NCC, NH} pair and keeps the KeNB unchanged.

Step 608: The second MME sends a forward relocation response message to the first MME.

Further, after the eNB switches the MME to which the UE is attached from the first MME to the second MME, the second MME calculates a first {NCC, NH} pair according to the second {NCC, NH} pair, and the second MME sends a path change. The message is sent to the eNB, and the path change message carries the first {NCC, NH} pair. The eNB receives the path change message sent by the second MME, and acquires the first {NCC, NH} pair.

The second MME adds the second NCC to obtain the first NCC, and calculates the first NH according to the second NH, the second {NCC, NH} pair is the current {NCC, NH} pair, and the second {NCC, NH The pair includes a second NCC and a second NH; the first {NCC, NH} pair is a fresh {NCC, NH} pair, and the first {NCC, NH} pair includes the first NCC and the first NH.

In the embodiment of the present invention, the eNB receives the handover trigger message sent by the first MME, and receives the handover request message sent by the second MME, and determines, according to the handover trigger message or the handover request message, that the handover reason is a handover triggered by the core network, and the eNB acquires the current The KeNB shared with the UE, and the KeNB* is used as the key KeNB* updated after the handover of the MME, that is, the KeNB between the eNB and the UE is kept unchanged, and the data communicated between the eNB and the UE is performed according to the KeNB or KeNB*. Encryption ensures that the eNB side synchronizes with the KeNB on the UE side. Example 7

Embodiments of the present invention provide an apparatus for encrypting data. Referring to Figure 7, the apparatus includes: a first memory 701 and a first processor 702 for performing the following method of encrypting data:

Receiving a handover request message sent by the second MME;

The key KeNB shared between the evolved base station eNB and the UE is kept unchanged, and the data communicated between the eNB and the UE is encrypted according to the KeNB.

Further, after receiving the handover trigger message sent by the first mobility management entity MME, the method further includes:

Determining, according to the handover trigger message, that the handover reason is a handover triggered by the core network; Sending a handover request message to the first MME, the handover request message carrying the handover reason, and causing the first MME to send a forward relocation request message to the second MME, the forward relocation request message Carrying the handover reason, so that the second MME sends the handover request message to the eNB.

Further, the handover request message carries a first next hop chain counter NCC and a first next hop NH, where the first NCC is obtained by adding the first MME according to the second NCC, and the first NH is the first MME according to the first Calculated by the second NH, the second NCC is the current NCC, and the second NH is the current NH; or

Further, the forward relocation request message carries a first next hop chain counter NCC and a first next hop NH, where the first NCC is obtained by adding the first NMC according to the second NCC. The first NH is calculated by the first MME according to the second NH, the second NCC is the current NCC, and the second NH is the current NH; or

Further, the key KeNB shared between the evolved base station eNB and the UE is unchanged, and includes:

According to the handover trigger message or the handover request message, it is determined that the handover reason is a handover triggered by the core network, and the KeNB is kept unchanged.

In the embodiment of the present invention, the eNB receives the handover trigger message sent by the first MME, and receives the handover request message sent by the second MME, and determines, according to the handover trigger message or the handover request message, that the handover reason is a handover triggered by the core network, and the eNB acquires the current The KeNB shared with the UE, and the KeNB* is used as the key KeNB* updated after the handover of the MME, that is, the KeNB between the eNB and the UE is kept unchanged, and the data communicated between the eNB and the UE is performed according to the KeNB or KeNB*. Encryption ensures that the eNB side synchronizes with the KeNB on the UE side. Example 8

Embodiments of the present invention provide an apparatus for encrypting data. Referring to Figure 8, the apparatus includes: a second memory 801 and a second processor 802 for performing the following method of encrypting data:

Sending a handover trigger message to the evolved base station eNB, where the handover trigger message carries the user equipment UE The identifier, the eNB sends a handover required message to the first mobility management entity MME according to the handover trigger message;

Sending a forward relocation request message to the second MME, where the forward relocation request message carries a handover reason, so that the second MME sends a handover request message to the eNB, so that the eNB keeps the key KeNB shared between the eNB and the UE unchanged. And encrypting data communicated between the eNB and the UE according to the KeNB.

Further, the handover request message carries the first NCC and the first NH, where the first NCC is obtained by adding the first MME according to the second NCC, and the first NH is calculated by the first MME according to the second NH; or

The handover request message carries a second NCC and a second NH.

Further, the forward relocation request message carries the first NCC and the first NH, and the first NCC is obtained by the first MME according to the second NCC, and the first NH is calculated by the first MME according to the second NH; Or,

Further, before sending the forward relocation request message to the second mobility management entity MME, the method further includes:

Setting a next hop indication NHI of the forward relocation request message to a preset identifier, and carrying the second NCC and the second NH, or

The next hop indication NHI_old of the old evolved packet system EPS security context of the forward relocation request message is set to a preset identifier, and carries the second NCC and the second HN.

In the embodiment of the present invention, the eNB receives the handover trigger message sent by the first MME, and receives the handover request message sent by the second MME, and determines, according to the handover trigger message or the handover request message, that the handover reason is a handover triggered by the core network, and the eNB acquires the current The KeNB shared with the UE, and the KeNB* is used as the key KeNB* updated after the handover of the MME, that is, the KeNB between the eNB and the UE is kept unchanged, and the data communicated between the eNB and the UE is performed according to the KeNB or KeNB*. Encryption ensures that the eNB side synchronizes with the KeNB on the UE side. A person of ordinary skill in the art may understand that all or part of the steps of implementing the above embodiments may be completed by hardware, or may be instructed by a program to execute related hardware, and the program may be stored in In a computer readable storage medium, the above mentioned storage medium may be a read only memory, a magnetic disk or an optical disk or the like.

The above is only the preferred embodiment of the present invention, and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., which are within the spirit and scope of the present invention, should be included in the protection of the present invention. Within the scope.

Claims

claims

1. A device for encrypting data, characterized in that the device includes:

The first receiving module is configured to receive a handover trigger message sent by the first mobility management entity MME, where the handover trigger message carries the identity of the user equipment UE;

The second receiving module is configured to receive the handover request message sent by the second MME;

A maintenance module, used to keep the key KeNB shared between the evolved base station eNB and the UE unchanged;

An encryption module, configured to encrypt data communicated between the eNB and the UE according to the KeNB.

2. The device according to claim 1, characterized in that, the device further includes:

A determination module, configured to determine, according to the handover trigger message, that the cause of the handover is a handover triggered by the core network;

The first sending module is configured to send a handover need message to the first MME, where the handover need message carries the handover reason, so that the first MME sends a forward relocation request message to the second MME, so The forward relocation request message carries the handover reason, so that the second MME sends the handover request message to the eNB.

3. The apparatus according to claim 1, wherein the handover request message carries a first next hop chain counter NCC and a first next hop NH, and the first NCC is the first MME according to the first Obtained by adding one to two NCCs, the first NH is calculated by the first MME based on the second NH, the second NCC is the current NCC, and the second NH is the current NH; or, The handover request message carries a second next hop chain counter NCC and a second next hop NH, the second NCC is the current NCC, and the second NH is the current NH.

4. The device of claim 2, wherein the forward relocation request message carries a first next hop chain counter NCC and a first next hop NH, and the first NCC is the first The MME is obtained by adding one according to the second NCC, the first NH is calculated by the first MME according to the second NH, the second NCC is the current NCC, and the second NH is the current NH; or, The forward relocation request carries a second next hop chain counter NCC and a second next hop NH, the second NCC is the current NCC, and the second NH is the current NH.

5. The device according to claim 1, wherein the holding module includes: a determining unit configured to determine, according to the handover trigger message or the handover request message, that the handover cause is a handover triggered by the core network;

A holding unit, used to keep the KeNB unchanged.

6. A device for encrypting data, characterized in that the device includes:

The second sending module is configured to send a handover trigger message to the evolved base station eNB. The handover trigger message carries the identity of the user equipment UE, so that the eNB sends a handover requirement message to the first mobility management entity according to the handover trigger message. MME;

A third receiving module, configured to receive the handover requirement message sent by the eNB;

Acquisition module, used to obtain the second next hop chain counter NCC and the second next hop NH, the second NCC is the current NCC, and the second NH is the current NH;

The third sending module is configured to send a forward relocation request message to the second mobility management entity MME, where the forward relocation request message carries a handover reason, so that the second MME sends a handover request message to the eNB, So that the eNB keeps the key KeNB shared between the eNB and the UE unchanged, and encrypts the data communicated between the eNB and the UE according to the KeNB.

7. The apparatus according to claim 6, wherein the handover request message carries a first NCC and a first NH, and the first NCC is obtained by adding one to the second NCC by the first MME. , the first NH is calculated by the first MME based on the second NH; or, the handover request message carries the second NCC and the second NH.

8. The apparatus according to claim 6, wherein the forward relocation request message carries a first NCC and a first NH, and the first NCC is added by the first MME according to the second NCC. Obtained later, the first NH is calculated by the first MME based on the second NH; or,

9. The device according to claim 6, wherein the device further includes: a first carrying module configured to set the next hop indication NHI of the forward relocation request message as a preset identifier, and carrying the second NCC and the second NH, or,

A second carrying module, configured to set the next hop indication NHI_old of the old Evolved Packet System EPS security context of the forward relocation request message as the preset identifier, and carry the second NCC and the second HN.

10. A method of encrypting data, characterized in that the method includes:

Receive a handover trigger message sent by the first mobility management entity MME, where the handover trigger message carries the identity of the user equipment UE;

Receive the handover request message sent by the second MME;

Keep the key KeNB shared between the evolved base station eNB and the UE unchanged, and encrypt data communicated between the eNB and the UE according to the KeNB.

11. The method according to claim 10, after receiving the handover trigger message sent by the first mobility management entity MME, the method further includes:

Determine according to the handover trigger message that the cause of the handover is a handover triggered by the core network;

Send a handover need message to the first MME. The handover need message carries the handover reason, causing the first MME to send a forward relocation request message to the second MME. The forward relocation request message The handover reason is carried, so that the second MME sends the handover request message to the eNB.

12. The method of claim 10, wherein the handover request message carries a first next hop chain counter NCC and a first next hop NH, and the first NCC is the first MME according to the first Two NCCs are obtained by adding one, the first NH is calculated by the first MME according to the second NH, the second NCC is the current NCC, and the second NH is the current NH; or,

13. The method of claim 11, wherein the forward relocation request message carries a first next hop chain counter NCC and a first next hop NH, and the first NCC is the first The MME is obtained by adding one according to the second NCC, the first NH is calculated by the first MME according to the second NH, the second NCC is the current NCC, and the second NH is the current NH; or,

14. The method of claim 10, wherein keeping the key KeNB shared between the evolved base station eNB and the UE unchanged includes:

It is determined according to the handover trigger message or the handover request message that the cause of the handover is a handover triggered by the core network, and the KeNB remains unchanged.

15. A method of encrypting data, characterized in that the method includes:

Send a handover trigger message to the evolved base station eNB, where the handover trigger message carries the identity of the user equipment UE, so that the eNB sends a handover requirement message to the first mobility management entity MME according to the handover trigger message;

Receive the handover requirement message sent by the eNB, and obtain a second next hop chain counter NCC and a second next hop NH, where the second NCC is the current NCC and the second NH is the current NH; Send a forward relocation request message to the second MME. The forward relocation request message carries the handover reason, causing the second MME to send a handover request message to the eNB, so that the eNB maintains the relationship between the eNB and the eNB. The key KeNB shared between the UEs remains unchanged, and the KeNB encrypts the data communicated between the eNB and the UE.

16. The method of claim 15, wherein the handover request message carries a first NCC and a first NH, and the first NCC is obtained by adding one to the second NCC by the first MME. , the first NH is calculated by the first MME based on the second NH; or,

The handover request message carries the second NCC and the second NH.

17. The method of claim 15, wherein the forward relocation request message Carrying the first NCC and the first NH, the first NCC is obtained by adding one to the second NCC by the first MME, and the first NH is calculated by the first MME according to the second NH. obtained; or,

18. The method of claim 15, wherein before sending the forward relocation request message to the second mobility management entity MME, the method further includes:

Set the next hop indication NHI of the forward relocation request message as a preset identifier and carry the second NCC and the second NH, or,

Set the next hop indication NHI_old of the old Evolved Packet System EPS security context of the forward relocation request message as the preset identifier, and carry the second NCC and the second HN.

19. A device for encrypting data, characterized in that the device includes: a first memory and a first processor, configured to execute the method of encrypting data according to any one of claims 11-14.

20. A device for encrypting data, characterized in that the device includes: a second memory and a second processor, configured to execute the method of encrypting data according to any one of claims 15 to 18.