WO2015131379A1 - Procédé de protection d'informations, station de base, équipement utilisateur et entité de gestion de mobilité - Google Patents

Procédé de protection d'informations, station de base, équipement utilisateur et entité de gestion de mobilité Download PDF

Info

Publication number
WO2015131379A1
WO2015131379A1 PCT/CN2014/073008 CN2014073008W WO2015131379A1 WO 2015131379 A1 WO2015131379 A1 WO 2015131379A1 CN 2014073008 W CN2014073008 W CN 2014073008W WO 2015131379 A1 WO2015131379 A1 WO 2015131379A1
Authority
WO
WIPO (PCT)
Prior art keywords
key
information
mme
integrity protection
rrc connection
Prior art date
Application number
PCT/CN2014/073008
Other languages
English (en)
Chinese (zh)
Inventor
应江威
许怡娴
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to CN201480001772.5A priority Critical patent/CN105191479A/zh
Priority to PCT/CN2014/073008 priority patent/WO2015131379A1/fr
Publication of WO2015131379A1 publication Critical patent/WO2015131379A1/fr

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/03—Protecting confidentiality, e.g. by encryption
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/041—Key generation or derivation
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/60—Context-dependent security

Definitions

  • the present invention relates to the field of communications, and in particular, to an information protection method, a base station, a user equipment, and a mobility management entity.
  • M2M Machine to Machine
  • the M2M device can be a UE (User Equipment) with M2M features.
  • M2M devices can access GSM
  • EUTRAN Evolved Universal Terrestrial Radio Access Network
  • M2M servers or other M2M devices communicate with M2M servers or other M2M devices to implement M2M applications.
  • small data transmission is more and more, for example: In the period when no business data occurs, in order to maintain the connection with the server, it is necessary to interact with the server to keep alive messages. Or called a heat beat message.
  • the services supported by the M2M service may periodically report the small data detected by the service to the service network.
  • the UE when the UE has no data service interaction with the network side, the UE will be in an idle state, and when the UE needs to send a data packet to the network side or needs to accept the network side
  • an RRC (Radio Resource Control) connection is established, and a service request procedure is initiated to the network side to enable the UE to enter a connection state before sending or receiving a data packet.
  • the air interface needs at least 7 RRC signaling, and the security negotiation and bearer establishment signaling of the S1 interface are also considered, so that the transmission efficiency of the data packet is low, and the network resource is occupied more.
  • an M2M small data transmission scheme aimed at simplifying air interface signaling is generated: that is, combined air interface signaling.
  • the network side transmits some important sensitive information (SRB (Signle Radio Broadcast) and DRB (Data Radio Broadcast) configuration information to the UE.
  • SRB Signal Radio Broadcast
  • DRB Data Radio Broadcast
  • the AS Access Stratum Security Mode Command
  • the eNB the evolved Node B, the evolved mobile base station
  • the UE only successfully authenticates. Subsequent received messages are decrypted only after the AS SMC message.
  • the problem is that in the M2M small data signaling process, the AS SMC message that activates the AS security is sent to the UE through the RRC Connection Setu together with the SRB and the DRB configuration information, so the RRC Connection Setu message at this time is not secured.
  • the encryption protection of the AS is also not enabled. According to the requirements, the above sensitive information needs to be protected by encryption and integrity. Therefore, the existing security mechanism cannot protect the secure transmission of sensitive information.
  • the present invention provides an information protection method, device, and system, and provides a mechanism for protecting specified information, which can protect specified information in a wireless connection establishment process, thereby implementing secure delivery of specified information.
  • an information protection method comprising:
  • Radio resource control RRC connection request receives, by the user equipment, a radio resource control RRC connection request, where the RRC connection request includes a service request and a fast service request indication;
  • the initial user information includes the service request and the fast service request indication
  • the fast service request indication in the RRC connection request is used to instruct the base station to perform security protection on the specified information
  • the fast service request indication in the initial user information is used to instruct the MME to deliver the security context to the base station.
  • the initial context setup request received from the MME includes:
  • the protecting the specified information to generate the protected file includes:
  • the RRC connection setup message that includes the protected information, where the RRC connection setup message further includes the small data message verification code, the small data anti-replay value, and a security mode command; or ,
  • the RRC connection setup message that includes the protected information, where the RRC connection setup message further includes the anti-replay value and the security mode Order, message verification code.
  • the RRC connection request received from the user equipment further includes a user temporary value, the user temporary value being used to generate an encryption key and an integrity protection key;
  • the initial user information sent to the MME further includes the user temporary value;
  • the initial context establishment request received from the MME includes: an encryption key, an integrity protection key, and an MME temporary value, the MME temporary value And for generating the encryption key and the integrity protection key.
  • the securing the specified information to generate the protected information, and sending the protected information to the user equipment includes:
  • the encryption key, and the integrity protection key to securely protect the specified information, generate the protected information, and generate a small data message verification code correspondingly;
  • the RRC connection setup message including the protected information, where the RRC connection setup message includes the small data message verification code and the protected information and security mode command;
  • the sending the initial user information to the mobility management entity MME includes:
  • the initial user information including a service request to acquire the security context from the MME.
  • the security protection of the specified information to generate the protected information, and the sending the RRC connection setup message including the protected information to the user equipment includes:
  • the RRC connection setup message including the protected information, where the RRC connection setup message further includes a security mode command and a message verification code.
  • the initial user information further includes a fast service request indication
  • the initial context setup request received from the MME includes a fast service request grant indication, which is sent by the MME after the MME determines that the user equipment is allowed to fast service.
  • the initial context setup request received from the MME includes:
  • the public key and the common algorithm are obtained and sent by the MME from the key server after the initial user information is sent to the MME.
  • the performing the security protection on the specified information to generate the protected information, and sending the protected information to the user equipment includes:
  • the RRC connection setup message that includes the protected information, where the RRC connection setup message includes a security mode command and the message verification code; or Performing integrity protection on the RRC connection setup message by using the RRC integrity protection key, and generating a message verification code;
  • the RRC connection setup message including the protected information, where the RRC connection setup message includes the message verification code and a security mode command.
  • an information protection method comprising:
  • the fast service request indication is used to instruct the base station to perform security protection on the specified information.
  • the RRC connection setup message received from the base station further includes a small data message verification code, a small data anti-replay value, and the protected information, where the security mode is Commands include message authentication codes and protection algorithms and security mode commands.
  • the verifying the RRC connection setup message, and decrypting the protected information after the verification succeeds, to obtain the specified information includes: :
  • the encryption key and the integrity protection key are generated by the MME in the authentication and key agreement process according to the preset original key and the random value RAND in the authentication vector. Integrity protection key; or,
  • the encryption key and the integrity protection key are obtained by the MME after the authentication and key agreement process, according to a preset original key and a small data temporary value generated by the MME.
  • Key and the integrity protection key wherein
  • the preset original key includes Kasme, and the small data temporary value is included in the non-access stratum security mode command.
  • the RRC connection request sent to the base station includes a user temporary value; the RRC connection setup message received from the base station includes an MME temporary value; and an encryption key is generated according to the user temporary value and the MME temporary value.
  • the integrity protection key includes:
  • the RRC connection setup message that includes the protected information received from the base station further includes a security mode command and a message verification code; Protection algorithm
  • the verifying the RRC connection setup message including the protected information, and decrypting the protected information after the verification succeeds to obtain the specified information includes:
  • the verifying the RRC connection setup message that includes the protected information, and decrypting the protected information after the verification succeeds to obtain the specified information includes:
  • the protection information is decrypted to obtain the prescribed information; the private key and the common algorithm are preset on the user equipment.
  • an information protection method comprising:
  • the initial user information includes the service request and the fast service request indication
  • the fast service request indication is used to instruct the MME to deliver the security context to the base station.
  • the initial context establishment request sent to the base station includes an encryption key, an integrity protection key, and security of a user equipment.
  • the small data anti-replay value is an anti-replay value used for small data transmission
  • the small data anti-replay value includes an encryption anti-replay value and an integrity protection anti-replay value ;
  • the encryption key and the integrity protection key are generated by the user equipment in the authentication and key agreement process according to the preset original key and the random value RAND in the authentication vector. And the integrity protection key; or
  • the encryption key and the integrity protection key are generated by the user equipment according to a preset original key and the MME after the authentication and key agreement process.
  • the small data temporary value acquires the encryption key and the integrity protection key; wherein the preset original key includes Kasme, and the small data temporary value generated by the MME is included in a non-access layer security mode command. .
  • the initial user information received from the base station further includes a user temporary value; the user temporary value is used to generate an encryption key and an integrity protection key.
  • the method before the sending an initial context setup request to the base station, the method further includes:
  • the MME temporary value is generated, and the encryption key and the integrity protection key are obtained according to the preset original key, the user temporary value, and the MME temporary value.
  • the initial context setup request sent to the base station includes the encryption key, the integrity protection key, and the MME temporary value.
  • the initial user information includes the service request and the fast service request indication
  • the method further includes:
  • the initial context establishment request sent to the base station includes a fast service request permission indication.
  • the method further includes:
  • the public key and the common algorithm are included in the initial context establishment request sent by the base station.
  • a base station where the base station includes:
  • a receiving unit configured to receive, by the user equipment, a radio resource control RRC connection request, where the RRC connection request includes a service request and a fast service request indication;
  • a sending unit configured to send initial user information to the mobility management entity MME, where the initial user information is used to request the MME to send a security context;
  • the receiving unit is further configured to receive, from the MME, an initial context setup request including the security context;
  • An encryption unit configured to perform security protection on the specified information by using the security context, to generate the protected information
  • the sending unit is further configured to send an RRC connection setup message including the protected information to the user equipment.
  • the initial user information includes the service request and the fast service request indication
  • the fast service request indication in the RRC connection request is used to instruct the base station to perform security protection on the specified information
  • the fast service request indication in the initial user information is used to instruct the MME to deliver the security context to the base station.
  • the initial context establishment request that is received by the receiving unit from the MME includes:
  • the encryption key and the integrity protection key are negotiated by the user equipment and the MME in an authentication and key agreement process; or
  • the encryption key and the integrity protection key are after the authentication and key agreement process, and are negotiated by the user equipment and the MME before the user equipment sends the fast service request.
  • the encryption unit is specifically configured to select a protection algorithm, and use the protection algorithm, the encryption key, and the integrity protection key to protect specified information, generate the protected information, and generate a small data message verification correspondingly. code;
  • the cryptographic unit is further configured to perform integrity protection on the protection algorithm by using an RRC integrity protection key, and generate a message verification code correspondingly;
  • the sending unit is further configured to send, to the user equipment, the RRC connection setup message that includes the protected information, where the RRC connection setup message includes the small data message verification code, and the small data anti-replay And the security mode command; or the encryption unit is further configured to perform integrity protection on the RRC connection setup message by using the RRC integrity protection key and the protection algorithm to generate the message verification code;
  • the sending unit is further configured to send the RRC connection setup message that includes the protected information to the user equipment, where the RRC connection setup message further includes the anti-replay value, a security mode command, Message verification code.
  • the RRC connection request received by the receiving unit from the user equipment further includes a user temporary value, where the user temporary value is used to generate an encryption key and an integrity protection key; the sending unit sends the The initial user information also includes the user temporary value;
  • the initial context setup request received from the MME includes: an encryption key, a integrity protection key, and an MME temporary value, the MME temporary value being used to generate the encryption key and the integrity protection key.
  • the encryption unit is further configured to: select a protection algorithm; use the protection algorithm, the encryption key, and the integrity protection key to perform security protection on the specified information, generate the protected information, and generate a small data message correspondingly Verification code;
  • the cryptographic unit is further configured to perform integrity protection on the MME temporary value and the protection algorithm by using a RRC integrity protection key, and generate a message verification code correspondingly; or
  • the cryptographic unit is further configured to perform integrity protection on the RRC connection setup message by using the RRC integrity protection key and the protection algorithm to generate the message authentication code.
  • the sending unit is further configured to send the RRC connection setup message to the user equipment, where the RRC connection setup message includes the protected information and a security mode command.
  • the sending unit further includes:
  • an identifying unit configured to identify, according to the fast service request indication in the RRC connection request, that the current service request is a fast service request
  • an information sending unit configured to send the initial user information to the MME, where the initial user information includes a service request, to obtain the security context from the MME.
  • the cryptographic unit is further configured to perform integrity protection on the RRC connection setup message according to the RRC integrity protection key and the protection algorithm to generate a message verification code.
  • the encryption unit is further configured to perform security protection on the specified information according to the RRC encryption key and the protection algorithm to generate the protected information.
  • the sending unit is further configured to send, to the user equipment, the RRC connection setup message including the protected information interruption, where the RRC connection setup message further includes a security mode command and a message verification code.
  • the initial user information further includes a fast service request indication
  • the initial context setup request that is further used by the receiving unit to receive the MME includes a fast service request permission indication, where the initial context setup request is sent by the MME after the MME determines that the user equipment is allowed to fast service. of.
  • the initial context establishment request that is received by the receiving unit from the MME includes:
  • the public key and the common algorithm are obtained and sent by the MME from the key server after the initial user information is sent to the MME.
  • the encryption unit is further configured to perform encryption protection on the specified information by using the public key and the public algorithm to generate the protected information.
  • the encryption unit is further configured to perform integrity protection on the specified information by using an RRC integrity protection key, and generate a message verification code;
  • the sending unit is further configured to send, to the user equipment, the RRC connection setup message that includes the protected information, where the RRC connection setup message further includes a security mode command and the message verification code; or
  • the cryptographic unit is further configured to perform integrity protection on the RRC connection establishment message by using the RRC integrity protection key, and generate a message verification code.
  • the sending unit is further configured to send the RRC connection setup message that includes the protected information to the user equipment, where the RRC connection setup message further includes a message authentication code and a security mode command.
  • a fifth aspect provides a user equipment, where the user equipment includes:
  • a sending unit configured to send a radio resource control RRC connection request to the base station, where the RRC connection request includes a service request and a fast service request indication;
  • a receiving unit configured to receive, by the base station, an RRC connection setup message including the protected information, where the RRC connection setup message includes the protected information;
  • a decryption unit configured to verify the RRC connection establishment message including the protected information, and decrypt the protected information to obtain prescribed information after the verification succeeds.
  • the fast service request indication is used to instruct the base station to perform security protection on the specified information.
  • the receiving unit is The RRC connection setup message received by the base station further includes a small data message verification code, a small data anti-replay value, the protected information, and a security mode command; the security mode command includes a cancellation, a verification code, and a protection algorithm.
  • the key negotiation unit is configured to perform, according to the preset original key, with an MME in an authentication and key agreement process.
  • the random value RAND in the authentication vector generates the encryption key and the integrity protection key; or
  • the key negotiation unit is configured to acquire, after the authentication and key negotiation process, the encryption key and the integrity according to a preset original key and a small data temporary value generated by the MME.
  • the protection key wherein the preset original key includes Kasme, and the small data temporary value is included in a non-access stratum security mode command.
  • the RRC connection request sent by the sending unit to the base station includes a user temporary value
  • the RRC connection setup message received by the receiving unit from the base station includes an MME temporary value
  • Generating an encryption key and a integrity protection key according to the user temporary value and the MME temporary value include:
  • the decrypting unit is specifically configured to:
  • the RRC connection setup message including the protected information received by the receiving unit from the base station further includes a security mode command and a message verification code;
  • the security mode command includes the protection algorithm;
  • the decrypting unit is further configured to generate the RRC integrity protection key and the RRC encryption key according to the protection algorithm, and verify the message verification code according to the RRC integrity protection key, and After the verification is successful, the protected information is decrypted according to the RRC encryption key to obtain the prescribed information.
  • the decrypting unit is further configured to:
  • the sixth aspect provides a mobility management entity, where the mobility management entity includes: a receiving unit, configured to receive initial user information from a base station, where the initial user information is used to request the MME to deliver a security context;
  • a sending unit configured to send an initial context establishment request including the security context to the base station, so that the base station performs security protection on the specified information according to the security information in the initial context establishment request.
  • the initial user information includes the service request and the fast service request indication
  • the fast service request indication is used to instruct the MME to deliver the security context to the base station.
  • the initial context establishment request sent by the sending unit to the base station includes an encryption key, an integrity protection key,
  • the security capability of the user equipment and the small data anti-replay value the small data anti-replay value is an anti-replay value used for small data transmission.
  • the small data anti-replay value includes an encryption anti-playback value and an integrity protection anti-playback value.
  • the mobility management entity further includes a key negotiation unit, where the key negotiation unit is used in the authentication and key agreement process. Neutifying the user equipment to generate the encryption key and the integrity protection key according to the preset original key and a random value RAND in the authentication vector; or
  • the key agreement unit is configured to acquire the encryption key and the user equipment according to the preset original key and the small data temporary value generated by the MME after the authentication and key agreement process.
  • the integrity protection key wherein the preset original key includes Kasme, and the small data temporary value generated by the MME is included in a non-access stratum security mode command.
  • the initial user information received by the receiving unit from the base station further includes a user temporary value; the user temporary value is used to generate an encryption key and integrity Protect the key.
  • the mobility management entity further includes:
  • a determining unit configured to determine whether to allow a fast service request of the user equipment before the sending the initial context establishment request to the base station;
  • the MME temporary value is generated, and the encryption key and the integrity protection key are obtained according to the preset original key, the user temporary value, and the MME temporary value.
  • the initial context setup request sent by the sending unit to the base station includes the encryption key, the integrity protection secret Key and the MME temporary value.
  • the initial user information includes the service request and the fast service request indication
  • the mobility management entity Before the sending the initial context setup request to the base station, the mobility management entity further includes:
  • a determining unit configured to send an initial context setup request to the base station Before, determine whether to allow fast service requests from user devices;
  • the initial context establishment request sent to the base station includes a fast service request permission indication.
  • the sending unit is further configured to send a user identifier of the user equipment to the key server to request to use a public key and a common algorithm corresponding to the user equipment; the public key and the public algorithm are preset in the secret On the key server;
  • the receiving unit is further configured to receive the public key and the public algorithm from the key server, and include the public key and a common algorithm in the initial context establishment request sent to the base station.
  • a base station in a seventh aspect, includes: a bus, and a processor, a memory, and an interface connected to the bus, wherein the interface is configured to communicate with other network elements; the memory is configured to store an instruction; The instructions are executed for:
  • Radio resource control RRC connection request receives, by the user equipment, a radio resource control RRC connection request, where the RRC connection request includes a service request and a fast service request indication;
  • the initial user information includes the service request and the fast service request indication
  • the fast service request indication in the RRC connection request is used to instruct the base station to perform security protection on the specified information
  • the fast service request indication in the initial user information is used to instruct the MME to deliver the security context to the base station.
  • the initial context setup request received from the MME includes: An encryption key, an integrity protection key, a security capability of the user equipment, and a small data anti-replay value, the small data anti-replay value including an encryption anti-replay value and an integrity protection anti-replay value;
  • the encryption key and the integrity protection key are negotiated by the user equipment and the MME in an authentication and key agreement process; or
  • the encryption key and the integrity protection key are after the authentication and key agreement procedure and are negotiated by the user equipment and the MME before the user equipment sends the fast service request.
  • the processor executes the
  • the RRC connection setup message that includes the protected information, where the RRC connection setup message further includes the small data message verification code, the small data anti-replay value, and a security mode command; or ,
  • the RRC connection setup message that includes the protected information, where the RRC connection setup message further includes the anti-replay value, a security mode command, and a message verification code.
  • the processor is configured to:
  • the RRC connection request received from the user equipment further includes a user temporary value, the user temporary value being used to generate an encryption key and an integrity protection key;
  • the initial user information sent to the MME further includes the user temporary value.
  • the initial context setup request received from the MME includes:
  • An encryption key, an integrity protection key, and an MME temporary value being used to generate the encryption key and the integrity protection key.
  • the processor is configured to:
  • the encryption key, and the integrity protection key to securely protect the specified information, generate the protected information, and generate a small data message verification code correspondingly;
  • the RRC connection setup message including the protected information, where the RRC connection setup message includes the small data message verification code and the protected information and security mode command;
  • the processor is configured to:
  • the initial user information including a service request to acquire the security context from the MME.
  • the processor is configured to:
  • the RRC connection setup message including the protected information, where the RRC connection setup message further includes a security mode command and a message verification code.
  • the initial user information further includes a fast service request indication
  • the initial context setup request received from the MME includes a fast service request grant indication, which is sent by the MME after the MME determines that the user equipment is allowed to fast service.
  • the initial context setup request received from the MME includes:
  • the public key and the common algorithm are obtained and sent by the MME from the key server after the initial user information is sent to the MME.
  • the processor is configured to:
  • the RRC connection setup message that includes the protected information, where the RRC connection setup message further includes a security mode command and the message authentication code;
  • the RRC connection setup message including the protected information, where the RRC connection setup message further includes a message verification code and a security mode command.
  • a user equipment comprising: a bus, and a processor, a memory and an interface connected to the bus, wherein the interface is used for other networks
  • the processor is configured to: send a radio resource control RRC connection request to the base station, where the RRC connection request includes a service request and a fast service request indication;
  • the fast service request indication is used to instruct the base station to perform security protection on the specified information.
  • the RRC connection setup message received from the base station further includes a small data message verification code, a small data anti-replay value, the protected information, and a security mode command;
  • the security mode command includes a message verification code and a protection algorithm.
  • the processor executes the
  • the encryption key and the integrity protection key are generated by the MME in the authentication and key agreement process according to the preset original key and the random value RAND in the authentication vector. Integrity protection key; or,
  • the encryption key and the integrity protection key are obtained by the MME after the authentication and key agreement process, according to a preset original key and a small data temporary value generated by the MME.
  • Key and the integrity protection key wherein the preset original key includes Kasme, and the small data temporary value is included in a non-access stratum security mode command.
  • the processor is configured to:
  • the RRC connection request sent to the base station includes a user temporary value; the RRC connection setup message received from the base station includes an MME temporary value; Generating an encryption key and an integrity protection key according to the user temporary value and the MME temporary value include:
  • the processor is configured to:
  • the RRC connection setup message received from the base station includes protected information, a security mode command, and a message verification code;
  • the security mode command includes the protection algorithm;
  • the processor executes the instruction for The protection algorithm generates the RRC integrity protection key and the RRC encryption key, and verifies the message verification code according to the RRC integrity protection key, and according to the RRC encryption key after successful verification Decrypting the protected information to obtain the prescribed information.
  • the processor is configured to:
  • a mobility management entity includes: And a processor, memory and interface connected to the bus, wherein the interface is for communicating with other network elements; the memory is for storing instructions; the processor executing the instructions for:
  • the initial user information includes the service request and the fast service request indication
  • the fast service request indication is used to instruct the MME to deliver the security context to the base station.
  • the initial context establishment request sent to the base station includes an encryption key, an integrity protection key, and security of a user equipment.
  • the small data anti-replay value is an anti-replay value used for small data transmission
  • the small data anti-replay value includes an encryption anti-replay value and an integrity protection anti-replay value ;
  • the encryption key and the integrity protection key are generated by the user equipment in the authentication and key agreement process according to the preset original key and the random value RAND in the authentication vector. And the integrity protection key; or
  • the encryption key and the integrity protection key are obtained by the user equipment after the authentication and key agreement process, according to a preset original key and a small data temporary value generated by the MME.
  • the initial user information received from the base station further includes a user temporary value; the user temporary value is used to generate an encryption key and an integrity protection key.
  • the processor executes the instruction for:
  • the MME temporary value is generated, and the encryption key and the integrity protection key are obtained according to the preset original key, the user temporary value, and the MME temporary value.
  • the initial context setup request sent to the base station includes the encryption key, the integrity protection key, and the MME temporary value.
  • the initial user information includes the service request and the fast service request indication
  • the processor executes the instructions for:
  • the method further includes:
  • the initial context establishment request sent to the base station includes a fast service request permission indication.
  • the processor is configured to:
  • Receiving the public key and the common algorithm from the key server, the public key and the public algorithm are included in the initial context establishment request sent to the base station.
  • An embodiment of the present invention provides an information protection method, device, and system, where a user equipment sends an RRC connection request to a base station, and after receiving an initial context connection request sent by the MME, the base station and the algorithm according to the initial context connection request indication key and algorithm pair
  • the specified information is protected to generate the protected information
  • the RRC connection setup message including the protected information is sent to the user equipment, and then the user equipment verifies the RRC connection setup message and
  • the protected information is decrypted to obtain the specified information. Therefore, a mechanism for protecting the specified information is provided, and the specified information can be protected in the wireless connection establishment process, thereby realizing the secure delivery of the specified information.
  • FIG. 1 is a schematic flowchart of an information protection method according to an embodiment of the present invention
  • FIG. 2 is a schematic flowchart of an information protection method according to an embodiment of the present invention
  • FIG. 3 is an information protection method according to an embodiment of the present invention
  • FIG. 4 is a schematic flowchart of an information protection method according to an embodiment of the present invention
  • FIG. 4 is a schematic diagram of a key negotiation process in an information protection method according to an embodiment of the present invention
  • FIG. 4b is a schematic diagram of another key negotiation process in an information protection method according to an embodiment of the present disclosure.
  • FIG. 5 is a schematic flowchart of an information protection method according to an embodiment of the present invention
  • FIG. 6 is a schematic flowchart of an information protection method according to an embodiment of the present invention
  • FIG. Figure 8 is a schematic flowchart of an information protection method according to an embodiment of the present invention
  • Figure 9 is a schematic structural diagram of a base station according to an embodiment of the present invention.
  • FIG. 10 is a schematic structural diagram of a base station according to an embodiment of the present disclosure.
  • FIG. 11 is a schematic structural diagram of a user equipment according to an embodiment of the present invention
  • FIG. 12 is a schematic structural diagram of a user equipment according to an embodiment of the present invention
  • FIG. 13 is a schematic diagram of a mobile management entity according to an embodiment of the present invention
  • FIG. 14 is a schematic structural diagram of a mobility management entity according to an embodiment of the present invention
  • FIG. 15 is a schematic structural diagram of a mobility management entity according to an embodiment of the present invention. Schematic diagram of the structure of the base station
  • FIG. 17 is a schematic structural diagram of a user equipment according to an embodiment of the present invention
  • FIG. 18 is a schematic structural diagram of a mobility management entity according to an embodiment of the present invention.
  • An embodiment of the present invention provides an information protection method, which is based on a base station side, as shown in FIG. 1 , the method includes:
  • the base station receives a radio resource control RRC connection request from the user equipment, where the RRC connection request includes a service request and a fast service request indication.
  • the base station sends the initial user information to the mobility management entity MME, where the initial user information is used to request the MME to deliver the security context.
  • the base station receives an initial context setup request including a security context from the MME.
  • the base station uses the security context to perform security protection on the specified information to generate the protected information.
  • the specified information may be configuration information such as SRB (Signaling Radio Bearer) and DRB (Data Radio Bearer).
  • SRB Synignaling Radio Bearer
  • DRB Data Radio Bearer
  • the base station sends an RRC connection setup message to the user equipment, where the RRC connection setup message includes the protected information.
  • the base station receives an RRC connection complete message from the user equipment, where the RRC connection complete message includes a security mode complete message.
  • An embodiment of the present invention provides an information protection method.
  • the base station receives an RRC connection request including a service request and a fast service request indication from a user equipment, and then sends initial user information to the MME, and receives an initial context including the security context from the MME.
  • the context establishment request is generated, and then the protected information is generated according to the security context using the security context, and the RRC connection setup message including the protected information is sent to the user equipment. Therefore, a mechanism for protecting the specified information is provided, and the specified information can be protected in the wireless connection establishment process, thereby realizing the secure delivery of the specified information.
  • the embodiment of the present invention further provides an information protection method, which is based on the user equipment side, as shown in FIG. 2, and includes:
  • the user equipment sends a radio resource control RRC connection request to the base station, where the RRC connection request includes a service request and a fast service request indication.
  • the user equipment receives an RRC connection setup message from the base station, where the RRC connection setup message includes the protected information.
  • the user equipment verifies the RRC connection setup message, and decrypts the protected information after the verification succeeds to obtain the specified information.
  • the user equipment sends an RRC connection complete message to the base station, where the RRC connection complete message includes a security mode complete message.
  • An embodiment of the present invention provides an information protection method.
  • the user equipment sends an RRC connection request including a service request and a fast service request indication to a base station, and then receives an RRC connection setup message including the protected information from the base station, and verifies the user equipment side.
  • the RRC connection establishes a message, and decrypts the protected information after the verification is successful to obtain prescribed information. Therefore, a mechanism for protecting the prescribed information is provided, and the specified information can be protected in the wireless connection establishment process, thereby realizing the secure delivery of the prescribed information.
  • the embodiment of the present invention further provides an information protection method, which is based on the MME side, as shown in FIG. 3, the method includes:
  • the MME receives the initial user information from the base station, where the initial user information is used to request the MME to deliver the security context.
  • the MME sends an initial context setup request including a security context to the base station, so that the base station performs security protection on the specified information according to the security information in the initial context establishment request.
  • An embodiment of the present invention provides an information protection method, based on an MME side, and an MME After receiving the initial user information, the base station sends an initial context setup request including the security context to the base station, so that the base station performs security protection on the specified information according to the security information in the initial context establishment request. Therefore, a mechanism for protecting the prescribed information is provided, and the specified information can be protected in the wireless connection establishment process, thereby realizing the secure delivery of the prescribed information.
  • FIG. 4 the method is as shown in FIG. Includes:
  • the user equipment sends an RRC connection request to the base station.
  • the RRC connection request may include a service request (Service Request) and a fast service request indication (Fast Service Request Indication), where the fast service request indication is used to indicate that the base station performs security protection on the specified information, and The fast service request indication is used to indicate that the security context is sent to the base station.
  • the specified information may be configuration information such as an SRB (Signaling Radio Bearer), a DRB (Data Radio Bearer), and the like.
  • the base station After receiving the RRC connection request of the user equipment, the base station sends initial user information (Initial UE Message) to the MME.
  • initial user information Initial UE Message
  • the base station After receiving the RRC connection request sent by the user equipment, the base station generates initial user information according to the RRC connection request, and sends the initial user information to the MME.
  • the initial user information is generated according to the RRC connection request, and the initial user information includes the service request and the fast service request indication sent by the user equipment.
  • the MME After receiving initial user information of the base station, the MME sends a context establishment request to the base station.
  • the context establishment request may include an integrity protection key (KSDT enc ), an encryption key (KSDT int ), a small data anti-replay value (Count_SDT), and a user security capability (UE EP S Security Capabilitise).
  • SDT refers to Small Data Transmission
  • EP S refers to Evolved Packet System 0 where user security capabilities may refer to security supported by user equipment.
  • Algorithm the small data anti-replay value includes an encryption anti-replay value and an integrity protection anti-replay value; the integrity protection key and the encryption key are negotiated and generated by the user equipment and the MME, and used by the base station to perform integrity protection on the specified message.
  • the integrity protection key and the secret key can be negotiated in the AKA (Authentication and Key Agreement) process; or, after the AKA process, at the user equipment to the base station Before the fast service request is initiated, the user equipment negotiates with the MME.
  • AKA Authentication and Key Agreement
  • the integrity protection key is represented as KSDT enc in the subsequent embodiment, and the encryption key is represented as KSDT int .
  • the MME sends an authentication request to the HSS (Home Subscriber Server).
  • HSS Home Subscriber Server
  • the HSS After receiving the authentication request of the MME, the HSS generates an authentication vector (Authentication Vectors, AV) according to the authentication request, where i is AV (1 ... n , n is a positive integer), and each AV includes RAND (random number), Kasme, AUTH
  • Authentication Token Authentication Token
  • XERS Extended Response
  • Kasme is a preset original key
  • the Kasme is used as a preset original key for generating an integrity protection key and an encryption key.
  • the AUTN value is used by the user equipment to detect the security of the network itself.
  • HHS After HHS generates the authentication vector, HHS passes the Authentication Data Response ⁇ ! The generated authentication vector (AV (1 ... n )) is sent to the MME.
  • the MME After receiving the authentication vector sent by the HSS, the MME stores and selects an authentication vector, and then sends the RAND and the AUTN to the user equipment by using a user authentication request.
  • the RAND and AUTN that are sent to the user equipment by the user authentication request are RAND (i) and AUTN (i).
  • the user equipment After receiving the user authentication request of the MME, the user equipment verifies the AUTN, and after the verification succeeds, generates an authentication response RES (Response), and then sends a user authentication response including the RES to the MME. For example, if the authentication vector selected by the MME is AV (i), the AUTN received by the user equipment is AUTN (i), and then the user equipment verifies AUTN(i), and RES(i) is generated after the verification succeeds.
  • RES Response
  • the MME After receiving the authentication response of the user equipment, the MME compares RES (i) with XRES (i). Where XRES ( i ) is generated by the MME.
  • RES ( i ) and XRES ( i ) meet the preset conditions, indicating that RAND is correct, then after comparing the RES and XRES processes, it also includes:
  • the user equipment generates Kasme, then generates KSDT enc and KSDT int according to Kasme and RAND, and resets Count_SDT to zero.
  • the MME selects Kasme, then generates an encryption key and an integrity protection key according to Kasme and RAND, and resets Count_SDT to zero.
  • the above 4036 and 4037 may be performed simultaneously or in different steps.
  • the encryption key and the integrity protection key generated by the user equipment are the same as the encryption key and the integrity protection key generated by the MME.
  • the user equipment and the MME negotiate the encryption key and the integrity protection key, as shown in FIG. 4b, and the specific process is as follows:
  • the MME generates a small data temporary value nonce_SDT, and then generates KSDT enc and KSDT int according to Kasme and nonce_SDT, and resets Count_SDT to zero.
  • the MME sends a non-access layer security mode command (NAS Security Mode Command, NAS SMC) to the user equipment.
  • NAS Security Mode Command NAS SMC
  • the non-access stratum security mode command includes eKSI (Algorithm Identification), NAS Algorithm (Non-Access Stratum Algorithm), user equipment security capability, nonce-SDT, and NAS MAC (NAS Massage Authentication Command, non-access stratum message). Verification code).
  • the eKSI is used to identify the non-access stratum security mode command, and the non-layered algorithm is used to perform integrity protection on the non-access stratum security mode command.
  • the user device security capability refers to the security algorithm supported by the user.
  • the user equipment receives the non-access stratum security mode command sent by the MME. After verifying the non-access stratum message authentication code, verifying the non-access stratum message authentication code to verify the non-access stratum security mode command, after the verification succeeds, generating KSDT enc and KSDT int according to Kasme and nonce-SDT, The Count_SDT is reset to zero, and then the non-access stratum security mode command is sent to the MME.
  • the user device generates KSDT enc and KSDT int and MME generated KSDT enc and KSDT int are the same.
  • the base station protects the specified information to generate the protected information and the message verification code. Specifically, after receiving the security capabilities of the KSDT enc , the KSDT int , the Count-SDT, and the user equipment, the base station selects a protection algorithm, and the protection algorithm may be an AS layer security protection algorithm, where the AS layer security protection algorithm includes the AS Layer integrity protection algorithm and AS layer encryption algorithm.
  • the base station uses the AS layer security protection algorithm, KSDT enc and KSDT int to perform encryption protection and integrity protection on the specified information, generates the protected information, and generates a small data message verification code correspondingly, and the small data message verification code can be recorded as MAC-I - SDT.
  • an AS security context is obtained, where the AS layer security context includes an RRC integrity protection key and a corresponding RRC integrity protection algorithm, an RRC encryption key, and a corresponding RRC encryption algorithm.
  • the integrity protection of the selected AS layer integrity protection algorithm is performed by using the RRC integrity protection key, and a message verification code is generated correspondingly, and the message verification code can be recorded as MAC-I.
  • the KSDT int may be used to perform integrity protection on the specified information to generate a separate MAC-I-SDT, and the existing RRC integrity protection key and RRC integrity protection algorithm may be used. The entire RRC connection setup message is protected to generate a corresponding message verification code MAC-I.
  • the base station sends an RRC connection setup message to the user equipment.
  • the RRC connection setup message includes the protected information, the MAC-I-SDT, the Count SDT, and the AS SMC (AS Security Mode Command), and the MAC-I that protects the RRC connection setup message. Which is included in the AS SMC AS layer security protection algorithm.
  • the user equipment verifies the RRC connection setup message, and decrypts the protected information after the verification succeeds to obtain the specified information.
  • the user equipment first verifies the MAC-I that protects the RRC connection setup message after receiving the RRC connection setup message. After the verification is successful, the MAC-I-SDT for protecting the protected information is verified by the KSDT in p AS layer integrity protection algorithm, and after the verification is successful, the use is performed.
  • the AS layer encryption algorithm decrypts the protected information to obtain the specified information.
  • the user equipment sends an RRC connection complete message to the base station, where the RRC connection complete message includes a Security Mode Command Complete Message and a message full code.
  • the message verification code here may also be a MAC-I for integrity protection of the RRC connection complete message.
  • An embodiment of the present invention provides an information protection method, in which a user equipment sends an RRC connection request including a fast service request indication to a base station, where the fast service request indication is used to instruct the base station and the MME to open protection for the specified information, and the MME sends a single request to the base station.
  • An initial context establishment request including an encryption key, an integrity protection key, an anti-replay value, and a user security capability, and a key and an algorithm according to an indication of the initial context connection request after the base station receives the initial context connection request sent by the MME Protecting the specified information to generate the protected information, and transmitting an RRC connection setup message including the protected information to the user equipment, and then the user equipment verifies the RRC connection setup message and decrypts the protected information to obtain prescribed information, thereby providing a
  • the mechanism for protecting the specified information can protect the specified information in the wireless connection establishment process, so as to realize the secure delivery of the specified information.
  • FIG. 5 Another information protection method provided by the embodiment of the present invention is shown in FIG. 5, and the method includes:
  • the user equipment sends an RRC connection request to the base station, where the RRC connection request includes a user temporary value.
  • the above user temporary value can be expressed as a nonce UE, and the nonce UE is used to generate a plus Secret key and integrity protection key.
  • the rest is the same as the RRC connection request in 401, and will not be described again.
  • the base station After receiving the RRC connection request of the user equipment, the base station sends initial user information to the MME.
  • the initial user information also includes a nonce-UE (except for the nonce-UE, the rest is the same as the RRC connection request in 401, and will not be described again).
  • the MME determines whether to allow the fast service request of the user equipment.
  • the MME temporary value is generated, and the MME temporary value may be represented as nonce_MME, and the nonce_MME is used to generate an encryption key and an integrity protection key, and according to Kasme, nonce-UE, Nonce—MME obtains KSDD KSDT int .
  • the MME sends an initial context setup request to the base station.
  • the initial context request includes KSDT enc , KSDT int and nonce_ MME.
  • the base station After receiving the initial context setup request sent by the MME, the base station protects the specified information to generate the protected information.
  • the base station first selects a protection algorithm, and the protection algorithm may be an AS layer security protection algorithm, and the AS layer security protection algorithm includes an AS layer integrity protection algorithm and an AS layer encryption algorithm.
  • the protection algorithm may be an AS layer security protection algorithm
  • the AS layer security protection algorithm includes an AS layer integrity protection algorithm and an AS layer encryption algorithm.
  • the AS layer security protection algorithm, KSDT ene and KSDT int are used to encrypt and protect the specified information, generate protected information, and generate a small data message verification code, which can be recorded as MAC- I—SDT.
  • the RRC integrity protection key is used to perform integrity protection on the selected AS layer security protection algorithm and the nonce-MME, and correspondingly generate a message verification code, and the message may be recorded as MAC-I.
  • the KSDT int may be used to perform integrity protection on the specified information to generate a separate MAC-I-SDT, and the existing RRC integrity protection key and RRC integrity protection algorithm may be used. Establish a message for the entire RRC connection The protection is generated to generate a corresponding message verification code MAC-I.
  • the base station sends an RRC connection setup message to the user equipment.
  • the RRC Connection Setup message includes the protected information, MAC-I-SDT, Count SDT, and AS SMC.
  • the AS SMC includes an AS layer security protection algorithm, a nonce-MME, and a MAC-I that protects the RRC connection setup message.
  • the user equipment After receiving the RRC connection setup message sent by the base station, the user equipment verifies the RRC connection setup message, and decrypts the protected information after the verification succeeds to obtain the specified information.
  • the user equipment after receiving the RRC connection setup message, the user equipment first verifies the MAC-I that protects the RRC connection setup message, and after the verification succeeds, generates KSDT enc and KSDT int according to nonce_MME, nonce-UE, and Kasme, and according to The KSDT int and AS layer integrity protection algorithms verify the MAC-I-SDT that protects the reported information, and decrypt the protected information according to the KSDT ene and AS layer encryption algorithms to obtain the specified information after successful verification.
  • the user equipment sends an RRC connection complete message to the base station (the same as the 407, for details, refer to 407, and details are not described herein again).
  • the embodiment of the present invention provides an information protection method, where the user equipment sends an RRC connection request including a fast service request indication and a user temporary value to the base station, where the fast service request indication is used to instruct the base station and the MME to open protection for the specified information, where the MME is After receiving the initial user information of the base station and allowing the user to perform the fast service, the MME temporary value is generated, and the encryption key and the integrity protection key are generated according to the user temporary value, the MME temporary value, and the preset algorithm, and then the base station sends the The encryption key, the integrity protection key, and the user temporarily deserve the security context request. After receiving the initial context connection request sent by the MME, the base station protects the specified information according to the key and algorithm indicated by the initial context connection request.
  • the method includes:
  • the user equipment sends an RRC connection request to the base station (the same as the 401, for details, refer to 401, and details are not described herein again).
  • the base station After receiving the RRC connection request of the user equipment, the base station sends initial user information to the MME.
  • the initial user information contains a service request.
  • the MME After receiving the initial user information sent by the receiving station, the MME sends an initial context setup request to the base station.
  • the base station After receiving the initial context setup request sent by the MME, the base station protects the specified information to generate the protected information.
  • the base station first acquires an access layer security context, performs integrity protection on the entire RRC connection setup message according to the RRC integrity protection key and the RRC integrity protection algorithm in the security context, and generates a corresponding message verification code MAC-I.
  • the specified information is encrypted and protected according to the RRC encryption key and the RRC encryption algorithm in the security context to obtain the protected information.
  • the base station sends an RRC connection setup message to the user equipment.
  • the RRC Connection Setup message includes protected information, a message authentication code, and an access layer security mode command, the access layer security mode command including a protection algorithm.
  • the protection algorithm includes an RRC integrity protection algorithm and an RRC encryption algorithm.
  • the message authentication code is the MAC-I that protects the RRC connection setup message. It should be noted that the access layer security mode command in the RRC connection setup message is only integrity protected by the base station.
  • the user equipment After receiving the RRC connection setup message sent by the base station, the user equipment verifies the message verification code, and decrypts the protected information to obtain the specified information after the verification succeeds.
  • the user equipment generates a security context according to the RRC integrity protection algorithm and the RRC encryption algorithm, where the security context includes an RRC integrity protection key and an RRC encryption key, and the MAC-I is verified according to the RRC integrity protection key, and the verification succeeds.
  • the protected information is then decrypted according to the RRC encryption key to obtain the specified information. 608.
  • the user equipment sends an RRC connection complete message to the base station (the same as 407, for details, refer to 407, and details are not described herein again).
  • the MME may further include:
  • the MME determines, according to user equipment information or subscription data saved by the HSS of the core network, whether the user equipment is allowed to initiate a fast service request.
  • An embodiment of the present invention provides an information protection method, where a user equipment sends an RRC connection request including a fast service request indication to a base station, where the fast service request indication is used to instruct the base station and the MME to open protection for the specified information, and the base station sends the MME to send After the initial context connection request, the specified information is protected according to the key and algorithm indicated by the initial context connection request to generate the protected information, and the entire RRC connection request is integrity protected, and the protected device is sent to the user equipment.
  • the RRC connection setup message and then the user equipment generates a security context, and then uses the generated security context to verify the RRC connection setup message and decrypts the protected information to obtain the specified information, thereby providing a mechanism for protecting the specified information, which can be established in the wireless connection.
  • the specified information is protected in the process, so that the specified information can be safely delivered.
  • the embodiment of the invention further provides an information protection method for detailed description. As shown in FIG. 8, the method includes:
  • the user equipment presets a private key and a public algorithm.
  • the private key and the public algorithm are used by the user equipment to verify and decrypt the protected information to obtain the specified information.
  • the key server presets a public key and a public algorithm.
  • the public key and the common algorithm are used for base station encryption specifying information to generate protected information.
  • the user equipment sends an RRC connection request to the base station (the same as 401, for details, refer to 401, and details are not described herein again).
  • the base station After receiving the RRC connection request of the user equipment, the base station sends the initial user information to the MME (the same as the 402, for details, refer to 401, and details are not described herein again). 705. After receiving the initial user information sent by the base station, the MME sends a user identifier of the user equipment to the key server to request to use a public key and a public algorithm corresponding to the user equipment.
  • the key server After receiving the public key request sent by the MME, the key server sends the public key and the public algorithm to the MME.
  • the MME After receiving the public key and the common algorithm sent by the core network, the MME sends an initial context setup request to the base station, where the initial context establishment request includes a public key and a public algorithm.
  • the base station After receiving the initial context setup request sent by the MME, the base station protects the specified information to generate the protected information.
  • the public key and the public algorithm are used to encrypt and protect the specified information, generate the protected information, use the RRC integrity protection key to protect the integrity of the specified information, and generate a message verification code, which can be recorded as MAC-1. .
  • the base station After completing the foregoing process, the base station sends an RRC connection setup message to the user equipment.
  • the RRC connection setup message includes the protected information, the message verification code, and the access layer security mode command.
  • the access layer security mode command includes a protection algorithm, and the protection algorithm may be an RRC integrity protection algorithm, and the message verification code is a protection RRC connection. Establish the MAC-I of the message. It should be noted that the access layer security mode command in the RRC connection setup message is only integrity protected by the base station.
  • the user equipment After receiving the RRC connection setup message of the base station, the user equipment verifies the message verification code, and decrypts the protected information to obtain the specified information after the verification succeeds.
  • the user equipment generates an RRC integrity protection key according to the foregoing RRC integrity protection algorithm, and verifies the MAC-I according to the RRC integrity protection key, and after the verification succeeds, the protection is protected according to a preset private key and a common algorithm pair.
  • the information is decrypted to obtain the prescribed information.
  • the user equipment sends an RRC connection complete message to the base station (the same as the 402, for details, refer to 407, and details are not described herein again).
  • the embodiment of the invention provides an information protection method, where the user equipment is pre-configured privately.
  • the key and the common algorithm the core network pre-configures the public key and the common algorithm, and then the user equipment sends an RRC connection request including the fast service request indication to the base station, where the fast service request indication is used to instruct the base station and the MME to open the protection of the specified information.
  • the base station After receiving the initial context connection request sent by the MME and including the public key and the common algorithm, the base station protects the specified information according to the public key and the public algorithm indicated by the initial context connection request to generate the protected information, and generates the protected information to the user equipment.
  • the specified information can be protected in the wireless connection establishment process, so that the specified information can be safely delivered.
  • the embodiment of the present invention further provides a base station 1.
  • the base station includes: a receiving unit 1 1 configured to receive a radio resource control RRC connection request from a user equipment, where the RRC connection request includes a service request and a fast service request indication. ;
  • the sending unit 12 is configured to send initial user information to the mobility management entity MME, where the initial user information is used to request the MME to deliver a security context.
  • the receiving unit 1 1 is further configured to receive an initial context setup request including a security context from the MME;
  • the encryption unit 13 is configured to securely protect the specified information by using a security context to generate the protected information.
  • the sending unit 12 is further configured to send an RRC connection setup message including the protected information to the user equipment.
  • the initial user information includes a service request and a fast service request indication
  • the fast service request indication in the RRC connection request is used to instruct the base station to perform security protection on the specified information
  • the fast service request indication in the initial user information is used to instruct the MME to issue a security context to the base station.
  • the initial context setup request received by the receiving unit 11 from the MME includes: Encryption key, integrity protection key, security capability of the user equipment, and small data anti-replay value, the small data anti-replay value includes an encryption anti-replay value and an integrity protection anti-replay value;
  • the encryption key and the integrity protection key are negotiated by the user equipment and the MME in an authentication and key agreement process; or
  • the encryption key and the integrity protection key are after the authentication and key agreement procedure and are negotiated by the user equipment and the MME before the user equipment sends the fast service request.
  • the encryption unit 13 is specifically configured to select a protection algorithm; protect the specified information by using a protection algorithm, an encryption key, and an integrity protection key, generate the protected information, and generate a small data message verification code correspondingly;
  • the encryption unit 13 is further configured to perform integrity protection on the protection algorithm by using the RRC integrity protection key, and correspondingly generate a message verification code.
  • the sending unit 12 is further configured to send, to the user equipment, the RRC connection setup message that includes the protected information, where the RRC connection setup message includes the small data message verification code, and the small data is anti-heavy Place value and safe mode commands; or,
  • the sending unit is further configured to send the RRC connection setup message that includes the protected information to the user equipment, where the RRC connection setup message further includes the anti-replay value, a security mode command, Message verification code.
  • the RRC connection request received by the receiving unit 1 1 from the user equipment further includes a user temporary value, and the user temporary value is used to generate an encryption key and an integrity protection key;
  • the initial user information sent by the sending unit 12 to the MME further includes a user temporary value.
  • the initial context establishment request received by the receiving unit 11 from the MME includes: an encryption key, an integrity protection key, and an MME temporary value, and the MME temporary value is used to generate an encryption key. Key and integrity protection keys.
  • the encryption unit 13 is further configured to select a protection algorithm; use the protection algorithm, the encryption key, and the integrity protection key to securely protect the specified information, generate the protected information, and generate a small data message verification code;
  • the encryption unit 13 is further configured to perform integrity protection on the MME temporary value and the protection algorithm by using the RRC integrity protection key, and generate a message verification code correspondingly; or
  • the encryption unit 13 is further configured to perform integrity protection on the RRC connection setup message by using the RRC integrity protection key and the protection algorithm to generate a message verification code.
  • the sending unit 12 is further configured to: send an RRC connection setup message to the user equipment, where the RRC connection setup message includes the protected information and the security mode command.
  • the sending unit 12 further includes:
  • the identifying unit 121 is configured to identify, according to the fast service request indication in the RRC connection request, that the current service request is a fast service request;
  • the information sending unit 122 is configured to send initial user information to the MME, where the initial user information includes a service request, so as to obtain a security context from the MME.
  • the encryption unit 13 is further configured to perform integrity protection on the RRC connection setup message according to the RRC integrity protection key and the protection algorithm to generate a message verification code.
  • the encryption unit 13 is further configured to perform security protection on the specified information according to the RRC encryption key and the protection algorithm to generate the protected information.
  • the sending unit 12 is further configured to send, to the user equipment, an RRC connection setup message that includes the protected information, where the RRC connection setup message further includes a security mode command and a message verification code.
  • the initial user information also includes a quick service request indication
  • the initial context setup request that the receiving unit 1 further receives from the MME includes a fast service request permission indication, which is sent by the MME after the MME determines that the user equipment is allowed to fast service.
  • the initial context setup request received by the receiving unit 11 from the MME includes: a public key and a public algorithm;
  • the public key and the common algorithm are obtained and sent by the MME from the key server after the initial user information is sent to the MME.
  • the encryption unit 13 is further configured to encrypt and protect the specified information by using a public key and a public algorithm to generate the protected information;
  • the encryption unit 13 is further configured to perform integrity protection on the specified information by using the RRC integrity protection key, and generate a message verification code.
  • the sending unit 12 is further configured to send, to the user equipment, the RRC connection setup message that includes the protected information, where the RRC connection setup message further includes a security mode command and the message verification code; or
  • the encryption unit 13 is further configured to perform integrity protection on the RRC connection setup message by using the RRC integrity protection key to generate a message verification code.
  • the sending unit 12 is further configured to send, to the user equipment, the RRC connection setup message that includes the protected information, where the RRC connection setup message further includes a message verification code and a security mode command.
  • An embodiment of the present invention provides a base station, where the base station receives an RRC connection request including a service request and a fast service request indication from a user equipment, and then sends initial user information to the MME, and receives an initial context establishment request including a security context from the MME, and then The specified information is security-protected according to the information in the initial context establishment request to generate the protected information, and then the RRC connection setup message including the protected information is sent to the user equipment. Therefore, a mechanism for protecting the specified information is provided, and the specified information can be protected in the wireless connection establishment process, thereby realizing the secure delivery of the specified information.
  • the embodiment of the present invention further provides a user equipment 2, as shown in FIG. 11, the base station includes:
  • the sending unit 21 is configured to send a radio resource control RRC connection request to the base station, where the RRC connection request includes a service request and a fast service request indication;
  • the receiving unit 22 is configured to receive, from the base station, an RRC connection that includes the protected information. a message, the RRC connection setup message includes the protected information;
  • the decryption unit 23 is configured to verify an RRC connection setup message including the protected information, and decrypt the protected information to obtain the specified information after the verification succeeds.
  • the fast service request indication is used to instruct the base station to perform security protection on the specified information.
  • the RRC connection setup message received by the receiving unit 22 from the base station further includes a small data message verification code, a small data anti-replay value, the protected information, and a security mode command.
  • the security mode command includes message verification. Code and protection algorithms.
  • the decryption unit 23 is specifically configured to:
  • the message verification code is verified, and after the verification is successful, the small data message verification code is verified according to the encryption key, the integrity protection key, and the protection algorithm, and the protected information is decrypted to obtain the specified information after the verification is successful.
  • the user equipment 2 further includes a key agreement unit 24, and the key negotiation unit 24 is configured to perform, according to the preset original key and authentication, in the authentication and key agreement process with the MME.
  • the random value RAND in the vector generates the encryption key and the integrity protection key, or
  • the key negotiation unit 24 is configured to acquire, after the authentication and key negotiation process, the encryption key and the completeness according to a preset original key and a small data temporary value generated by the MME. a security key; wherein the preset original key includes Kasme, and the small data temporary value is included in a non-access stratum security mode command.
  • the RRC connection setup message received by the receiving unit 11 from the base station includes an MME temporary value
  • the decryption unit 23 generates an encryption key and an integrity protection key according to the user temporary value and the MME temporary value, including:
  • the decryption unit 23 is further configured to: And verifying the message verification code according to the RRC integrity protection key and the protection algorithm, and decrypting the protected information according to the encryption key and the protection algorithm to obtain the specified information after the verification succeeds; or
  • the RRC Connection Setup message including the protected information received by the receiving unit 22 from the base station further includes a security mode command and a message verification code; the security mode command includes the protection algorithm.
  • the decryption unit 23 is further configured to generate a RRC integrity protection key and an RRC encryption key according to the protection algorithm, and verify the message verification code according to the RRC integrity protection key, and after the verification succeeds, according to the RRC encryption key pair
  • the protection information is decrypted to obtain the prescribed information.
  • the decryption unit is further configured to:
  • An embodiment of the present invention provides a user equipment, where the user equipment sends an RRC connection request including a service request and a fast service request indication to a base station, and then receives an RRC connection setup message including the protected information from the base station, and verifies the RRC connection setup message. And after the verification is successful, the protected information is decrypted to obtain the specified information. Therefore, a mechanism for protecting the prescribed information is provided, and the prescribed information can be protected in the wireless connection establishment process, thereby realizing the secure delivery of the prescribed information.
  • the embodiment of the present invention further provides a mobility management entity (MME) 3, as shown in FIG. 13, the mobility management entity 3 includes:
  • the receiving unit 3 1 is configured to receive initial user information from the base station, where the initial user information is used. Sending a security context to the requesting MME;
  • the sending unit 32 is configured to send an initial context establishment request including a security context to the base station, so that the base station performs security protection on the specified information according to the security information in the initial context establishment request.
  • the initial user information includes a service request and a fast service request indication
  • the fast service request indication is used to instruct the MME 3 to deliver a security context to the base station.
  • the initial context establishment request sent by the sending unit 32 to the base station includes an encryption key, an integrity protection key, a security capability of the user equipment, and a small data anti-replay value, and the small data anti-replay value is anti-replay used for small data transmission.
  • the value, small data anti-replay value includes an encryption anti-playback value and an integrity protection anti-playback value.
  • the MME 3 further includes a key agreement unit 33, where the key agreement unit 33 is used in the authentication and key agreement process and the user equipment according to the preset original key and The random value RAND in the authentication vector generates the encryption key and the integrity protection key; or
  • the key negotiation unit 33 is configured to obtain the encryption key and the location after the authentication and key agreement process, and at the user equipment according to the preset original key and the small data temporary value generated by the MME.
  • the integrity protection key wherein the preset original key includes Kasme, and the small data temporary value generated by the MME is included in a non-access stratum security mode command.
  • the initial user information received by the receiving unit 31 from the base station further includes a user temporary value; the user temporary value is used to generate an encryption key and an integrity protection key.
  • the MME3 further includes:
  • the determining unit 34 is configured to determine whether the fast service request of the user equipment is allowed. If the fast service request of the user equipment is allowed, the MME temporary value is generated, and the encryption key is obtained according to the preset original key, the user temporary value, and the MME temporary value. And integrity protection keys.
  • the fast service request of the user equipment is allowed, the MME temporary value is generated, and the encryption key is obtained according to the preset original key, the user temporary value, and the MME temporary value. And integrity protection keys.
  • the initial context establishment request sent by the transmitting unit 32 to the base station includes an encryption key, an integrity protection key, and an MME temporary value.
  • the initial user information includes a service request and a fast service request indication; before sending the initial context establishment request to the base station, the determining unit 34 is configured to:
  • the initial context setup request sent to the base station includes a fast service request permission indication.
  • the sending unit 32 is further configured to send a user identifier of the user equipment to the key server to request to use a public key and a common algorithm corresponding to the user equipment; the public key and the public algorithm are preset on the key server;
  • the receiving unit 31 is further configured to receive the public key and the common algorithm from the key server, and then include the public key and the common algorithm in the initial context establishment request sent to the base station.
  • An embodiment of the present invention provides an MME, after receiving the initial user information from the base station, the MME sends an initial context setup request including a security context to the base station, so that the base station securely protects the specified information according to the security information in the initial context establishment request. Therefore, a mechanism for protecting the prescribed information is provided, and the specified information can be protected in the wireless connection establishment process, thereby realizing the secure delivery of the specified information.
  • the embodiment of the present invention further provides a base station 4.
  • the base station 4 includes: a bus 41, and a processor 42, a memory 43 and an interface 44 connected to the bus 41, wherein the interface 44 is used for other network elements.
  • Communication 43 is used to store instructions 43 1 ; processor 42 executes instructions 43 1 for:
  • Radio resource control RRC connection request receives, by the user equipment, a radio resource control RRC connection request, where the RRC connection request includes a service request and a fast service request indication;
  • the initial user information includes a service request and a fast service request indication
  • the fast service request indication in the RRC connection request is used to instruct the base station to perform security protection on the specified information
  • the fast service request indication in the initial user information is used to instruct the MME to issue a security context to the base station.
  • the initial context setup request received from the MME includes:
  • the encryption key, the integrity protection key, the security capability of the user equipment, and the small data anti-replay value includes the encryption anti-replay value and the integrity protection anti-replay value;
  • the encryption key and the integrity protection key are negotiated by the user equipment and the MME in an authentication and key agreement process; or
  • the encryption key and the integrity protection key are after the authentication and key agreement procedure and are negotiated by the user equipment and the MME before the user equipment sends the fast service request.
  • the processor 42 executes the instruction 43 1 for:
  • the protection information, the encryption key and the integrity protection key are used to protect the specified information, the protected information is generated, and the small data message verification code is generated correspondingly;
  • the RRC connection setup message that includes the protected information, where the RRC connection setup message further includes the small data message verification code, the small data anti-replay value, and a security mode command; or ,
  • the processor 42 executes the instruction 43 1 for:
  • the RRC connection request received from the user equipment further includes a user temporary value, and the user temporary value is used to generate an encryption key and an integrity protection key;
  • the initial user information sent to the MME also includes user temporary values.
  • the initial context setup request received from the MME includes:
  • the cryptographic key, the integrity protection key, and the MME temporary value is used to generate the encryption key and the integrity protection key.
  • the processor 42 executes the instruction 43 1 for:
  • the protection information, the encryption key and the integrity protection key are used to securely protect the specified information, generate the protected information, and generate a small data message verification code correspondingly;
  • the RRC connection setup message including the protected information, where the RRC connection setup message includes the small data message verification code and the protected information and security mode command;
  • the processor 42 executes the instruction 43 1 for:
  • Initial user information is sent to the MME, the initial user information including a service request to obtain a security context from the MME.
  • the processor 42 executes the instruction 43 1 for:
  • RRC connection setup message including the protected information, where the RRC connection setup message further includes a security mode command and a message verification code.
  • the initial user information also includes a quick service request indication
  • the initial context setup request received from the MME includes a fast service request grant indication, which is sent by the MME after the MME determines that the user equipment is allowed to fast service.
  • the initial context setup request received from the MME includes:
  • the public key and the common algorithm are obtained and sent by the MME from the key server after the initial user information is sent to the MME.
  • the processor 42 executes the instruction 43 1 for:
  • the RRC connection setup message that includes the protected information, where the RRC connection setup message further includes a security mode command and the message authentication code;
  • the RRC connection setup message including the protected information, where the RRC connection setup message further includes a message verification code and a security mode command.
  • An embodiment of the present invention provides a base station, where the base station receives an RRC connection request including a service request and a fast service request indication from a user equipment, and then sends initial user information to the MME, and receives an initial context establishment request including a security context from the MME. Then, according to the information in the initial context establishment request, the specified information is security-protected to generate the protected information, and then the RRC connection setup message including the protected information is sent to the user equipment. Therefore, a mechanism for protecting the specified information is provided, and the specified information can be protected in the wireless connection establishment process, thereby realizing the secure delivery of the specified information.
  • the embodiment of the present invention further provides a user equipment 5, as shown in FIG. 17, the user equipment 5 includes: a bus 51, and a processor 52, a memory 53 and an interface 54 connected to the bus 5 1 , wherein the interface 54 is used for Other network element communication; memory 53 is used to store instruction 53 1; processor 52 executes instruction 53 1 for:
  • the RRC connection setup message including the protected information is received from the base station, the RRC connection setup message includes the protected information, and the RRC connection setup message is verified, and the protected information is decrypted to obtain the prescribed information after the verification succeeds.
  • the fast service request indication is used to instruct the base station to secure the specified information.
  • the RRC Connection Setup message received from the base station further includes a small data message verification code, a small data anti-replay value, the protected information, and a security mode command; the security mode command includes a message verification code and a protection algorithm.
  • the processor 52 executes the instruction 53 1 for:
  • the encryption key and the integrity protection key are generated by the MME in the authentication and key agreement process according to the preset original key and the random value RAND in the authentication vector. Integrity protection key; or,
  • the encryption key and the integrity protection key are obtained by the MME after the authentication and key agreement process, according to a preset original key and a small data temporary value generated by the MME.
  • Key and the integrity protection key wherein
  • the preset original key includes Kasme, and the small data temporary value is included in the non-access stratum security mode command.
  • the processor 52 executes the instruction 53 1 for:
  • the RRC connection request sent to the base station includes a user temporary value; the RRC connection setup message received from the base station includes an MME temporary value; and an encryption key is generated according to the user temporary value and the MME temporary value.
  • the integrity protection key includes:
  • the processor 52 executes the instruction 53 1 for:
  • the RRC Connection Setup message including the protected information received from the base station further includes a security mode command and a message verification code; the security mode command includes a protection algorithm.
  • the processor 52 executes the instruction 53 1 for generating the RRC integrity protection key and the RRC encryption key according to the protection algorithm, and verifying the message verification code according to the RRC integrity protection key, and according to the RRC encryption key after successful verification
  • the protected information is decrypted to obtain the specified information.
  • the processor 52 executes the instruction 53 1 for:
  • An embodiment of the present invention provides a user equipment, where the user equipment sends an RRC connection request including a service request and a fast service request indication to a base station, and then receives an RRC connection setup message including the protected information from the base station, and verifies the RRC connection setup message. And after the verification is successful, the protected information is decrypted to obtain the specified information. Therefore, a mechanism for protecting the prescribed information is provided, and the prescribed information can be protected in the wireless connection establishment process, thereby realizing the secure delivery of the prescribed information.
  • the embodiment of the present invention further provides a mobility management entity 6.
  • the mobility management entity 6 includes: a bus 61, and a processor 62, a memory 63 and an interface 64 connected to the bus 61, wherein the interface 64 is used Communicating with other network elements; memory 63 for storing instructions 63 1 ; processor 62 executing instructions 63 1 for:
  • An initial context setup request including a security context is sent to the base station to enable the base station to securely protect the specified information based on the security information in the initial context establishment request.
  • the initial user information includes a service request and a fast service request indication
  • the fast service request indication is used to instruct the MME to deliver a security context to the base station.
  • the initial context establishment request sent to the base station includes an encryption key, an integrity protection key, a security capability of the user equipment, and a small data anti-replay value
  • the small data anti-replay value is an anti-replay value used for small data transmission, small
  • the data anti-replay value includes an encryption anti-playback value and an integrity protection anti-playback value
  • the encryption key and the integrity protection key are generated by the user equipment in the authentication and key agreement process according to the preset original key and the random value RAND in the authentication vector. And the integrity protection key; or
  • the encryption key and the integrity protection key are generated by the user equipment according to a preset original key and the MME after the authentication and key agreement process.
  • the small data temporary value acquires the encryption key and the integrity protection key; wherein the preset original key includes Kasme, and the small data temporary value generated by the MME is included in a non-access layer security mode command. .
  • the initial user information received from the base station also includes user temporary values; the user temporary values are used to generate an encryption key and an integrity protection key.
  • the processor 62 executes the instruction 63 1 for:
  • the MME temporary value is generated, and the encryption key and the integrity protection key are obtained according to the preset original key, the user temporary value, and the MME temporary value.
  • the initial context setup request sent to the base station includes an encryption key, an integrity protection key, and an MME temporary value.
  • the processor 62 executes the instruction 63 1 for:
  • the initial context setup request sent to the base station includes a fast service request permission indication.
  • the processor 62 executes the instruction 63 1 for:
  • Receiving the public key and the common algorithm from the key server, the public key and the common algorithm are included in the initial context establishment request sent to the base station.
  • An embodiment of the present invention provides an MME, after receiving initial user information from a base station, the MME sends an initial context setup request including a security context to the base station, so that the base station performs security protection on the specified information according to the security information in the initial context establishment request. Therefore, a mechanism for protecting the specified information is provided, and the specified information can be protected in the wireless connection establishment process, thereby realizing the secure delivery of the specified information.
  • the disclosed methods, devices, and systems may be implemented in other manners.
  • the device embodiments described above are merely illustrative.
  • the division of the unit is only a logical function division.
  • the units described as separate components may or may not be physically separated, and the components displayed as the units may or may not be physical units, and may be located in one place or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the objectives of the embodiment of the present embodiment.
  • each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may be physically included separately, or two or more units may be integrated into one unit.
  • the above integrated unit can be implemented in the form of hardware or in the form of hardware plus software functional units.
  • the above-described integrated unit implemented in the form of a software functional unit can be stored in a computer readable storage medium.
  • the software functional unit described above is stored in a storage medium and includes instructions for causing a computer device (which may be a personal computer, server, or network device, etc.) to perform portions of the steps of the various embodiments of the present invention.
  • the foregoing storage medium includes: a U disk, a mobile hard disk, a Read-Only Memory (ROM), a Random Access Memory (RAM), a disk or an optical disk, and the like, which can store program codes. Medium.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

L'invention concerne un procédé de protection d'informations, une station de base, un équipement utilisateur et une entité de gestion de mobilité, qui concernent le domaine des communications. L'invention concerne un mécanisme de protection d'informations prescrites, qui peut protéger des informations prescrites dans un processus d'établissement de connexion sans fil, ce qui permet de réaliser une émission sécurisée des informations prescrites. Le procédé spécifique comprend : l'envoi, par un équipement utilisateur, d'une demande de connexion de RRC à une station de base ; la protection, par la station de base, des informations prescrites suite à la réception d'une demande de connexion de contexte initiale envoyée par une MME en fonction d'une clé et d'un algorithme indiqué par la demande de connexion de contexte initiale pour générer des informations protégées, et l'envoi d'un message d'établissement de connexion de RRC contenant les informations protégées à l'équipement utilisateur ; puis la vérification, par l'équipement utilisateur, du message d'établissement de connexion de RRC et le décryptage des informations protégées afin d'obtenir les informations prescrites. Les modes de réalisation de la présente invention sont destinés à protéger des informations prescrites dans un processus d'établissement de connexion sans fil.
PCT/CN2014/073008 2014-03-06 2014-03-06 Procédé de protection d'informations, station de base, équipement utilisateur et entité de gestion de mobilité WO2015131379A1 (fr)

Priority Applications (2)

Application Number Priority Date Filing Date Title
CN201480001772.5A CN105191479A (zh) 2014-03-06 2014-03-06 一种信息保护方法、基站、用户设备和移动管理实体
PCT/CN2014/073008 WO2015131379A1 (fr) 2014-03-06 2014-03-06 Procédé de protection d'informations, station de base, équipement utilisateur et entité de gestion de mobilité

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2014/073008 WO2015131379A1 (fr) 2014-03-06 2014-03-06 Procédé de protection d'informations, station de base, équipement utilisateur et entité de gestion de mobilité

Publications (1)

Publication Number Publication Date
WO2015131379A1 true WO2015131379A1 (fr) 2015-09-11

Family

ID=54054383

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2014/073008 WO2015131379A1 (fr) 2014-03-06 2014-03-06 Procédé de protection d'informations, station de base, équipement utilisateur et entité de gestion de mobilité

Country Status (2)

Country Link
CN (1) CN105191479A (fr)
WO (1) WO2015131379A1 (fr)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108702288A (zh) * 2016-03-01 2018-10-23 华为技术有限公司 数据传输方法、设备及系统
WO2022056733A1 (fr) * 2020-09-16 2022-03-24 Apple Inc. Protection de sécurité sur consentement d'utilisateur pour le traitement informatique en périphérie

Families Citing this family (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US10917789B2 (en) * 2017-04-21 2021-02-09 Nokia Technologies Oy Radio link recovery for user equipment
CN110896683A (zh) * 2017-06-01 2020-03-20 华为国际有限公司 数据保护方法、装置以及系统
RU2746923C1 (ru) * 2018-02-15 2021-04-22 Телефонактиеболагет Лм Эрикссон (Пабл) Способ для улучшения безопасности передачи данных
CN110830988B (zh) * 2018-08-08 2023-08-15 维沃移动通信有限公司 一种安全更新方法、网络设备及终端
CN111866884B (zh) * 2019-04-26 2022-05-24 华为技术有限公司 一种安全保护方法及装置

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20110292893A1 (en) * 2010-05-26 2011-12-01 Lg Electronics Inc. Nas-based signaling protocol for overload protection of random access in massive machine type communication
CN102986258A (zh) * 2010-05-03 2013-03-20 三星电子株式会社 在移动通信系统中递送短消息服务消息的方法和系统
CN103220720A (zh) * 2012-01-21 2013-07-24 中兴通讯股份有限公司 一种网络控制负载的方法、系统及网络侧网元

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102986258A (zh) * 2010-05-03 2013-03-20 三星电子株式会社 在移动通信系统中递送短消息服务消息的方法和系统
US20110292893A1 (en) * 2010-05-26 2011-12-01 Lg Electronics Inc. Nas-based signaling protocol for overload protection of random access in massive machine type communication
CN103220720A (zh) * 2012-01-21 2013-07-24 中兴通讯股份有限公司 一种网络控制负载的方法、系统及网络侧网元

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108702288A (zh) * 2016-03-01 2018-10-23 华为技术有限公司 数据传输方法、设备及系统
EP3410629A4 (fr) * 2016-03-01 2018-12-12 Huawei Technologies Co., Ltd. Procédé, dispositif et système de transmission de données
US10673611B2 (en) 2016-03-01 2020-06-02 Huawei Technologies Co., Ltd. Data transmission method, device, and system
WO2022056733A1 (fr) * 2020-09-16 2022-03-24 Apple Inc. Protection de sécurité sur consentement d'utilisateur pour le traitement informatique en périphérie

Also Published As

Publication number Publication date
CN105191479A (zh) 2015-12-23

Similar Documents

Publication Publication Date Title
US11178584B2 (en) Access method, device and system for user equipment (UE)
CN108781366B (zh) 用于5g技术的认证机制
JP4649513B2 (ja) 無線携帯インターネットシステムの認証方法及び関連キー生成方法
KR101554396B1 (ko) 통신 시스템들에서 가입자 인증과 디바이스 인증을 바인딩하는 방법 및 장치
US8787572B1 (en) Enhanced association for access points
WO2015131379A1 (fr) Procédé de protection d'informations, station de base, équipement utilisateur et entité de gestion de mobilité
US20190306684A1 (en) Mtc key management for key derivation at both ue and network
KR102062162B1 (ko) 보안 인증 방법, 구성 방법 및 관련 기기
US20200228977A1 (en) Parameter Protection Method And Device, And System
WO2016134536A1 (fr) Procédé, dispositif et système de génération de clé
US11303622B2 (en) Key distribution method, key receiving method, first key management system, and first network element
CN109922474B (zh) 触发网络鉴权的方法及相关设备
WO2009094942A1 (fr) Procédé et système de réseau de communication pour établir une conjonction de sécurité
WO2014180352A1 (fr) Procede, dispositif et systeme pour configurer un dispositif sans fil
WO2014134786A1 (fr) Procédé et appareil d'interaction de clés
WO2012097723A1 (fr) Procédé, entité côté réseau et terminal de communications pour protéger la sécurité des données
WO2014169451A1 (fr) Procédé et dispositif pour la transmission de données
CN106131834B (zh) 网络连接方法、网络连接装置和终端
WO2008006312A1 (fr) Procédé de fourniture de service push de gaa et dispositif associé
WO2016023198A1 (fr) Procédé de commutation et système de commutation entre des réseaux hétérogènes
US20230179400A1 (en) Key management method and communication apparatus
EP2389031B1 (fr) Procédé et système de transfert intercellulaire sécurisé
WO2015106387A1 (fr) Procédé de vérification de clé, station de base, dispositif d'utilisateur, et élément de réseau central
CN111163468A (zh) 一种通信连接方法及设备
CN105393567B (zh) 数据的安全传输方法和设备

Legal Events

Date Code Title Description
WWE Wipo information: entry into national phase

Ref document number: 201480001772.5

Country of ref document: CN

121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 14884913

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 14884913

Country of ref document: EP

Kind code of ref document: A1