WO2015139434A1

WO2015139434A1 - Method and apparatus for determining a security algorithm

Info

Publication number: WO2015139434A1
Application number: PCT/CN2014/086764
Authority: WO
Inventors: 李阳; 林兆骥; 游世林
Original assignee: 中兴通讯股份有限公司
Priority date: 2014-03-21
Filing date: 2014-09-17
Publication date: 2015-09-24
Also published as: CN104936171B; CN104936171A

Abstract

Disclosed in the present invention are a method and apparatus for determining a security algorithm; within said method, a secondary eNodeB (SeNB) receives a request message from a macro eNodeB; on the basis of UE security capability information carried in the request message, whether the request message carries a security algorithm recommended by the macro eNodeB for the secondary eNodeB, and the security algorithms supported by the secondary eNodeB, the secondary eNodeB determines the security algorithm to be used by same. The technical solution provided by the present invention enables an SeNB to determine its own selection of security algorithm, and can effectively reduce the degree of complexity of encryption security protection between an SeNB and UE.

Description

Method and device for determining security algorithm

Technical field

The present invention relates to the field of communications, and in particular to a method and apparatus for determining a security algorithm.

Background technique

The Long Term Evolution (LTE) network consists of an Evolved Universal Terrestrial Radio Access Network (E-UTRAN) and an Evolved Packet Core (EPC). Its network is flat. The EUTRAN is connected to the EPC through an S1 interface, where the EUTRAN is composed of a plurality of interconnected Evolved NodeBs (eNBs), and the eNBs are connected through an X2 interface. The EPC is composed of a Mobility Management Entity (MME) and a Serving Gateway (S-GW). In addition, there is a Home Environment (hereinafter referred to as HE) in the system architecture, that is, a Home Subscriber Server (HSS) or a Home Location Register (HLR) as a user database. It can contain user profiles, perform user authentication and authorization, and can provide information about the user's physical location.

In order to meet the growing demand for large-bandwidth, high-speed mobile access, the Third Generation Partnership Projects (3GPP) has introduced the Long-Term Evolution advance (LTE-Advanced) standard. . LTE-Advanced retains the core of LTE for the evolution of LTE systems. Based on this, a series of technologies are used to expand the frequency domain and airspace to improve spectrum utilization and increase system capacity. In some application scenarios, a small cell (Small Cell, SC for short) enhancement technology is used to improve user throughput.

The main implementation of SC enhancement technology is dual connectivity. FIG. 1 is a schematic diagram of networking including a slave base station according to the related art. As shown in FIG. 1, one user equipment (UE) simultaneously connects two cells, one of which is a primary cell (Macro Cell) and the other is a secondary cell (Small cell). The base station where the primary cell is located is referred to as a primary base station (Macro eNodeB, abbreviated as MeNB), and the base station where the secondary cell is located is referred to as a secondary eNodeB (or secondary eNodeB, SeNB for short). The signaling plane function between the UE and the base station can be completed by the primary base station, and the user plane can be completed by the UE together with the primary base station and the secondary base station, that is, the UE has both a user plane connection with the primary base station and a user plane with the secondary base station. Connection, which is referred to as dual connection.

The main technology of dual connectivity is the allocation of user plane protocol stack functions between the primary base station and the secondary base station. There are several alternative solutions in the related art, the most important one of which uses the user plane of the primary base station. The control plane remains unchanged, and the user plane protocol stack of the base station can include all layers from the Packet Data Convergence Protocol (PDCP) layer to the Physical Layer (PHY) layer. The base station is directly connected to the S-GW, and the interface S1-U between the two is exactly the same as that used previously. On the air interface, the UE directly connects with the secondary base station to deliver the data radio bearer (DRB) to which the UE is transferred.

The algorithm used by the air interface security between the UE and the MeNB is completed by an algorithm negotiation process of the LTE system. After the MeNB transfers the partial DRB of the UE to the SeNB, an algorithm negotiation process needs to exist between the SeNB and the UE in order to implement encryption protection. The currently discussed method may be that the MeNB learns the algorithm supported by the SeNB, or configures an algorithm supported by the SeNB on the MeNB, and then the MeNB replaces the SeNB to select an algorithm, and the MeNB notifies the UE and the SeNB of the selected algorithm. Although this method is feasible, it has two main defects:

First, the algorithm between the SeNB and the UE is not determined by the SeNB itself, but is completed by the MeNB, and the algorithm adopted by the device in the existing LTE is inconsistently selected by itself;

Second, the number of SeNBs is large, and learning or configuration will bring certain complexity to the system.

In summary, the encryption security protection method between the UE and the SeNB used in the related art is not determined by the SeNB itself and the implementation process is complicated.

Summary of the invention

The embodiments of the present invention provide a method and a device for determining a security algorithm, so as to at least solve the problem that the encryption security protection between the UE and the SeNB in the related art is not determined by the SeNB itself and the implementation process is complicated.

According to an aspect of the present invention, a method of determining a security algorithm is provided.

The determining method of the security algorithm according to the embodiment of the present invention includes: receiving a request message from the base station from the base station; and determining, by the base station, the security capability information of the UE carried in the request message, whether the request message carries the recommended by the primary base station to the secondary base station The security algorithm and the security algorithm supported by the base station itself determine the security algorithm to be used by itself.

Preferably, determining, by the base station, the security algorithm to be used includes: determining, by the base station, a plurality of security algorithms supported by the local and the UE according to the locally supported security algorithm and the security algorithm supported by the UE; if the request message does not carry the recommended security algorithm, The base station selects the security algorithm with the highest priority according to the preset priority order of multiple security algorithms as the security algorithm to be used.

Preferably, after determining the security algorithm to be used from the base station, the method further includes: sending, by the base station, the security algorithm to be used to the UE by using the primary base station.

Preferably, selecting a security algorithm to be used from the base station includes: determining, by the base station, a plurality of security algorithms supported by the local and the UE according to the locally supported security algorithm and the security algorithm supported by the UE; if the request message carries the recommended security algorithm, The base station determines whether the recommended security algorithm is included in the multiple security algorithms; if so, the recommended security algorithm is selected from the base station as the security algorithm to be used.

Preferably, after selecting the security algorithm to be used from the base station, the method further includes: the base station does not carry the security algorithm to be used in the response message returned to the primary base station; the UE continues to use the security algorithm currently used for communication with the primary base station. .

Preferably, selecting a security algorithm to be used from the base station includes: determining, by the base station, a plurality of security algorithms supported by the local and the UE according to the locally supported security algorithm and the security algorithm supported by the UE; if the request message carries the recommended security algorithm, The base station determines whether the recommended security algorithm is included in the multiple security algorithms. If not, the base station selects the security algorithm with the highest priority as the security algorithm to be used according to the preset priority ranking of the multiple security algorithms.

Preferably, after selecting the security algorithm to be used from the base station, the method further includes: sending, by the base station, the security algorithm to be used to the UE by using the primary base station; and using the security algorithm to be used between the UE and the secondary base station.

Preferably, the recommended security algorithm is the security algorithm currently used for communication between the primary base station and the UE.

Preferably, the manner in which the primary base station sends the recommended security algorithm to the secondary base station is one of the following: the primary base station configures a parameter in a preset field of the request message, where the parameter is used to indicate a security algorithm provided by the primary base station to the secondary base station; The base station adjusts the priority order of the multiple security algorithms supported in the security capability information of the UE by sending a request message to the secondary base station.

According to another aspect of the present invention, a determining apparatus of a security algorithm is provided.

The determining apparatus of the security algorithm according to the embodiment of the present invention includes: a receiving module, configured to receive a request message from the primary base station; and a determining module, configured to: according to the security capability information of the UE carried in the request message, whether the request message carries the master The security algorithm recommended by the base station to itself and the security algorithm supported by the base station itself determine the security algorithm to be used by itself.

Preferably, the determining module includes: a first determining unit, configured to determine, according to the locally supported security algorithm and the security algorithm supported by the UE, multiple security algorithms supported by the local and the UE; the first selecting unit is set to be When the message does not carry the recommended security algorithm, the security algorithm with the highest priority is selected as the security algorithm to be used according to the preset priority ranking of multiple security algorithms.

Preferably, the determining module includes: a second determining unit, configured to determine, according to the locally supported security algorithm and the security algorithm supported by the UE, multiple security algorithms supported by the local and the UE; the first determining unit is configured to carry the request message When the recommended security algorithm is used, it is determined whether the recommended security algorithm is included in the multiple security algorithms. The second selection unit is configured to select the recommended security algorithm as the security algorithm to be used when the output of the first determining unit is YES.

Preferably, the determining module includes: a third determining unit, configured to determine a plurality of security algorithms supported by the local and the UE according to the locally supported security algorithm and the security algorithm supported by the UE; and the second determining unit is configured to carry the request message When the recommended security algorithm is used, it is determined whether the recommended security algorithm is included in the multiple security algorithms; and the third selecting unit is configured to sort the priorities of the multiple security algorithms according to the preset when the output of the second determining unit is negative. Select the security algorithm with the highest priority as the security algorithm to be used.

Preferably, the apparatus further includes: a sending module, configured to send the security algorithm to be used to the UE via the primary base station.

According to the embodiment of the present invention, the request message from the base station is received from the base station; the security capability information of the UE carried by the base station according to the request message, whether the request message carries the security algorithm recommended by the primary base station to the secondary base station, and the secondary base station itself The supported security algorithm determines the security algorithm to be used by itself, that is, the primary base station, the secondary base station, and the UE participate in the negotiation process of the security algorithm, and the secondary base station can select according to the security capability information of the UE and whether the primary base station recommends the security algorithm to itself. The security algorithm is used to solve the problem that the encryption security protection between the UE and the SeNB in the related art is not determined by the SeNB itself and the implementation process is complicated, and the SeNB can determine the security algorithm selected by the SeNB, and can effectively The complexity of the encryption security protection between the UE and the SeNB is reduced.

DRAWINGS

The drawings described herein are intended to provide a further understanding of the invention, and are intended to be a part of the invention. In the drawing:

1 is a schematic diagram of networking including a slave base station according to the related art;

2 is a flowchart of a method for determining a security algorithm according to an embodiment of the present invention;

3 is a flow chart of algorithm negotiation with MeNB recommendation in accordance with a preferred embodiment of the present invention;

4 is a flow chart of algorithm negotiation without MeNB recommendation in accordance with a preferred embodiment of the present invention;

FIG. 5 is a structural block diagram of a determining apparatus of a security algorithm according to an embodiment of the present invention; FIG.

FIG. 6 is a structural block diagram of a determining apparatus of a security algorithm according to a preferred embodiment of the present invention.

detailed description

The invention will be described in detail below with reference to the drawings in conjunction with the embodiments. It should be noted that the embodiments in the present application and the features in the embodiments may be combined with each other without conflict.

2 is a flow chart of a method of determining a security algorithm in accordance with an embodiment of the present invention. As shown in FIG. 2, the method may include the following processing steps:

Step S202: Receive a request message from the base station from the base station;

Step S204: The slave base station determines, according to the security capability information of the UE carried in the request message, whether the request message carries a security algorithm recommended by the primary base station to the secondary base station, and a security algorithm supported by the base station itself to determine a security algorithm to be used.

The cryptographic security protection between the UE and the SeNB in the related art is not determined by the SeNB itself and the implementation process is complicated. As shown in FIG. 2, the primary base station, the secondary base station, and the UE participate in the negotiation process of the security algorithm, and the secondary base station can determine the manner of selecting the security algorithm according to the security capability information of the UE and whether the primary base station recommends the security algorithm to itself. Therefore, the problem that the encryption security protection between the UE and the SeNB in the related art is not determined by the SeNB itself and the implementation process is complicated, and the SeNB determines the security algorithm selected by the SeNB, and can effectively reduce the UE and the UE. The complexity of cryptographic security protection between SeNBs.

In a preferred implementation, the above-mentioned recommended security algorithm may be a security algorithm currently used for communication between the primary base station and the UE.

In a preferred implementation process, the manner in which the primary base station sends the recommended security algorithm to the secondary base station may be one of the following:

Manner 1: The primary base station configures parameters in a preset field of the request message, where the parameter is used to indicate a security algorithm provided by the primary base station to the secondary base station; for example, writing 0 in the preset field indicates that the security algorithm 1 is recommended, and writing Enter 1 to recommend the security algorithm 2.

Manner 2: The primary base station adjusts the priority order of multiple security algorithms supported by the security capability information of the UE by sending a request message to the secondary base station. For example, the UE supports the security algorithm 1, the security algorithm 2, and the security algorithm 3, and the priority is from high to low, which are security algorithm 1, security algorithm 2, and security algorithm 3. The primary base station can adjust the prioritization by sending a request message to the secondary base station, and adjust the security algorithm 2 to the security algorithm with the highest priority.

Preferably, in step S204, determining, by the base station, the security algorithm to be used may include the following operations:

Step S1: The base station determines multiple security algorithms supported by the local and the UE according to the locally supported security algorithm and the security algorithm supported by the UE.

Step S2: If the request message does not carry the recommended security algorithm, the base station selects the security algorithm with the highest priority as the security algorithm to be used according to the preset priority order of the multiple security algorithms.

In a preferred embodiment, it is assumed that the security algorithm 1, the security algorithm 2, the security algorithm 3, the security algorithm 4, the security algorithm 5, and the UE support the security algorithm 1, the security algorithm 3, and the security algorithm 4 are supported locally from the base station. The intersection (ie, the commonly supported security algorithms) is Security Algorithm 1, Security Algorithm 3, and Security Algorithm 4. The priorities preset from the base station are preset from high to low: security algorithm 3, security algorithm 1, and security algorithm 4. Therefore, the slave station will select the security algorithm 3 with the highest priority.

Preferably, after determining the security algorithm to be used from the base station, the following steps may also be included:

Step S3: The security algorithm to be used is sent from the base station to the UE via the primary base station. That is, the base station can send a response message to the primary base station, where the response message carries the security algorithm to be used selected from the base station; and then the primary base station returns a response message to the UE, where the response message carries the selected from the base station. The security algorithm to be used.

Preferably, in step S204, selecting a security algorithm to be used from the base station may include the following steps:

Step S4: The base station determines multiple security algorithms supported by the local and the UE according to the locally supported security algorithm and the security algorithm supported by the UE.

Step S5: If the request message carries the recommended security algorithm, the base station determines whether the recommended security algorithm is included in the multiple security algorithms.

Step S6: If yes, the recommended security algorithm is selected from the base station as the security algorithm to be used.

In a preferred embodiment, it is assumed that the security algorithm 1, the security algorithm 2, the security algorithm 3, the security algorithm 4, the security algorithm 5, and the UE support the security algorithm 1, the security algorithm 3, and the security algorithm 4 are supported locally from the base station. The intersection (ie, the commonly supported security algorithms) is Security Algorithm 1, Security Algorithm 3, and Security Algorithm 4. The security algorithm recommended by the primary base station to the secondary base station is the security algorithm 1, and the base station determines that the security algorithm 1 is a security algorithm supported by the local and the UE. Therefore, the security algorithm 1 is selected as the security algorithm to be selected.

Preferably, after the security algorithm to be used is selected from the base station in step S204, the following operations may also be included:

Step S7: The slave base station does not carry the security algorithm to be used in the response message returned to the primary base station;

Step S8: The UE continues to use the security algorithm currently used for communication with the primary base station.

In a preferred embodiment, if the security algorithm recommended by the primary base station is selected from the base station, and the recommended security algorithm is usually a security algorithm used by the current UE to communicate with the primary base station, the response of the secondary base station to the primary base station is returned. The recommended security algorithm is not required to be carried in the message and in the response message returned by the primary base station to the UE. The UE can continue to use the security algorithm currently used to communicate with the primary base station.

Step S9: The base station determines multiple security algorithms supported by the local and the UE according to the locally supported security algorithm and the security algorithm supported by the UE.

Step S10: If the request message carries the recommended security algorithm, the base station determines whether the recommended security algorithm is included in the multiple security algorithms.

Step S11: If no, the base station selects the security algorithm with the highest priority according to the preset priority order of the multiple security algorithms as the security algorithm to be used.

In a preferred embodiment, it is assumed that the security algorithm 1, the security algorithm 2, the security algorithm 3, the security algorithm 4, the security algorithm 5, and the UE support the security algorithm 1, the security algorithm 3, and the security algorithm 4 are supported locally from the base station. The intersection (ie, the commonly supported security algorithms) is Security Algorithm 1, Security Algorithm 3, and Security Algorithm 4. The security algorithm recommended by the primary base station to the secondary base station is the security algorithm 6. The base station determines that the security algorithm 6 is not a security algorithm supported by the local and the UE, and the priorities preset from the base station are preset from high to low: Security algorithm 3, security algorithm 1, security algorithm 4. Therefore, the slave station will select the security algorithm 3 with the highest priority.

It should be noted that when the base station selects the security algorithm to be used by the base station, the security algorithm recommended by the base station and the UE and recommended by the primary base station to the secondary base station should be selected first. Secondly, the secondary base station cannot support the primary base station recommendation. In the case of the security algorithm, the security algorithm with the highest priority supported by both the base station and the UE is selected.

Step S12: The security algorithm to be used is sent from the base station to the UE via the primary base station;

Step S13: The UE uses a security algorithm to be used between the UE and the secondary base station.

As a preferred embodiment of the present invention, FIG. 3 is a flowchart of algorithm negotiation with MeNB recommendation in accordance with a preferred embodiment of the present invention. As shown in FIG. 3, a scenario in which the MeNB recommends a security algorithm to the SeNB and the SeNB negotiates a security algorithm with the UE is described in the preferred embodiment. The process can include the following processing steps:

Step S302: The radio resource control (RRC) connection and the DRBs are established between the UE and the MeNB, and the UE reports the security capability information to the MeNB, where the security capability information may include: security algorithm information, and the security algorithm information may include: an encryption algorithm and integrity. Protection algorithm.

Step S304: The MeNB sends an add/modify DRB request message to the SeNB, where the request message carries the security capability information of the UE and an encryption algorithm recommended by the MeNB to the SeNB.

In the preferred embodiment, the algorithm recommended by the MeNB can also be implemented by adjusting the priority of the UE supporting algorithm, so that the SeNB only needs to negotiate according to the algorithm supported by the UE and the algorithm supported by the SeNB.

Step S306: The SeNB may preferentially select the UE security capability support, the SeNB support, and the algorithm recommended by the MeNB. Secondly, the UE security capability support, the SeNB supported, and the high priority algorithm are selected.

If the algorithm selected by the SeNB is recommended by the MeNB, it may not be necessary to carry a security algorithm in subsequent steps, whereby the UE can use the algorithm used to communicate with the MeNB.

Step S308: The SeNB sends an add/modify DRB command message to the MeNB, where the command message carries a security algorithm, and the security algorithm may be identified by using an algorithm identifier.

Step S310: The MeNB instructs the UE to connect to the SeNB by using an RRC connection reconfiguration request message, where the request message carries the identification information of the security algorithm.

Step S312: The UE returns an RRC connection reconfiguration response message to the MeNB.

As another preferred embodiment of the present invention, FIG. 4 is a flow chart of algorithm negotiation without MeNB recommendation in accordance with a preferred embodiment of the present invention. As shown in FIG. 4, a scenario in which the MeNB does not recommend a security algorithm to the SeNB and the SeNB negotiates a security algorithm with the UE is described in the preferred embodiment. The process can include the following processing steps:

Step S402: The radio resource control (RRC) connection and the DRBs are established between the UE and the MeNB, and the UE reports the security capability information to the MeNB, where the security capability information may include: security algorithm information, and the security algorithm information may include: an encryption algorithm and integrity. Protection algorithm.

Step S404: The MeNB sends an add/modify DRB request message to the SeNB, where the request message carries only the security capability information of the UE.

Step S406: The SeNB may select a UE with high security priority support and a high priority algorithm supported by the SeNB.

Step S408: The SeNB sends an add/modify DRB command message to the MeNB, where the command message carries a security algorithm, and the security algorithm may be identified by using an algorithm identifier.

Step S410: The MeNB indicates that the UE is connected to the SeNB by using an RRC connection reconfiguration request message, where the request message carries the identification information of the security algorithm.

Step S412: The UE returns an RRC connection reconfiguration response message to the MeNB.

FIG. 5 is a structural block diagram of a determining apparatus of a security algorithm according to an embodiment of the present invention. The device may be disposed on the slave base station side. As shown in FIG. 5, the determining apparatus of the security algorithm may include: a receiving module 10 configured to receive a request message from the primary base station; and a determining module 20 configured to carry according to the request message The security capability information of the UE, whether the request message carries the security algorithm recommended by the primary base station to itself, and the security algorithm supported by the base station itself determine the security algorithm to be used by itself.

The apparatus shown in FIG. 5 solves the problem that the encryption security protection between the UE and the SeNB in the related art is not determined by the SeNB itself and the implementation process is complicated, and the security algorithm selected by the SeNB can be implemented, and The complexity of encryption security protection between the UE and the SeNB can be effectively reduced.

Manner 1: The primary base station configures parameters in a preset field of the request message, where the parameter is used to indicate a security algorithm provided by the primary base station to the secondary base station;

Manner 2: The primary base station adjusts the priority order of multiple security algorithms supported by the security capability information of the UE by sending a request message to the secondary base station.

Preferably, as shown in FIG. 6, the determining module 20 may include: a first determining unit 200, configured to determine multiple security algorithms supported by the local and the UE according to the locally supported security algorithm and the security algorithm supported by the UE; The unit 202 is configured to select the security algorithm with the highest priority as the security algorithm to be used according to the preset priority ranking of the multiple security algorithms when the request message does not carry the recommended security algorithm.

Preferably, as shown in FIG. 6, the determining module 20 may include: a second determining unit 204, configured to determine multiple security algorithms supported by the local and the UE according to the locally supported security algorithm and the security algorithm supported by the UE; The unit 206 is configured to determine whether the recommended security algorithm is included in the multiple security algorithms when the request message carries the recommended security algorithm. The second selecting unit 208 is configured to select the recommendation when the output of the first determining unit is yes. The security algorithm acts as a security algorithm to be used.

Preferably, as shown in FIG. 6, the determining module 20 may include: a third determining unit 210, configured to determine, according to the locally supported security algorithm and the security algorithm supported by the UE, multiple security algorithms supported by the local and the UE; The unit 212 is configured to determine whether the recommended security algorithm is included in the multiple security algorithms when the request message carries the recommended security algorithm. The third selecting unit 214 is configured to: when the output of the second determining unit is negative, The priority ranking of multiple security algorithms is set to select the security algorithm with the highest priority as the security algorithm to be used.

Preferably, as shown in FIG. 6, the apparatus may further include: a sending module 30, configured to send a security algorithm to be used to the UE via the primary base station.

From the above description, it can be seen that the above embodiments achieve the following technical effects (it is required that the effects are achievable by some preferred embodiments): by using the technical solution provided by the embodiment of the present invention, The base station and the terminal negotiate an optimal encryption algorithm. Since the negotiation process has the participation of the primary base station, the secondary base station, and the terminal, the primary base station can recommend an algorithm to the secondary base station, and the secondary base station can support the algorithm of the UE security capability and support itself. The algorithm and the algorithm recommended by the primary base station are comprehensively considered, and finally the security algorithm adopted by itself is determined, so that the encryption security protection between the UE and the SeNB is more easily realized.

It will be apparent to those skilled in the art that the various modules or steps of the present invention described above can be implemented by a general-purpose computing device that can be centralized on a single computing device or distributed across a network of multiple computing devices. Alternatively, they may be implemented by program code executable by the computing device, thereby Storing them in a storage device is performed by a computing device, and in some cases, the steps shown or described may be performed in an order different than that herein, or separately fabricated into individual integrated circuit modules, or Multiple of these modules or steps are fabricated as a single integrated circuit module. Thus, the invention is not limited to any specific combination of hardware and software.

The above description is only the preferred embodiment of the present invention, and is not intended to limit the present invention, and various modifications and changes can be made to the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and scope of the present invention are intended to be included within the scope of the present invention.

Industrial applicability

As described above, the method and apparatus for determining a security algorithm provided by the embodiments of the present invention have the following beneficial effects: the base station and the terminal negotiate an optimal encryption algorithm, and the negotiation process includes a primary base station, a secondary base station, and a terminal. Participating, the primary base station can recommend an algorithm to the secondary base station, and the base station can comprehensively consider the algorithm supported by the UE security capability, the algorithm supported by itself, and the algorithm recommended by the primary base station, and finally determine the security algorithm adopted by itself, so it is easier to implement the UE and Encryption security protection between SeNBs.

Claims

A method for determining a security algorithm, comprising:

Receiving a request message from the base station from the base station;

The slave base station according to the security capability information of the user equipment UE carried in the request message, whether the request message carries a security algorithm recommended by the primary base station to the secondary base station, and a security algorithm supported by the slave base station itself Determine the security algorithm you want to use.
The method of claim 1, wherein the determining, by the base station, the security algorithm to be used comprises:

Determining, by the base station, multiple security algorithms supported by the local and the UE according to the locally supported security algorithm and the security algorithm supported by the UE;

If the request message does not carry the recommended security algorithm, the slave base station selects the security algorithm with the highest priority as the security algorithm to be used according to the preset priority order of the multiple security algorithms.
The method according to claim 2, wherein after the determining, by the base station, the security algorithm to be used, the method further comprises:

The slave base station transmits the to-be-used security algorithm to the UE via the primary base station.
The method according to claim 1, wherein the selecting the security algorithm to be used from the base station comprises:

Determining, by the base station, multiple security algorithms supported by the local and the UE according to the locally supported security algorithm and the security algorithm supported by the UE;

If the request message carries the recommended security algorithm, the slave base station determines whether the recommended security algorithm is included in the multiple security algorithms;

If yes, the slave base station selects the recommended security algorithm as the security algorithm to be used.
The method according to claim 4, wherein after the slave base station selects the security algorithm to be used, the method further includes:

The slave base station does not carry the security algorithm to be used in the response message returned to the primary base station;

The UE continues to use the security algorithm currently used to communicate with the primary base station.
The method according to claim 1, wherein the selecting the security algorithm to be used from the base station comprises:

Determining, by the base station, multiple security algorithms supported by the local and the UE according to the locally supported security algorithm and the security algorithm supported by the UE;

If the request message carries the recommended security algorithm, the slave base station determines whether the recommended security algorithm is included in the multiple security algorithms;

If not, the slave base station selects the security algorithm with the highest priority according to the preset priority order of the multiple security algorithms as the security algorithm to be used.
The method according to claim 6, wherein after the slave base station selects the security algorithm to be used, the method further includes:

Sending, by the base station, the security algorithm to be used to the UE via the primary base station;

The UE uses the security algorithm to be used between the UE and the secondary base station.
The method according to any one of claims 1 to 7, wherein the recommended security algorithm is a security algorithm currently used for communication between the primary base station and the UE.
The method according to any one of claims 1 to 7, wherein the manner in which the primary base station transmits the recommended security algorithm to the secondary base station is one of the following:

The primary base station configures a parameter in a preset field of the request message, where the parameter is used to indicate a security algorithm that is provided by the primary base station to the secondary base station;

The primary base station adjusts a priority order of multiple security algorithms supported by the security capability information of the UE by sending the request message to the secondary base station.
A determining device for a security algorithm, comprising:

a receiving module, configured to receive a request message from the primary base station;

a determining module, configured to determine, according to security capability information of the user equipment UE carried in the request message, whether the request message carries a security algorithm recommended by the primary base station to itself, and a security algorithm supported by the base station itself The security algorithm to be used.
The apparatus of claim 10, wherein the determining module comprises:

a first determining unit, configured to determine, according to the locally supported security algorithm and the security algorithm supported by the UE, multiple security algorithms supported by the local and the UE;

a first selecting unit, configured to: when the request message does not carry the recommended security algorithm, select a security algorithm with the highest priority according to a preset priority ranking of the multiple security algorithms as the to-be-used Security algorithm.
The apparatus of claim 10, wherein the determining module comprises:

a second determining unit, configured to determine, according to the locally supported security algorithm and the security algorithm supported by the UE, multiple security algorithms supported by the local and the UE;

a first determining unit, configured to determine, when the request message carries the recommended security algorithm, whether the recommended security algorithm is included in the multiple security algorithms;

And a second selecting unit, configured to: when the output of the first determining unit is YES, select the recommended security algorithm as the security algorithm to be used.
The apparatus of claim 10, wherein the determining module comprises:

a third determining unit, configured to determine, according to the locally supported security algorithm and the security algorithm supported by the UE, multiple security algorithms supported by the local and the UE;

a second determining unit, configured to determine, when the request message carries the recommended security algorithm, whether the recommended security algorithm is included in the multiple security algorithms;

And a third selecting unit, configured to: when the output of the second determining unit is negative, select a security algorithm with the highest priority according to a preset priority order of the multiple security algorithms as the security algorithm to be used.
The device of claim 10, wherein the device further comprises:

And a sending module, configured to send the to-be-used security algorithm to the UE via the primary base station.
The apparatus of any one of claims 10 to 14, wherein the recommended security algorithm is a security algorithm currently used for communication between the primary base station and the UE.
The apparatus according to any one of claims 10 to 14, wherein the manner in which the primary base station transmits the recommended security algorithm to the secondary base station is one of the following:

The primary base station configures a parameter in a preset field of the request message, where the parameter is used to indicate a security algorithm that is provided by the primary base station to the secondary base station;

The primary base station adjusts a priority order of multiple security algorithms supported by the security capability information of the UE by sending the request message to the secondary base station.