WO2015139596A1 - 密钥生成方法、主基站、辅基站及用户设备 - Google Patents

密钥生成方法、主基站、辅基站及用户设备 Download PDF

Info

Publication number
WO2015139596A1
WO2015139596A1 PCT/CN2015/074324 CN2015074324W WO2015139596A1 WO 2015139596 A1 WO2015139596 A1 WO 2015139596A1 CN 2015074324 W CN2015074324 W CN 2015074324W WO 2015139596 A1 WO2015139596 A1 WO 2015139596A1
Authority
WO
WIPO (PCT)
Prior art keywords
key
base station
user plane
drb
user equipment
Prior art date
Application number
PCT/CN2015/074324
Other languages
English (en)
French (fr)
Inventor
甘露
吴�荣
何承东
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to ES15765368T priority Critical patent/ES2821818T3/es
Priority to EP20179098.7A priority patent/EP3768039B1/en
Priority to EP15765368.4A priority patent/EP3163923B1/en
Publication of WO2015139596A1 publication Critical patent/WO2015139596A1/zh
Priority to US15/268,808 priority patent/US20170005795A1/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/041—Key generation or derivation
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W76/00—Connection management
    • H04W76/10—Connection setup
    • H04W76/11—Allocation or use of connection identifiers
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
    • H04L63/061—Network architectures or network communication protocols for network security for supporting key management in a packet data network for key exchange, e.g. in peer-to-peer networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/12—Applying verification of the received information
    • H04L63/123—Applying verification of the received information received data contents, e.g. message integrity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H04L9/0869—Generation of secret information including derivation or calculation of cryptographic keys or passwords involving random numbers or seeds
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/03—Protecting confidentiality, e.g. by encryption
    • H04W12/033—Protecting confidentiality, e.g. by encryption of the user plane, e.g. user's traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2463/00—Additional details relating to network architectures or network communication protocols for network security covered by H04L63/00
    • H04L2463/061—Additional details relating to network architectures or network communication protocols for network security covered by H04L63/00 applying further key derivation, e.g. deriving traffic keys from a pair-wise master key
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/10—Integrity
    • H04W12/106—Packet or message integrity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W84/00—Network topologies
    • H04W84/02—Hierarchically pre-organised networks, e.g. paging networks, cellular networks, WLAN [Wireless Local Area Network] or WLL [Wireless Local Loop]
    • H04W84/04—Large scale networks; Deep hierarchical networks
    • H04W84/042—Public Land Mobile systems, e.g. cellular systems
    • H04W84/045—Public Land Mobile systems, e.g. cellular systems using private Base Stations, e.g. femto Base Stations, home Node B

Definitions

  • the present invention relates to the field of communications technologies, and in particular, to a key generation method, a primary base station, a secondary base station, and a user equipment.
  • the user equipment in order to improve the user plane data throughput rate of the user equipment, the user equipment can be simultaneously connected to one primary base station (MeNB, Master eNB) and one secondary base station (SeNB, Secondary eNB), and the user equipment can simultaneously The base station and the secondary base station transmit user plane data.
  • the primary base station is a macro base station (Marco eNB/cell)
  • the secondary base station is a small base station (Small eNB/cell)
  • the small base station is specifically a micro base station (Pico eNB/cell) or a femto eNB/cell.
  • the user plane key of the user equipment and the secondary base station is generated by the primary base station and sent to the user equipment and the secondary base station, causing the primary base station to be overloaded, and only for the same user equipment and the secondary base station.
  • a user plane key is generated, that is, all user plane keys between the secondary base station and the same user equipment are the same. If one user plane key between the user equipment and the secondary base station is compromised, the same user equipment and the secondary All user plane keys between base stations are compromised.
  • the existing key generation method causes the primary base station to be overloaded, and the user plane key security between the generated user equipment and the secondary base station is low.
  • the embodiment of the present invention provides a key generation method, a primary base station, a secondary base station, and a user equipment, so as to reduce the load of the primary base station and improve the security of the user plane key between the user equipment and the secondary base station.
  • an embodiment of the present invention provides a key generation method, where the method includes:
  • the determining the key parameter corresponding to the DRB is specifically: allocating or generating a key parameter for the DRB, where the key parameter includes at least one of the following parameters: DRB ID, random number, counter value.
  • the method before the determining a key parameter corresponding to the DRB, the method further includes: receiving a DRB establishment or a new request sent by the primary base station, where the DRB is established or new The acknowledgment request carries the key parameter.
  • the determining the key parameter corresponding to the DRB is specifically: acquiring the key parameter from the DRB establishment or a new request, where the key parameter includes: a DRB ID.
  • the key parameter is specifically: sending, by the primary base station, the key parameter to the user equipment.
  • the user plane key is a user plane encryption key or a user plane integrity protection key.
  • an embodiment of the present invention provides a key generation method, where the method includes:
  • the key parameter includes: a DRB ID.
  • the user plane key is a user plane encryption key or a user plane integrity protection key.
  • an embodiment of the present invention provides a secondary base station, where the secondary base station includes:
  • a determining unit configured to determine a key parameter corresponding to the radio data bearer DRB
  • a sending unit configured to send the key parameter to a user equipment corresponding to the DRB, so that the user equipment generates a user plane key according to the key parameter and a basic key generated by the user equipment;
  • a receiving unit configured to receive a basic key generated by the primary base station and sent by the primary base station;
  • a generating unit configured to generate the user plane key according to the key parameter and a basic key generated by the primary base station.
  • the determining unit is specifically configured to: allocate or generate a key parameter for the DRB, where the key parameter includes at least one of the following parameters: a DRB ID, a random Number, counter value.
  • the receiving unit is further configured to: receive a DRB establishment or a new request sent by the primary base station, where the DRB establishment or the new request carries the key parameter;
  • the determining unit is specifically configured to: obtain the key parameter from the DRB establishment or a new request, where the key parameter includes: a DRB ID.
  • the sending unit is specifically configured to:
  • the primary base station transmits the key parameters to the user equipment.
  • the user plane key is a user plane encryption key or a user plane integrity protection key.
  • an embodiment of the present invention provides a primary base station, where the primary base station includes:
  • a determining unit configured to determine a key parameter corresponding to the radio data bearer DRB
  • a sending unit configured to send the key parameter to a user equipment corresponding to the DRB, so that the user equipment generates a user plane key according to the key parameter and a basic key generated by the user equipment;
  • the sending unit is further configured to send the key parameter and the basic key generated by the primary base station to the secondary base station, so that the secondary base station generates the foregoing according to the key parameter and a basic key generated by the primary base station.
  • the user plane key; or the primary base station further includes: a generating unit, configured to generate the user plane key according to the key parameter and a basic key generated by the primary base station, where the sending unit is further configured to The base station transmits the user plane key.
  • the key parameter includes: a DRB ID.
  • the user plane key is a user plane encryption key or a user plane integrity protection key.
  • an embodiment of the present invention provides a user equipment, where the user equipment includes:
  • a receiving unit configured to receive a key parameter corresponding to the radio data bearer DRB sent by the primary base station or the secondary base station;
  • a generating unit configured to generate a user plane key according to the key parameter and the base key.
  • the key parameter includes at least one of the following parameters: a DRB ID, a random number, and a counter value.
  • the user plane key is a user plane encryption key or a user plane integrity protection key.
  • the user plane key between the user equipment and the secondary base station is generated by the user equipment and the secondary base station, respectively, which can effectively reduce the load of the primary base station. And between the same user equipment and the secondary base station Generating different user plane keys for different DRBs can effectively improve the security of the user plane key between the secondary base station and the user equipment.
  • FIG. 1 is a schematic flowchart of a key generation method according to Embodiment 1 of the present invention.
  • FIG. 2 is a signaling diagram of a key generation method according to Embodiment 1 of the present invention.
  • FIG. 3 is a schematic flowchart diagram of a key generation method according to Embodiment 2 of the present invention.
  • FIG. 4 is a signaling diagram of a key generation method according to Embodiment 2 of the present invention.
  • FIG. 5 is a schematic flowchart diagram of a key generation method according to Embodiment 3 of the present invention.
  • FIG. 6 is a signaling diagram of a key generation method according to Embodiment 3 of the present invention.
  • FIG. 7 is a schematic structural diagram of a secondary base station according to Embodiment 4 of the present invention.
  • FIG. 8 is a schematic structural diagram of a secondary base station according to Embodiment 5 of the present invention.
  • FIG. 9 is a schematic structural diagram of a primary base station according to Embodiment 6 of the present invention.
  • FIG. 10 is a schematic structural diagram of a primary base station according to Embodiment 7 of the present invention.
  • FIG. 11 is a schematic structural diagram of a primary base station according to Embodiment 8 of the present invention.
  • FIG. 12 is a schematic structural diagram of a primary base station according to Embodiment 9 of the present invention.
  • FIG. 13 is a schematic structural diagram of a user equipment according to Embodiment 10 of the present invention.
  • FIG. 14 is a schematic structural diagram of a user equipment according to Embodiment 10 of the present invention.
  • FIG. 1 is a schematic flowchart of a key generation method according to Embodiment 1 of the present invention.
  • the execution body of the key generation method is a secondary base station.
  • the secondary base station is a small base station, and the small base station is specifically a micro base station or a milli base station.
  • the key generation method includes the following steps:
  • Step S101 determining a data radio bearer (DRB) corresponding key parameter.
  • DRB data radio bearer
  • the key parameters may be allocated by the secondary base station or by the primary base station.
  • the primary base station is a macro base station.
  • the key parameter includes at least one of the following parameters: a DRB ID, a random number, and a counter value.
  • the secondary base station receives the DRB establishment or the new request sent by the primary base station, and the secondary base station receives or adds the DRB.
  • RRC Radio Resource Control
  • the DRB is allocated to the user equipment, and the DRB ID is assigned to the DRB, and the DRB ID of each DRB is unique. Therefore, the DRB ID can be used as the key parameter corresponding to the DRB.
  • the secondary base station may include a random number generator. After the user equipment establishes an RRC connection with the primary base station, the secondary base station receives the DRB establishment or the new request sent by the primary base station, and the secondary base station receives the DRB establishment or the new request after receiving the DRB establishment or the new request. Allocating a DRB for the user equipment, and then generating a random number for the DRB random number generator, and each random number generated by the random number generator is unique, so the random number can be used as a key parameter corresponding to the DRB. .
  • the secondary base station may further include a counter. After the user equipment establishes an RRC connection with the primary base station, the secondary base station receives the DRB establishment or the new request sent by the primary base station, and after receiving the DRB establishment or new request, the secondary base station is The user equipment allocates a DRB, and then generates a counter value for the DRB counter, and each counter value generated by the counter is unique, so the counter can be The value is used as the key parameter corresponding to the DRB.
  • step S101 if the key parameter is allocated by the primary base station, before step S101, the following steps are further included:
  • the DRB establishing or adding a request carries a key parameter.
  • the key parameter only includes: DRB ID.
  • the primary base station allocates a DRB to the user equipment, and the DRB ID of each DRB is unique. Therefore, the DRB ID can be used as the key parameter corresponding to the DRB.
  • step S101 is specifically: acquiring a key parameter from the received DRB establishment or adding request.
  • Step S102 Send the key parameter to the user equipment corresponding to the DRB.
  • the secondary base station may first send the key parameter to the primary base station, and then the primary base station forwards the key parameter to the user equipment.
  • the user equipment After receiving the key parameter sent by the secondary base station, the user equipment uses the key derivation function (KDF) to generate the key parameter and the basic key generated by the user equipment (eg, the secondary base station key S-KeNB). A calculation is performed to generate a user plane key.
  • KDF key derivation function
  • Step S103 Receive a basic key generated by the primary base station and sent by the primary base station.
  • the basic key generated by the user equipment is the same as the basic key generated by the primary base station.
  • the user equipment and the primary base station respectively calculate the same shared key (eg, base station key KeNB) and the same shared key parameter by using the key generation function KDF, thereby generating a basic key. Therefore, the basic key generated by the user equipment is the same as the basic key generated by the primary base station.
  • the same shared key eg, base station key KeNB
  • KDF key generation function
  • Step S104 Generate a user plane key according to the key parameter and the basic key generated by the primary base station.
  • the secondary base station generates a user plane key in the same manner as the user equipment generates the user plane key according to the key parameter and the basic key generated by the primary base station.
  • the user equipment generates the basic key and the basic key generated by the primary base station, and uses the same user plane key generation method.
  • the generated user plane key is the same as the user plane key generated by the secondary base station.
  • the user plane key generated in this embodiment may be specifically a user plane encryption key.
  • the user equipment or the secondary base station Before transmitting the user plane data, the user equipment or the secondary base station encrypts the user plane data according to the generated user plane encryption key to form a ciphertext and then sends the data, so that the data cannot be cracked during the sending process; correspondingly, the user equipment or the secondary base station After receiving the user plane data, the user plane data is decrypted according to the generated user plane encryption key to obtain original user plane data.
  • the user plane key generated in this embodiment may be specifically a user plane integrity protection key.
  • the user equipment or the secondary base station Before transmitting the user plane data, the user equipment or the secondary base station performs integrity protection and then sends the user plane data according to the generated user plane integrity protection key, so that the data cannot be tampered with during the sending process; correspondingly, the user equipment or the auxiliary device
  • the base station After receiving the user plane data, the base station verifies the integrity of the user plane data according to the generated user plane integrity protection key to ensure that the user plane data has not been tampered with.
  • FIG. 2 is a signaling diagram of a key generation method according to Embodiment 1 of the present invention.
  • the signaling diagram shown in FIG. 2 shows the interaction process between the user equipment, the primary base station, and the secondary base station in detail.
  • the secondary base station is the execution body of the key generation method provided in the first embodiment, FIG. 2
  • the key generation method can be executed according to the process described in the foregoing Embodiment 1, and will not be repeated here.
  • the user plane key between the user equipment and the secondary base station is generated by the user equipment and the secondary base station, respectively, which can effectively reduce the load of the primary base station.
  • different DRBs of the same user equipment correspond to different key parameters
  • different user plane keys are generated for different DRBs between the same user equipment and the secondary base station, which can effectively improve the user plane between the secondary base station and the user equipment. The security of the key.
  • FIG. 3 is a schematic flowchart of a key generation method according to Embodiment 2 of the present invention.
  • the execution body of the key generation method is the primary base station.
  • the primary base station is a macro base station.
  • the key generation method includes the following steps:
  • Step S201 determining a key parameter corresponding to the DRB.
  • the key parameters include: a DRB ID.
  • the primary base station allocates a DRB to the user equipment, and allocates a DRB ID to the DRB, and the DRB ID of each DRB is unique, so the DRB ID can be used as the DRB.
  • the primary base station allocates a DRB to the user equipment, and allocates a DRB ID to the DRB, and the DRB ID of each DRB is unique, so the DRB ID can be used as the DRB.
  • Step S202 Send a key parameter to the user equipment corresponding to the DRB.
  • the user equipment After receiving the key parameter sent by the secondary base station, the user equipment calculates the key parameter and the basic key generated by the user equipment (for example, the secondary base station key S-KeNB) by using the key generation success KDF, thereby generating the user. Face key.
  • the basic key generated by the user equipment for example, the secondary base station key S-KeNB
  • the secondary base station is a small base station, and the small base station is specifically a micro base station or a milli base station.
  • Step S203 transmitting a key parameter and a basic key generated by the primary base station to the secondary base station.
  • the basic key generated by the user equipment is the same as the basic key generated by the primary base station.
  • the user equipment and the primary base station respectively calculate the same shared key (eg, base station key KeNB) and the same shared key parameter by using the key generation function KDF, thereby generating a basic key. Therefore, the basic key generated by the user equipment is the same as the basic key generated by the primary base station.
  • the same shared key eg, base station key KeNB
  • KDF key generation function
  • the secondary base station generates a user plane key in the same manner as the user equipment generates the user plane key according to the key parameter and the basic key generated by the primary base station.
  • the user plane key generated by the user equipment is the same as the user plane key generated by the secondary base station, because the basic key generated by the user equipment is the same as the basic key generated by the primary base station and the same user plane key generation method is adopted.
  • the user plane key generated in this embodiment may be specifically a user plane encryption key.
  • the user equipment or the secondary base station Before transmitting the user plane data, the user equipment or the secondary base station encrypts the user plane data according to the generated user plane encryption key to form a ciphertext and then sends the data, so that the data cannot be cracked during the sending process; correspondingly, the user equipment or the secondary base station After receiving the user plane data, the user plane data is decrypted according to the generated user plane encryption key to obtain original user plane data.
  • the user plane key generated in this embodiment may be specifically a user plane integrity protection key.
  • the user equipment or the secondary base station Before transmitting the user plane data, the user equipment or the secondary base station performs integrity protection and then sends the user plane data according to the generated user plane integrity protection key, so that the data cannot be smashed during the sending process.
  • the user equipment or the secondary base station After receiving the user plane data, the user equipment or the secondary base station verifies the integrity of the user plane data according to the generated user plane integrity protection key to ensure that the user plane data has not been tampered with.
  • FIG. 4 is a signaling diagram of a key generation method according to Embodiment 2 of the present invention.
  • the signaling diagram shown in FIG. 4 shows in detail the interaction process between the user equipment, the primary base station, and the secondary base station.
  • the primary base station is the execution body of the key generation method provided in the second embodiment, FIG.
  • the key generation method can be performed according to the process described in the foregoing Embodiment 2, and will not be repeated here.
  • the user plane key between the user equipment and the secondary base station is generated by the user equipment and the secondary base station, respectively, which can effectively reduce the load of the primary base station.
  • different DRBs of the same user equipment correspond to different key parameters
  • different user plane keys are generated for different DRBs between the same user equipment and the secondary base station, which can effectively improve the user plane between the secondary base station and the user equipment. The security of the key.
  • FIG. 5 is a schematic flowchart of a key generation method according to Embodiment 3 of the present invention.
  • the execution body of the key generation method is the primary base station.
  • the primary base station is a macro base station.
  • the key generation method includes the following steps:
  • Step S301 determining a key parameter corresponding to the DRB.
  • the key parameters include: a DRB ID.
  • the primary base station allocates a DRB to the user equipment, and allocates a DRB ID to the DRB, and the DRB ID of each DRB is unique, so the DRB ID can be used as the DRB.
  • the primary base station allocates a DRB to the user equipment, and allocates a DRB ID to the DRB, and the DRB ID of each DRB is unique, so the DRB ID can be used as the DRB.
  • Step S302 Send a key parameter to the user equipment corresponding to the DRB.
  • the user equipment After receiving the key parameter sent by the secondary base station, the user equipment calculates the key parameter and the basic key generated by the user equipment (for example, the secondary base station key S-KeNB) by using the key generation success KDF, thereby generating the user. Face key.
  • the basic key generated by the user equipment for example, the secondary base station key S-KeNB
  • the secondary base station is a small base station, and the small base station is specifically a micro base station or a milli base station.
  • Step S303 The user plane key is generated according to the key parameter and the base key generated by the primary base station.
  • the basic key generated by the user equipment is the same as the basic key generated by the primary base station.
  • the user equipment and the primary base station respectively calculate the same shared key (eg, base station key KeNB) and the same shared key parameter by using the key generation function KDF, thereby generating a basic key. Therefore, the basic key generated by the user equipment is the same as the basic key generated by the primary base station.
  • the primary base station generates a user plane key in the same manner as the user equipment generates the user plane key based on the key parameter and the base key generated by the primary base station.
  • the user plane key generated by the user equipment is the same as the user plane key generated by the master base station because the basic key generated by the user equipment is the same as the S basic key generated by the primary base station and the same user plane key generation method is adopted.
  • Step S304 the generated user plane key is sent to the secondary base station.
  • the secondary base station uses the user plane key sent by the primary base station as the user plane key between the user equipment and the secondary base station.
  • the user plane key generated in this embodiment may be specifically a user plane encryption key.
  • the user equipment or the secondary base station Before transmitting the user plane data, the user equipment or the secondary base station encrypts the user plane data according to the generated user plane encryption key to form a ciphertext and then sends the data, so that the data cannot be cracked during the sending process; correspondingly, the user equipment or the secondary base station After receiving the user plane data, the user plane data is decrypted according to the generated user plane encryption key to obtain original user plane data.
  • the user plane key generated in this embodiment may be specifically a user plane integrity protection key.
  • the user equipment or the secondary base station Before transmitting the user plane data, the user equipment or the secondary base station performs integrity protection and then sends the user plane data according to the generated user plane integrity protection key, so that the data cannot be tampered with during the sending process; correspondingly, the user equipment or the auxiliary device
  • the base station After receiving the user plane data, the base station verifies the integrity of the user plane data according to the generated user plane integrity protection key to ensure that the user plane data has not been tampered with.
  • FIG. 6 is a signaling diagram of a key generation method according to Embodiment 3 of the present invention.
  • the signaling diagram shown in FIG. 6 shows in detail the interaction process between the user equipment, the primary base station, and the secondary base station.
  • the primary base station is the execution body of the key generation method provided in the third embodiment, FIG. Secret
  • the key generation method can be performed according to the process described in the foregoing Embodiment 3, and will not be repeated herein.
  • the user plane key between the user equipment and the secondary base station is generated by the user equipment and the primary base station, respectively, which can effectively reduce the load of the primary base station.
  • different DRBs of the same user equipment correspond to different key parameters
  • different user plane keys are generated for different DRBs between the same user equipment and the secondary base station, which can effectively improve the user plane between the secondary base station and the user equipment. The security of the key.
  • FIG. 7 is a schematic structural diagram of a secondary base station according to Embodiment 4 of the present invention.
  • the secondary base station is a small base station, and the small base station is specifically a micro base station or a milli base station, and is used to implement the key generation method provided in Embodiment 1 of the present invention.
  • the secondary base station includes: a determining unit 410, a transmitting unit 420, a receiving unit 430, and a generating unit 440.
  • the determining unit 410 is configured to determine a key parameter corresponding to the DRB.
  • the key parameters may be allocated by the secondary base station or by the primary base station.
  • the primary base station is a macro base station.
  • the key parameter includes at least one of the following parameters: a DRB ID, a random number, and a counter value.
  • the secondary base station receives the DRB establishment or the new request sent by the primary base station, and the secondary base station allocates the DRB to the user equipment after receiving the DRB establishment or the new request.
  • the determining unit 410 allocates a DRB ID to the DRB, and the DRB ID of each DRB is unique. Therefore, the determining unit 410 uses the DRB ID as a key parameter corresponding to the DRB.
  • the determining unit 410 may include a random number generator. After the user equipment establishes an RRC connection with the primary base station, the secondary base station may receive a DRB establishment or a new request sent by the primary base station, and the secondary base station receives the DRB establishment or new request. Then, the user equipment is allocated a DRB, and then a random number is generated for the DRB random number generator, and each random number generated by the random number generator is unique, so the determining unit 410 can use the random number as the DRB corresponding Key parameter.
  • the determining unit 410 may further include a counter, when the user equipment establishes an RRC connection with the primary base station. After that, the secondary base station receives the DRB establishment or new request sent by the primary base station, and after receiving the DRB establishment or new request, the secondary base station allocates a DRB for the user equipment, and then generates a counter value for the DRB counter, and the counter Each counter value generated is unique, so the determining unit 410 can use the counter value as a key parameter corresponding to the DRB.
  • the receiving unit 430 is configured to receive a DRB establishment or a new request sent by the primary base station, where the DRB establishment or the new request carries the key parameter.
  • the key parameter only includes: DRB ID.
  • the primary base station allocates a DRB to the user equipment, and allocates a DRB ID to the DRB, and the DRB ID of each DRB is unique, so the DRB ID can be used as the DRB.
  • the primary base station allocates a DRB to the user equipment, and allocates a DRB ID to the DRB, and the DRB ID of each DRB is unique, so the DRB ID can be used as the DRB.
  • the determining unit 410 is specifically configured to acquire a key parameter from the received DRB establishment or new request.
  • the sending unit 420 is configured to send the key parameter to the user equipment corresponding to the DRB.
  • the sending unit 420 may first send the key parameter to the primary base station, and then the primary base station forwards the key parameter to the user equipment.
  • the user equipment After receiving the key parameter sent by the secondary base station, the user equipment calculates the key parameter and the basic key generated by the user equipment (for example, the secondary base station key S-KeNB) by using the key generation success KDF, thereby generating the user. Face key.
  • the basic key generated by the user equipment for example, the secondary base station key S-KeNB
  • the receiving unit 430 is configured to receive a basic key generated by the primary base station and sent by the primary base station.
  • the basic key generated by the user equipment is the same as the basic key generated by the primary base station.
  • the user equipment and the primary base station respectively calculate the same shared key (eg, base station key KeNB) and the same shared key parameter by using the key generation function KDF, thereby generating a basic key. Therefore, the basic key generated by the user equipment is the same as the basic key generated by the primary base station.
  • the same shared key eg, base station key KeNB
  • KDF key generation function
  • the generating unit 440 is configured to generate a user plane key according to the key parameter and the basic key generated by the primary base station.
  • the generating unit 440 passes the user equipment according to the key parameter and the basic key generated by the primary base station.
  • the user plane key is generated in the same way as the user plane key is generated. Since the basic key generated by the user equipment is the same as the basic key generated by the primary base station, and the same user plane key generation method is adopted, the user plane key generated by the user equipment is the same as the user plane key generated by the generating unit 440.
  • the user plane key generated in this embodiment may be specifically a user plane encryption key.
  • the user equipment or the secondary base station Before transmitting the user plane data, the user equipment or the secondary base station encrypts the user plane data according to the generated user plane encryption key to form a ciphertext and then sends the data, so that the data cannot be cracked during the sending process; correspondingly, the user equipment or the secondary base station After receiving the user plane data, the user plane data is decrypted according to the generated user plane encryption key to obtain original user plane data.
  • the user plane key generated in this embodiment may be specifically a user plane integrity protection key.
  • the user equipment or the secondary base station Before transmitting the user plane data, the user equipment or the secondary base station performs integrity protection and then sends the user plane data according to the generated user plane integrity protection key, so that the data cannot be tampered with during the sending process; correspondingly, the user equipment or the auxiliary device
  • the base station After receiving the user plane data, the base station verifies the integrity of the user plane data according to the generated user plane integrity protection key to ensure that the user plane data has not been tampered with.
  • the user plane key between the user equipment and the secondary base station is generated by the user equipment and the secondary base station, respectively, which can effectively reduce the load of the primary base station.
  • different DRBs of the same user equipment correspond to different key parameters
  • different user plane keys are generated for different DRBs between the same user equipment and the secondary base station, which can effectively improve the user plane between the secondary base station and the user equipment. The security of the key.
  • the above sending unit 420 may be a transmitter or a transceiver
  • the above receiving unit 430 may be a receiver or a transceiver
  • the sending unit 420 and the receiving unit 430 may be integrated to form a transceiver unit, corresponding to hardware implementation.
  • the above determining unit 410 and the generating unit 440 may be embedded in or independent of the processor of the secondary base station in hardware, or may be stored in the memory of the secondary base station in software, so that the processor calls to perform operations corresponding to the above modules.
  • the processor can be a central processing unit (CPU), a microprocessor, a microcontroller, or the like.
  • FIG. 8 is a schematic structural diagram of a secondary base station according to Embodiment 5 of the present invention.
  • the secondary base station includes a transmitter 510, a receiver 520, a memory 530, and a processor 540 coupled to the transmitter 510, the receiver 520, and the memory 530, respectively.
  • the secondary base station may also include a common component such as an antenna, a baseband processing component, a medium-frequency processing component, and an input/output device.
  • the embodiment of the present invention is not limited herein.
  • the secondary base station is a small base station, and the small base station is specifically a micro base station or a milli base station.
  • the key generation method provided in Embodiment 1 of the present invention is implemented.
  • the memory 530 stores a set of program codes
  • the processor 540 is configured to call the program code stored in the memory 530 for performing the following operations:
  • the basic key generated by the user equipment is the same as the basic key generated by the primary base station.
  • determining the key parameter corresponding to the DRB is specifically:
  • the key parameter includes at least one of the following parameters: a DRB ID, a random number, and a counter value.
  • processor 540 is configured to call the program code stored in the memory 530, and is also used to perform the following operations:
  • the determining the key parameter corresponding to the DRB Before the determining the key parameter corresponding to the DRB, receiving a DRB establishment or a new request sent by the primary base station, where the DRB establishment or the new request carries the key parameter; the determining the key parameter corresponding to the DRB is specifically Obtaining the key parameter from the DRB establishment or a new request, the key parameter includes: a DRB ID.
  • the sending the key parameter to the user equipment corresponding to the DRB is specifically:
  • the user plane key is a user plane encryption key or a user plane integrity protection key.
  • the primary base station is a macro base station.
  • the user plane key between the user equipment and the secondary base station is respectively generated by the user equipment and the secondary base station, which can effectively reduce the load of the primary base station. Moreover, since different DRBs of the same user equipment correspond to different key parameters, different user plane keys are generated for different DRBs between the same user equipment and the secondary base station, which can effectively improve the user plane between the secondary base station and the user equipment. The security of the key.
  • FIG. 9 is a schematic structural diagram of a primary base station according to Embodiment 6 of the present invention.
  • the primary base station is a macro base station, and is used to implement the key generation method provided by the second embodiment of the present invention.
  • the primary base station includes: a determining unit 610, and a transmitting unit 620.
  • the determining unit 610 is configured to determine a key parameter corresponding to the DRB.
  • the key parameters include: a DRB ID.
  • the primary base station allocates a DRB for the user equipment
  • the determining unit 610 allocates a DRB ID for the DRB, and the DRB ID of each DRB is unique, so the determining unit 610 will determine the DRB.
  • the ID is used as the key parameter corresponding to the DRB.
  • the sending unit 620 is configured to send a key parameter to the user equipment corresponding to the DRB.
  • the user equipment After receiving the key parameter sent by the secondary base station, the user equipment calculates the key parameter and the basic key generated by the user equipment (for example, the secondary base station key S-KeNB) by using the key generation KDF, thereby generating a user plane. Key.
  • the basic key generated by the user equipment for example, the secondary base station key S-KeNB
  • the secondary base station is a small base station, and the small base station is specifically a micro base station or a milli base station.
  • the sending unit 620 is further configured to send the key parameter and the basic key generated by the primary base station to the secondary base station.
  • the basic key generated by the user equipment is the same as the basic key generated by the primary base station.
  • the user equipment and the primary base station respectively calculate the same shared key (eg, base station key KeNB) and the same shared key parameter by using the key generation function KDF, thereby generating a basic key. Therefore, the basic key generated by the user equipment is the same as the basic key generated by the primary base station.
  • the same shared key eg, base station key KeNB
  • KDF key generation function
  • the secondary base station generates a user plane key in the same manner as the user equipment generates the user plane key according to the key parameter and the basic key generated by the primary base station.
  • the basic key generated by the user equipment and the primary base station The generated basic key is the same, and the same user plane key generation method is adopted. Therefore, the user plane key generated by the user equipment is the same as the user plane key generated by the secondary base station.
  • the user plane key generated in this embodiment may be specifically a user plane encryption key.
  • the user equipment or the secondary base station Before transmitting the user plane data, the user equipment or the secondary base station encrypts the user plane data according to the generated user plane encryption key to form a ciphertext and then sends the data, so that the data cannot be cracked during the sending process; correspondingly, the user equipment or the secondary base station After receiving the user plane data, the user plane data is decrypted according to the generated user plane encryption key to obtain original user plane data.
  • the user plane key generated in this embodiment may be specifically: the user plane integrity protection key user equipment or the secondary base station sends user plane data according to the generated user plane integrity protection key before the user plane data is sent.
  • the integrity protection is resent, so that the data cannot be tampered with during the sending process; correspondingly, after receiving the user plane data, the user equipment or the secondary base station performs the integrity of the user plane data according to the generated user plane integrity protection key. Check to ensure that the user face data has not been tampered with.
  • the user plane key between the user equipment and the secondary base station is generated by the user equipment and the secondary base station, respectively, which can effectively reduce the load of the primary base station.
  • different DRBs of the same user equipment correspond to different key parameters
  • different user plane keys are generated for different DRBs between the same user equipment and the secondary base station, which can effectively improve the user plane between the secondary base station and the user equipment. The security of the key.
  • the foregoing sending unit 620 can be a transmitter or a transceiver, and the above determining unit 610 can be embedded in the hardware of the main base station in hardware, or can be stored in the memory of the primary base station in software.
  • the processor can be a central processing unit (CPU), a microprocessor, a microcontroller, or the like.
  • FIG. 10 is a schematic structural diagram of a primary base station according to Embodiment 7 of the present invention.
  • the primary base station includes a transmitter 710, a memory 720, and a processor 730 coupled to the transmitter 710 and the memory 720, respectively.
  • the main base station may also include a common component such as an antenna, a baseband processing component, a medium-frequency radio processing component, and an input/output device, and the embodiment of the present invention is not limited thereto.
  • the primary base station is a macro base station, and is used to implement the key generation method provided by the second embodiment of the present invention.
  • the memory 720 stores a set of program codes, and the processor 730 is configured to call the program code stored in the memory 720 for performing the following operations:
  • the basic key generated by the user equipment is the same as the basic key generated by the primary base station.
  • the key parameter includes: a DRB ID.
  • the user plane key is a user plane encryption key or a user plane integrity protection key.
  • the secondary base station is a small base station, and the small base station is specifically a micro base station or a milli base station.
  • the user plane key between the user equipment and the secondary base station is generated by the user equipment and the secondary base station, respectively, which can effectively reduce the load of the primary base station.
  • different DRBs of the same user equipment correspond to different key parameters
  • different user plane keys are generated for different DRBs between the same user equipment and the secondary base station, which can effectively improve the user plane between the secondary base station and the user equipment. The security of the key.
  • FIG. 11 is a schematic structural diagram of a primary base station according to Embodiment 8 of the present invention.
  • the primary base station is a macro base station, and is used to implement the key generation method provided in Embodiment 3 of the present invention.
  • the primary base station includes a determining unit 810, a transmitting unit 820, and a generating unit 830.
  • the determining unit 810 is configured to determine a key parameter corresponding to the DRB.
  • the key parameters include: a DRB ID.
  • the primary base station allocates a DRB for the user equipment
  • the determining unit 810 allocates a DRB ID for the DRB, and the DRB ID of each DRB is unique, so the determining unit 810 sets the DRB.
  • the ID is used as the key parameter corresponding to the DRB.
  • the sending unit 820 is configured to send a key parameter to the user equipment corresponding to the DRB.
  • the user equipment After receiving the key parameter sent by the secondary base station, the user equipment calculates the key parameter and the basic key generated by the user equipment (for example, the secondary base station key S-KeNB) by using the key generation success KDF, thereby generating the user. Face key.
  • the basic key generated by the user equipment for example, the secondary base station key S-KeNB
  • the secondary base station is a small base station, and the small base station is specifically a micro base station or a milli base station.
  • the generating unit 830 is configured to generate a user plane key according to the key parameter and the basic key generated by the primary base station.
  • the basic key generated by the user equipment is the same as the basic key generated by the primary base station.
  • the user equipment and the primary base station respectively calculate the same shared key (eg, base station key KeNB) and the same shared key parameter by using the key generation function KDF, thereby generating a basic key. Therefore, the basic key generated by the user equipment is the same as the basic key generated by the primary base station.
  • the same shared key eg, base station key KeNB
  • KDF key generation function
  • the generating unit 830 generates a user plane key in the same manner as the user equipment generates the user plane key based on the key parameter and the base key generated by the master base station.
  • the user plane key generated by the user equipment is the same as the user plane key generated by the generating unit 830, because the basic key generated by the user equipment is the same as the basic key generated by the primary base station and the same user plane key generation method is adopted.
  • the sending unit 820 is further configured to send the generated user plane key to the secondary base station.
  • the secondary base station uses the user plane key sent by the primary base station as the user plane key between the user equipment and the secondary base station.
  • the user plane key generated in this embodiment may be specifically: the user plane encryption key user equipment or the secondary base station encrypts the user plane data according to the generated user plane encryption key before forming the user plane data to form a secret.
  • the text is sent again, so that the data cannot be cracked during the sending process; correspondingly, after receiving the user plane data, the user equipment or the secondary base station decrypts the user plane data according to the generated user plane encryption key to obtain the original user plane data.
  • the user plane key generated in this embodiment may be specifically a user plane integrity protection key.
  • the user equipment or the secondary base station Before transmitting the user plane data, the user equipment or the secondary base station performs integrity protection and then sends the user plane data according to the generated user plane integrity protection key, so that the data cannot be smashed during the sending process.
  • the user equipment or the secondary base station After receiving the user plane data, the user equipment or the secondary base station verifies the integrity of the user plane data according to the generated user plane integrity protection key to ensure that the user plane data has not been tampered with.
  • the user plane key between the user equipment and the secondary base station is respectively generated by the user equipment and the primary base station, which can effectively reduce the load of the primary base station.
  • different DRBs of the same user equipment correspond to different key parameters
  • different user plane keys are generated for different DRBs between the same user equipment and the secondary base station, which can effectively improve the user plane between the secondary base station and the user equipment. The security of the key.
  • the foregoing sending unit 820 may be a transmitter or a transceiver, and the above determining unit 810 and the generating unit 830 may be embedded in the hardware of the main base station in hardware or may be stored in the software in the main form. In the memory of the base station, so that the processor calls to perform the operations corresponding to the above modules.
  • the processor can be a central processing unit (CPU), a microprocessor, a microcontroller, or the like.
  • FIG. 12 is a schematic structural diagram of a primary base station according to Embodiment 9 of the present invention.
  • the primary base station includes a transmitter 910, a memory 920, and a processor 930 coupled to the transmitter 910 and the memory 920, respectively.
  • the main base station may also include a common component such as an antenna, a baseband processing component, a medium-frequency radio processing component, and an input/output device, and the embodiment of the present invention is not limited thereto.
  • the primary base station is a macro base station, and is used to implement the key generation method provided by the second embodiment of the present invention.
  • the memory 920 stores a set of program codes
  • the processor 930 is configured to call the program code stored in the memory 920 for performing the following operations:
  • the basic key generated by the user equipment is the same as the basic key generated by the primary base station.
  • the key parameter includes: a DRB ID.
  • the user plane key is a user plane encryption key or a user plane integrity protection key.
  • the secondary base station is a small base station, and the small base station is specifically a micro base station or a milli base station.
  • the primary base station provided in Embodiment 9 of the present invention, the user plane key between the user equipment and the secondary base station is generated by the user equipment and the primary base station, respectively, which can effectively reduce the load of the primary base station.
  • the key parameters of different user equipments are different, the user plane keys between the secondary base station and the different user equipments are different. Because different DRBs of the same user equipment correspond to different key parameters, the same user equipment and the secondary base station are Generating different user plane keys for different DRBs can effectively improve the security of the user plane key between the secondary base station and the user equipment.
  • FIG. 13 is a schematic structural diagram of a user equipment according to Embodiment 10 of the present invention.
  • FIG. 13 is a schematic structural diagram of a user equipment according to Embodiment 10 of the present invention.
  • the user equipment may be the user equipment described in Embodiment 1, Embodiment 2 or Embodiment 3.
  • the user equipment includes: a receiving unit 1010 and a generating unit 1020.
  • the receiving unit 1010 is configured to receive a key parameter corresponding to the DRB sent by the primary base station or the secondary base station.
  • the primary base station is a macro base station
  • the secondary base station is a small base station
  • the small base station is specifically a micro base station or a milli base station.
  • the key parameters may be allocated by the secondary base station or by the primary base station.
  • the key parameter includes at least one of the following parameters: a DRB ID, a random number, and a counter value.
  • the secondary base station receives the DRB establishment or the new request sent by the primary base station, and the secondary base station allocates the DRB to the user equipment after receiving the DRB establishment or the new request.
  • the DRB ID is assigned to the DRB, and the DRB ID of each DRB is unique. Therefore, the DRB ID can be used as the key parameter corresponding to the DRB.
  • the secondary base station may include a random number generator. After the user equipment establishes an RRC connection with the primary base station, the secondary base station receives the DRB establishment or the new request sent by the primary base station, and the secondary base station receives the DRB establishment or the new request after receiving the DRB establishment or the new request. , assigning a DRB to the user equipment, and then generating a random number for the DRB The device generates a random number, and each random number generated by the random number generator is unique, so the random number can be used as the key parameter corresponding to the DRB.
  • the secondary base station may further include a counter. After the user equipment establishes an RRC connection with the primary base station, the secondary base station receives the DRB establishment or the new request sent by the primary base station, and after receiving the DRB establishment or new request, the secondary base station is The user equipment allocates a DRB, and then generates a counter value for the DRB counter, and each counter value generated by the counter is unique, so the counter value can be used as a key parameter corresponding to the DRB.
  • the key parameters may be directly sent to the user equipment, or the key parameters may be sent to the primary base station and forwarded by the primary base station to the user equipment.
  • the key parameter includes only: the DRB ID.
  • the primary base station allocates a DRB to the user equipment, and the DRB ID of each DRB is unique. Therefore, the DRB ID can be used as the key parameter corresponding to the DRB.
  • the key parameters may be directly sent to the user equipment, or the key parameters may be sent to the secondary base station, and then forwarded by the secondary base station to the user equipment.
  • the generating unit 1020 is configured to generate a user plane key according to the key parameter and the base key.
  • the generating unit 1020 calculates the key parameter and the basic key generated by the user equipment (for example, the secondary base station key S-KeNB) by using the key generating function KDF, thereby generating a user. Face key.
  • the user plane key of the secondary base station is generated by the secondary base station or the primary base station.
  • the key parameter of the secondary base station or the primary base station and the basic key generated by the primary base station generate a user plane key.
  • the basic key generated by the user equipment is the same as the basic key generated by the primary base station.
  • the user equipment and the primary base station respectively calculate the same shared key (eg, base station key KeNB) and the same shared key parameter by using the key generation function KDF, thereby generating a basic key. Therefore, the basic key generated by the user equipment is the same as the basic key generated by the primary base station.
  • the same shared key eg, base station key KeNB
  • KDF key generation function
  • the secondary base station or the primary base station passes the key parameter and the basic key generated by the primary base station.
  • the user plane generates a user plane key in the same manner as the user plane generates the user plane key.
  • the user plane key generated by the user equipment is the same as the basic key generated by the secondary base station or the primary base station, and the user plane key generated by the user equipment is used.
  • the face key is the same.
  • the user plane key generated in this embodiment may be specifically a user plane encryption key.
  • the user equipment or the secondary base station Before transmitting the user plane data, the user equipment or the secondary base station encrypts the user plane data according to the generated user plane encryption key to form a ciphertext and then sends the data, so that the data cannot be cracked during the sending process; correspondingly, the user equipment or the secondary base station After receiving the user plane data, the user plane data is decrypted according to the generated user plane encryption key to obtain original user plane data.
  • the user plane key generated in this embodiment may be specifically a user plane integrity protection key.
  • the user equipment or the secondary base station Before transmitting the user plane data, the user equipment or the secondary base station performs integrity protection and then sends the user plane data according to the generated user plane integrity protection key, so that the data cannot be tampered with during the sending process; correspondingly, the user equipment or the auxiliary device
  • the base station After receiving the user plane data, the base station verifies the integrity of the user plane data according to the generated user plane integrity protection key to ensure that the user plane data has not been tampered with.
  • the user plane key between the user equipment and the secondary base station is respectively generated by the user equipment and the secondary base station, or generated by the user equipment and the primary base station, respectively, which can effectively reduce the load of the primary base station. . Moreover, since different DRBs of the same user equipment correspond to different key parameters, different user plane keys are generated for different DRBs between the same user equipment and the secondary base station, which can effectively improve the user plane between the secondary base station and the user equipment. The security of the key.
  • the above receiving unit 1010 may be a receiver machine or a transceiver.
  • the above generating unit 1020 may be embedded in the hardware of the user equipment in hardware, or may be stored in the memory of the user equipment in software.
  • the processor can be a central processing unit (CPU), a microprocessor, a microcontroller, or the like.
  • FIG. 14 is a schematic structural diagram of a user equipment according to Embodiment 11 of the present invention.
  • the user equipment includes a receiver 1110, a memory 1120, and a receiver 1110 and a storage device, respectively.
  • the processor 1120 is coupled to the processor 1130.
  • the user equipment may also include a common component such as an antenna, a baseband processing component, a medium-frequency radio processing component, and an input/output device, and the embodiment of the present invention is not limited thereto.
  • the user equipment may be the user equipment described in Embodiment 1, Embodiment 2 or Embodiment 3.
  • the memory 1120 stores a set of program codes
  • the processor 1130 is configured to call the program code stored in the memory 1120 to perform the following operations:
  • a user plane key is generated based on the key parameter and the base key.
  • the key parameter includes at least one of the following parameters: a DRB ID, a random number, and a counter value.
  • the user plane key is a user plane encryption key or a user plane integrity protection key.
  • the primary base station is a macro base station
  • the secondary base station is a small base station
  • the small base station is specifically a micro base station or a milli base station.
  • the steps of the method or algorithm described in connection with the embodiments disclosed herein may be implemented in hardware, processing The software module executed by the device, or a combination of the two.
  • the software module can be placed in random access memory (RAM), memory, read only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or technical field. Any other form of storage medium known.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本发明涉及一种密钥生成方法、主基站、辅基站及用户设备。该密钥生成方法包括：确定无线数据承载DRB对应的密钥参数；向所述DRB对应的用户设备发送所述密钥参数，以使所述用户设备根据所述密钥参数及所述用户设备生成的基本密钥生成用户面密钥；接收主基站发送的所述主基站生成的基本密钥；根据所述密钥参数及所述主基站生成的基本密钥生成所述用户面密钥。

Description

密钥生成方法、主基站、辅基站及用户设备 技术领域
本发明涉及通信技术领域，尤其涉及一种密钥生成方法，主基站、辅基站及用户设备。
背景技术
随时通信技术的发展，4G通信系统得到广泛应用。在4G通信系统中，为了提高用户设备的用户面数据吞吐率，用户设备可同时连接到一个主基站(MeNB,Master eNB)和一个辅基站(SeNB,Secondary eNB)，且用户设备可同时与主基站和辅基站传输用户面数据。其中，主基站为宏基站(Marco eNB/cell)，辅基站为小基站(Small eNB/cell),小基站具体为微基站(Pico eNB/cell)或毫基站(Femto eNB/cell)。
那么考虑到用户设备与辅基站之前传输用户面数据的安全性，需要对用户设备和辅基站之间的用户面传输进行安全保护。在现有的密钥生成方法用户设备和辅基站的用户面密钥都由主基站生成并发送至用户设备和辅基站，造成主基站负荷过重，且针对同一用户设备和辅基站之间只生成一个用户面密钥，也就是说，辅基站与同一用户设备之间的所有用户面密钥相同，如果用户设备与辅基站之间的一个用户面密钥被攻破，则同一用户设备与辅基站之间的所有用户面密钥都被攻破。
由此可以看出，现有的密钥生成方法会造成主基站负荷过重，且生成的用户设备与辅基站之间的用户面密钥安全性较低。
发明内容
有鉴于此，本发明实施例提供一种密钥生成方法、主基站、辅基站及用户设备，以降低主基站负荷，提高用户设备与辅基站之间的用户面密钥的安全性。
在第一方面，本发明实施例提供一种密钥生成方法，该方法包括：
确定无线数据承载DRB对应的密钥参数；
向所述DRB对应的用户设备发送所述密钥参数，以使所述用户设备根据所述密钥参数及所述用户设备生成的基本密钥生成用户面密钥；
接收主基站发送的所述主基站生成的基本密钥；
根据所述密钥参数及所述主基站生成的基本密钥生成所述用户面密钥。
在第一方面的第一种可能实现的方式中，所述确定DRB对应的密钥参数具体为：为所述DRB分配或生成密钥参数，所述密钥参数至少包括以下参数中的一个：DRB ID、随机数、计数器值。
在第一方面的第二种可能实现的方式中，在所述确定DRB对应的密钥参数之前，所述方法还包括：接收主基站发送的DRB建立或新增请求，所述DRB建立或新增请求携带所述密钥参数；所述确定DRB对应的密钥参数具体为：从所述DRB建立或新增请求获取所述密钥参数，所述密钥参数包括：DRB ID。
结合第一方面或第一方面的第一种可能实现的方式或第一方面的第二种可能实现的方式，在第三种可能实现的方式中，所述向所述DRB对应的用户设备发送所述密钥参数具体为：通过所述主基站将所述密钥参数发送至所述用户设备。
结合第一方面或第一方面的第一种可能实现的方式或第一方面的第二种可能实现的方式或第一方面的第三种可能实现的方式，在第四种可能实现的方式中，所述用户面密钥为用户面加密密钥或用户面完整性保护密钥。
在第二方面，本发明实施例提供一种密钥生成方法，该方法包括：
确定无线数据承载DRB对应的密钥参数；
向所述DRB对应的用户设备发送所述密钥参数，以使所述用户设备根据 所述密钥参数及所述用户设备生成的基本密钥生成用户面密钥；
向所述辅基站发送所述密钥参数及所述主基站生成的基本密钥，以使辅基站根据所述密钥参数及主基站生成的基本密钥生成所述用户面密钥；或者，根据所述密钥参数及主基站生成的基本密钥生成所述用户面密钥，向辅基站发送所述用户面密钥。
在第二方面的第一种可能实现的方式中，所述密钥参数包括：DRB ID。
结合第二方面或第二方面的第一种可能实现的方式，在第二种可能实现的方式中，所述用户面密钥为用户面加密密钥或用户面完整性保护密钥。
在第三方面，本发明实施例提供一种辅基站，该辅基站包括：
确定单元，用于确定无线数据承载DRB对应的密钥参数；
发送单元，用于向所述DRB对应的用户设备发送所述密钥参数，以使所述用户设备根据所述密钥参数及所述用户设备生成的基本密钥生成用户面密钥；
接收单元，用于接收主基站发送的所述主基站生成的基本密钥；
生成单元，用于根据所述密钥参数及所述主基站生成的基本密钥生成所述用户面密钥。
在第三方面的第一种可能实现的方式中，所述确定单元具体用于：为所述DRB分配或生成密钥参数，所述密钥参数至少包括以下参数中的一个：DRB ID、随机数、计数器值。
在第三方面的第二种可能实现的方式中，所述接收单元还用于：接收主基站发送的DRB建立或新增请求，所述DRB建立或新增请求携带所述密钥参数；所述确定单元具体用于：从所述DRB建立或新增请求获取所述密钥参数，所述密钥参数包括：DRB ID。
在第三方面或第三方面的第一种可能实现的方式或第三方面的第二种可能实现的方式，在第三种可能实现的方式中，所述发送单元具体用于：通过所述主基站将所述密钥参数发送至所述用户设备。
在第三方面或第三方面的第一种可能实现的方式或第三方面的第二种可能实现的方式或第三方面的第三种可能实现的方式，在第四种可能实现的方式中，所述用户面密钥为用户面加密密钥或用户面完整性保护密钥。
在第四方面，本发明实施例提供一种主基站，该主基站包括：
确定单元，用于确定无线数据承载DRB对应的密钥参数；
发送单元，用于向所述DRB对应的用户设备发送所述密钥参数，以使所述用户设备根据所述密钥参数及所述用户设备生成的基本密钥生成用户面密钥；
所述发送单元还用于向所述辅基站发送所述密钥参数及所述主基站生成的基本密钥，以使辅基站根据所述密钥参数及主基站生成的基本密钥生成所述用户面密钥；或者，所述主基站还包括：生成单元，用于根据所述密钥参数及主基站生成的基本密钥生成所述用户面密钥，所述发送单元还用于向辅基站发送所述用户面密钥。
在第四方面的第一种可能实现的方式中，所述密钥参数包括：DRB ID。
结合第四方面或第四方面的第一种可能实现的方式，在第二种可能实现的方式中，所述用户面密钥为用户面加密密钥或用户面完整性保护密钥。
在第五方面，本发明实施例提供一种用户设备，该用户设备包括：
接收单元，用于接收主基站或辅基站发送的无线数据承载DRB对应的密钥参数；
生成单元，用于根据所述密钥参数及基本密钥生成用户面密钥。
在第五方面的第一种可能实现的方式中，所述密钥参数至少包括以下参数中的一个：DRB ID、随机数、计数器值。
结合第五方面或第五方面的第一种可能实现的方式，在第二种可能实现的方式中，所述用户面密钥为用户面加密密钥或用户面完整性保护密钥。
通过上述方案，用户设备与辅基站之间的用户面密钥分别由用户设备和辅基站生成，可有效降低主基站的负荷。并且，同一用户设备与辅基站之间 针对不同的DRB生成不同的用户面密钥，可有效提高辅基站与用户设备之间的用户面密钥的安全性。
附图说明
图1为本发明实施例一提供的一种密钥生成方法的流程示意图；
图2为本发明实施例一提供的一种密钥生成方法的信令图；
图3为本发明实施例二提供的一种密钥生成方法的流程示意图；
图4为本发明实施例二提供的一种密钥生成方法的信令图；
图5为本发明实施例三提供的一种密钥生成方法的流程示意图；
图6为本发明实施例三提供的一种密钥生成方法的信令图；
图7为本发明实施例四提供的一种辅基站的结构示意图；
图8为本发明实施例五提供的一种辅基站的结构示意图；
图9为本发明实施例六提供的一种主基站的结构示意图；
图10为本发明实施例七提供的一种主基站的结构示意图；
图11为本发明实施例八提供的一种主基站的结构示意图；
图12为本发明实施例九提供的一种主基站的结构示意图；
图13为本发明实施例十提供的一种用户设备的结构示意图；
图14为本发明实施例十提供的一种用户设备的结构示意图。
下面通过附图和实施例，对本发明实施例的技术方案做进一步的详细描述。
具体实施方式
为使本发明实施例的目的、技术方案和优点更加清楚，下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例是本发明一部分实施例，而不是全部的实施例。基于 本发明中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本发明保护的范围。
下面以图1为例详细说明本发明实施例一提供的一种密钥生成方法，图1为本发明实施例一提供的一种密钥生成方法的流程示意图。该密钥生成方法的执行主体为辅基站。该辅基站为小基站,小基站具体为微基站或毫基站。
如图1所示，该密钥生成方法包括以下步骤：
步骤S101，确定数据无线承载(Data Radio Bearer，DRB)对应密钥参数。
其中，密钥参数可由辅基站分配，也可由主基站分配。其中，该主基站为宏基站。
可选地，若密钥参数由辅基站分配，则密钥参数至少包括以下参数中的一个：DRB ID、随机数、计数器值。
具体的，用户设备与主基站建立无线资源控制协议(Radio Resource Control，RRC)连接之后，辅基站会接收到主基站发送的DRB建立或新增请求，辅基站在接收到该DRB建立或新增请求后，为该用户设备分配DRB，并为该DRB分配DRB ID，且每个DRB的DRB ID都是唯一的，因此可将DRB ID作为该DRB对应的密钥参数。
辅基站中可以包括随机数生成器，当用户设备与主基站建立RRC连接之后，辅基站会接收到主基站发送的DRB建立或新增请求，辅基站在接收到该DRB建立或新增请求后，为该用户设备分配DRB，然后针对该DRB随机数生成器生成一个随机数，随机数生成器生成的每一个随机数都是唯一的，因此可将该随机数作为该DRB对应的密钥参数。
辅基站中还可以包括计数器，当用户设备与主基站建立RRC连接之后，辅基站会接收到主基站发送的DRB建立或新增请求，辅基站在接收到该DRB建立或新增请求后，为该用户设备分配DRB，然后针对该DRB计数器生成一个计数器值，计数器生成的每一个计数器值都是唯一的，因此可将该计数器 值作为该DRB对应的密钥参数。
可选地，若密钥参数由主基站分配，则在步骤S101之前，还包括以下步骤：
接收主基站发送的DRB建立或新增请求，该DRB建立或新增请求携带密钥参数。
该密钥参数仅包括：DRB ID。
具体的，用户设备与主基站建立RRC连接之后，主基站为该用户设备分配DRB，且每个DRB的DRB ID都是唯一的，因此可将DRB ID作为该DRB对应的密钥参数。
相应的，步骤S101具体为：从接收到的DRB建立或新增请求获取密钥参数。
步骤S102,向DRB对应的用户设备发送该密钥参数。
可选地，辅基站可先将该密钥参数发送至主基站，再由主基站将该密钥参数转发至用户设备。
用户设备接收到辅基站发送的密钥参数后，通过使用密钥生成功能(key derivation function，KDF)将密钥参数及该用户设备生成的基本密钥(如，辅基站密钥S-KeNB)进行计算，从而生成用户面密钥。
步骤S103,接收主基站发送的该主基站生成的基本密钥。
其中，用户设备生成的基本密钥与主基站生成的基本密钥相同。
具体的，用户设备和主基站分别通过使用密钥生成功能KDF将相同的共享密钥(如，基站密钥KeNB)和相同的共享密钥参数进行计算，从而生成基本密钥。因此，用户设备生成的基本密钥与主基站生成的基本密钥相同。
步骤S104，根据密钥参数及主基站生成的基本密钥生成用户面密钥。
辅基站根据密钥参数及主基站生成的基本密钥通过与用户设备生成用户面密钥同样的方式生成用户面密钥。由于用户设备生成的基本密钥与主基站生成的基本密钥相同，且采用同样的用户面密钥生成方式，因此用户设备 生成的用户面密钥与辅基站生成的用户面密钥相同。
可选地，本实施例中生成的用户面密钥可以具体为用户面加密密钥。用户设备或辅基站在发送用户面数据前，根据生成的用户面加密密钥将用户面数据加密后形成密文再发送，使得数据在发送过程中无法被破解；相应的，用户设备或辅基站在接收到用户面数据后，根据生成的用户面加密密钥将用户面数据解密，得到原始用户面数据。
可选地，本实施例中生成的用户面密钥可以具体为用户面完整性保护密钥。用户设备或辅基站在发送用户面数据前，根据生成的用户面完整性保护密钥将用户面数据进行完整性保护再发送，使得数据在发送过程中无法被篡改；相应的，用户设备或辅基站在接收到用户面数据后，根据生成的用户面完整性保护密钥将用户面数据的完整性进行校验，以确保用户面数据没有被篡改。
进一步地，图2为本发明实施例一提供的密钥生成方法的信令图。图2所示的信令图详细的展示了用户设备、主基站以及辅基站之间的交互流程，在图2中辅基站即为实施例一提供的密钥生成方法的执行主体，图2中的密钥生成方法均可按照前述实施例一描述的过程执行，在此不再复述。
通过利用本发明实施例一提供的密钥生成方法，用户设备与辅基站之间的用户面密钥分别由用户设备和辅基站生成，可有效降低主基站的负荷。并且，由于同一用户设备不同的DRB对应不同的密钥参数，因此同一用户设备与辅基站之间针对不同的DRB生成不同的用户面密钥，可有效提高辅基站与用户设备之间的用户面密钥的安全性。
下面以图3为例详细说明本发明实施例二提供的一种密钥生成方法，图3为本发明实施例二提供的一种密钥生成方法的流程示意图。该密钥生成方法的执行主体为主基站。该主基站为宏基站。
如图2所示，该密钥生成方法包括以下步骤：
步骤S201，确定DRB对应的密钥参数。
其中，密钥参数包括：DRB ID。
具体的，用户设备与主基站建立RRC连接之后，主基站为该用户设备分配DRB，并为该DRB分配DRB ID，且每个DRB的DRB ID都是唯一的，因此可将DRB ID作为该DRB对应的密钥参数。
步骤S202，向DRB对应的用户设备发送密钥参数。
用户设备接收到辅基站发送的密钥参数后，通过使用密钥生成功KDF将密钥参数及该用户设备生成的基本密钥(如，辅基站密钥S-KeNB)进行计算，从而生成用户面密钥。
其中，该辅基站为小基站,小基站具体为微基站或毫基站。步骤S203，向辅基站发送密钥参数及主基站生成的基本密钥。
其中，用户设备生成的基本密钥与主基站生成的基本密钥相同。
具体的，用户设备和主基站分别通过使用密钥生成功能KDF将相同的共享密钥(如，基站密钥KeNB)和相同的共享密钥参数进行计算，从而生成基本密钥。因此，用户设备生成的基本密钥与主基站生成的基本密钥相同。
辅基站根据密钥参数及主基站生成的基本密钥通过与用户设备生成用户面密钥同样的方式生成用户面密钥。由于用户设备生成的基本密钥与主基站生成的基本密钥相同，且采用同样的用户面密钥生成方式，因此用户设备生成的用户面密钥与辅基站生成的用户面密钥相同。
可选地，本实施例中生成的用户面密钥可以具体为用户面加密密钥。用户设备或辅基站在发送用户面数据前，根据生成的用户面加密密钥将用户面数据加密后形成密文再发送，使得数据在发送过程中无法被破解；相应的，用户设备或辅基站在接收到用户面数据后，根据生成的用户面加密密钥将用户面数据解密，得到原始用户面数据。
可选地，本实施例中生成的用户面密钥可以具体为用户面完整性保护密钥。用户设备或辅基站在发送用户面数据前，根据生成的用户面完整性保护密钥将用户面数据进行完整性保护再发送，使得数据在发送过程中无法被篡 改；相应的，用户设备或辅基站在接收到用户面数据后，根据生成的用户面完整性保护密钥将用户面数据的完整性进行校验，以确保用户面数据没有被篡改。
进一步地，图4为本发明实施例二提供的密钥生成方法的信令图。图4所示的信令图详细的展示了用户设备、主基站以及辅基站之间的交互流程，在图4中主基站即为实施例二提供的密钥生成方法的执行主体，图4中的密钥生成方法均可按照前述实施例二描述的过程执行，在此不再复述。
通过利用本发明实施例二提供的密钥生成方法，用户设备与辅基站之间的用户面密钥分别由用户设备和辅基站生成，可有效降低主基站的负荷。并且，由于同一用户设备不同的DRB对应不同的密钥参数，因此同一用户设备与辅基站之间针对不同的DRB生成不同的用户面密钥，可有效提高辅基站与用户设备之间的用户面密钥的安全性。
下面以图5为例详细说明本发明实施例三提供的一种密钥生成方法，图5为本发明实施例三提供的一种密钥生成方法的流程示意图。该密钥生成方法的执行主体为主基站。该主基站为宏基站。
如图3所示，该密钥生成方法包括以下步骤：
步骤S301，确定DRB对应的密钥参数。
其中，密钥参数包括：DRB ID。
具体的，用户设备与主基站建立RRC连接之后，主基站为该用户设备分配DRB，并为该DRB分配DRB ID，且每个DRB的DRB ID都是唯一的，因此可将DRB ID作为该DRB对应的密钥参数。
步骤S302，向DRB对应的用户设备发送密钥参数。
用户设备接收到辅基站发送的密钥参数后，通过使用密钥生成功KDF将密钥参数及该用户设备生成的基本密钥(如，辅基站密钥S-KeNB)进行计算，从而生成用户面密钥。
其中，该辅基站为小基站,小基站具体为微基站或毫基站。步骤S303， 根据密钥参数及主基站生成的基本密钥生成用户面密钥。
其中，用户设备生成的基本密钥与主基站生成的基本密钥相同。
具体的，用户设备和主基站分别通过使用密钥生成功能KDF将相同的共享密钥(如，基站密钥KeNB)和相同的共享密钥参数进行计算，从而生成基本密钥。因此，用户设备生成的基本密钥与主基站生成的基本密钥相同。主基站根据密钥参数及主基站生成的基本密钥通过与用户设备生成用户面密钥同样的方式生成用户面密钥。由于用户设备生成的基本密钥与主基站生成的S基本密钥相同，且采用同样的用户面密钥生成方式，因此用户设备生成的用户面密钥与主基站生成的用户面密钥相同。
步骤S304，向辅基站发送生成的用户面密钥。
辅基站将主基站发送的用户面密钥作为用户设备与辅基站之间的用户面密钥。
可选地，本实施例中生成的用户面密钥可以具体为用户面加密密钥。用户设备或辅基站在发送用户面数据前，根据生成的用户面加密密钥将用户面数据加密后形成密文再发送，使得数据在发送过程中无法被破解；相应的，用户设备或辅基站在接收到用户面数据后，根据生成的用户面加密密钥将用户面数据解密，得到原始用户面数据。
可选地，本实施例中生成的用户面密钥可以具体为用户面完整性保护密钥。用户设备或辅基站在发送用户面数据前，根据生成的用户面完整性保护密钥将用户面数据进行完整性保护再发送，使得数据在发送过程中无法被篡改；相应的，用户设备或辅基站在接收到用户面数据后，根据生成的用户面完整性保护密钥将用户面数据的完整性进行校验，以确保用户面数据没有被篡改。
进一步地，图6为本发明实施例三提供的密钥生成方法的信令图。图6所示的信令图详细的展示了用户设备、主基站以及辅基站之间的交互流程，在图6中主基站即为实施例三提供的密钥生成方法的执行主体，图6中的密 钥生成方法均可按照前述实施例三描述的过程执行，在此不再复述。
通过利用本发明实施例三提供的密钥生成方法，用户设备与辅基站之间的用户面密钥分别由用户设备和主基站生成，可有效降低主基站的负荷。并且，由于同一用户设备不同的DRB对应不同的密钥参数，因此同一用户设备与辅基站之间针对不同的DRB生成不同的用户面密钥，可有效提高辅基站与用户设备之间的用户面密钥的安全性。
下面以图7为例详细说明本发明实施例四提供的一种辅基站，图7为本发明实施例四提供的一种辅基站的结构示意图。该辅基站为小基站,小基站具体为微基站或毫基站，，用以实现本发明实施例一提供的密钥生成方法。
如图7所示，该辅基站包括：确定单元410，发送单元420，接收单元430和生成单元440。
确定单元410用于确定DRB对应的密钥参数。
其中，密钥参数可由辅基站分配，也可由主基站分配。其中，主基站为宏基站。
可选地，若密钥参数由辅基站分配，则密钥参数至少包括以下参数中的一个：DRB ID、随机数、计数器值。
具体的，用户设备与主基站建立RRC连接之后，辅基站会接收到主基站发送的DRB建立或新增请求，辅基站在接收到该DRB建立或新增请求后，为该用户设备分配DRB，确定单元410为该DRB分配DRB ID，且每个DRB的DRB ID都是唯一的，因此确定单元410将DRB ID作为该DRB对应的密钥参数。
确定单元410中可以包括随机数生成器，当用户设备与主基站建立RRC连接之后，辅基站会接收到主基站发送的DRB建立或新增请求，辅基站在接收到该DRB建立或新增请求后，为该用户设备分配DRB，然后针对该DRB随机数生成器生成一个随机数，随机数生成器生成的每一个随机数都是唯一的，因此确定单元410可将该随机数作为该DRB对应的密钥参数。
确定单元410中还可以包括计数器，当用户设备与主基站建立RRC连接 之后，辅基站会接收到主基站发送的DRB建立或新增请求，辅基站在接收到该DRB建立或新增请求后，为该用户设备分配DRB，然后针对该DRB计数器生成一个计数器值，计数器生成的每一个计数器值都是唯一的，因此确定单元410可将该计数器值作为该DRB对应的密钥参数。
可选地，若密钥参数由主基站分配，则接收单元430用于接收主基站发送的DRB建立或新增请求，该DRB建立或新增请求携带密钥参数。
该密钥参数仅包括：DRB ID。
具体的，用户设备与主基站建立RRC连接之后，主基站为该用户设备分配DRB，并为该DRB分配DRB ID，且每个DRB的DRB ID都是唯一的，因此可将DRB ID作为该DRB对应的密钥参数。
相应的，确定单元410具体用于从接收到的DRB建立或新增请求获取密钥参数。
发送单元420用于向DRB对应的用户设备发送该密钥参数。
可选地，发送单元420可先将该密钥参数发送至主基站，再由主基站将该密钥参数转发至用户设备。
用户设备接收到辅基站发送的密钥参数后，通过使用密钥生成功KDF将密钥参数及该用户设备生成的基本密钥(如，辅基站密钥S-KeNB)进行计算，从而生成用户面密钥。
接收单元430用于接收主基站发送的该主基站生成的基本密钥。
其中，用户设备生成的基本密钥与主基站生成的基本密钥相同。
具体的，用户设备和主基站分别通过使用密钥生成功能KDF将相同的共享密钥(如，基站密钥KeNB)和相同的共享密钥参数进行计算，从而生成基本密钥。因此，用户设备生成的基本密钥与主基站生成的基本密钥相同。
生成单元440用于根据密钥参数及主基站生成的基本密钥生成用户面密钥。
生成单元440根据密钥参数及主基站生成的基本密钥通过与用户设备 生成用户面密钥同样的方式生成用户面密钥。由于用户设备生成的基本密钥与主基站生成的基本密钥相同，且采用同样的用户面密钥生成方式，因此用户设备生成的用户面密钥与生成单元440生成的用户面密钥相同。
可选地，本实施例中生成的用户面密钥可以具体为用户面加密密钥。用户设备或辅基站在发送用户面数据前，根据生成的用户面加密密钥将用户面数据加密后形成密文再发送，使得数据在发送过程中无法被破解；相应的，用户设备或辅基站在接收到用户面数据后，根据生成的用户面加密密钥将用户面数据解密，得到原始用户面数据。
可选地，本实施例中生成的用户面密钥可以具体为用户面完整性保护密钥。用户设备或辅基站在发送用户面数据前，根据生成的用户面完整性保护密钥将用户面数据进行完整性保护再发送，使得数据在发送过程中无法被篡改；相应的，用户设备或辅基站在接收到用户面数据后，根据生成的用户面完整性保护密钥将用户面数据的完整性进行校验，以确保用户面数据没有被篡改。
通过利用本发明实施例四提供的辅基站，用户设备与辅基站之间的用户面密钥分别由用户设备和辅基站生成，可有效降低主基站的负荷。并且，由于同一用户设备不同的DRB对应不同的密钥参数，因此同一用户设备与辅基站之间针对不同的DRB生成不同的用户面密钥，可有效提高辅基站与用户设备之间的用户面密钥的安全性。
在硬件实现上，以上发送单元420可以为发射机或收发机，以上接收单元430可以为接收机或收发机，且该发送单元420和接收单元430可以集成在一起构成收发单元，对应于硬件实现为收发机。以上确定单元410和生成单元440可以以硬件形式内嵌于或独立于辅基站的处理器中，也可以以软件形式存储于辅基站的存储器中，以便于处理器调用执行以上各个模块对应的操作。该处理器可以为中央处理单元(CPU)、微处理器、单片机等。
如图8所示，其为本发明实施例五所提供的一种辅基站的结构示意图。 该辅基站包括发射机510、接收机520、存储器530以及分别与发射机510、接收机520和存储器530连接的处理器540。当然，辅基站还可以包括天线、基带处理部件、中射频处理部件、输入输出装置等通用部件，本发明实施例在此不再任何限制。该辅基站为小基站,小基站具体为微基站或毫基站。，用以实现本发明实施例一提供的密钥生成方法。
其中，存储器530中存储一组程序代码，且处理器540用于调用存储器530中存储的程序代码，用于执行以下操作：
确定DRB对应的密钥参数；
向所述DRB对应的用户设备发送所述密钥参数，以使所述用户设备根据所述密钥参数及所述用户设备生成的基本密钥生成用户面密钥；
接收主基站发送的所述主基站生成的基本密钥；
根据所述密钥参数及所述主基站生成的基本密钥生成所述用户面密钥；
其中，所述用户设备生成的基本密钥与所述主基站生成的基本密钥相同。
进一步地，所述确定DRB对应的密钥参数具体为：
为所述DRB分配或生成密钥参数，所述密钥参数至少包括以下参数中的一个：DRB ID、随机数、计数器值。
进一步地，处理器540用于调用存储器530中存储的程序代码，还用于执行以下操作：
在所述确定DRB对应的密钥参数之前，接收主基站发送的DRB建立或新增请求，所述DRB建立或新增请求携带所述密钥参数；所述确定DRB对应的密钥参数具体为：从所述DRB建立或新增请求获取所述密钥参数，所述密钥参数包括：DRB ID。
进一步地，所述向所述DRB对应的用户设备发送所述密钥参数具体为：
通过所述主基站将所述密钥参数发送至所述用户设备。
进一步地，所述用户面密钥为用户面加密密钥或用户面完整性保护密钥。
其中，主基站为宏基站。
通过利用本发明实施例五提供的辅基站，用户设备与辅基站之间的用户面密钥分别由用户设备和辅基站生成，可有效降低主基站的负荷。并且，由于同一用户设备不同的DRB对应不同的密钥参数，因此同一用户设备与辅基站之间针对不同的DRB生成不同的用户面密钥，可有效提高辅基站与用户设备之间的用户面密钥的安全性。
下面以图9为例详细说明本发明实施例六提供的一种主基站，图9为本发明实施例六提供的一种主基站的结构示意图。该主基站为宏基站，用以实现本发明实施例二提供的密钥生成方法。
如图9所示，该主基站包括：确定单元610，发送单元620。
确定单元610用于确定DRB对应的密钥参数。
其中，密钥参数包括：DRB ID。
具体的，用户设备与主基站建立RRC连接之后，主基站为该用户设备分配DRB，确定单元610为该DRB分配DRB ID，且每个DRB的DRB ID都是唯一的，因此确定单元610将DRB ID作为该DRB对应的密钥参数。
发送单元620用于向DRB对应的用户设备发送密钥参数。
用户设备接收到辅基站发送的密钥参数后，通过使用密钥生成KDF将密钥参数及该用户设备生成的基本密钥(如，辅基站密钥S-KeNB)进行计算，从而生成用户面密钥。
其中，该辅基站为小基站,小基站具体为微基站或毫基站。
发送单元620还用于向辅基站发送密钥参数及主基站生成的基本密钥。
其中，用户设备生成的基本密钥与主基站生成的基本密钥相同。
具体的，用户设备和主基站分别通过使用密钥生成功能KDF将相同的共享密钥(如，基站密钥KeNB)和相同的共享密钥参数进行计算，从而生成基本密钥。因此，用户设备生成的基本密钥与主基站生成的基本密钥相同。
辅基站根据密钥参数及主基站生成的基本密钥通过与用户设备生成用户面密钥同样的方式生成用户面密钥。由于用户设备生成的基本密钥与主基站 生成的基本密钥相同，且采用同样的用户面密钥生成方式，因此用户设备生成的用户面密钥与辅基站生成的用户面密钥相同。
可选地，本实施例中生成的用户面密钥可以具体为用户面加密密钥。用户设备或辅基站在发送用户面数据前，根据生成的用户面加密密钥将用户面数据加密后形成密文再发送，使得数据在发送过程中无法被破解；相应的，用户设备或辅基站在接收到用户面数据后，根据生成的用户面加密密钥将用户面数据解密，得到原始用户面数据。
可选地，本实施例中生成的用户面密钥可以具体为用户面完整性保护密钥用户设备或辅基站在发送用户面数据前，根据生成的用户面完整性保护密钥将用户面数据进行完整性保护再发送，使得数据在发送过程中无法被篡改；相应的，用户设备或辅基站在接收到用户面数据后，根据生成的用户面完整性保护密钥将用户面数据的完整性进行校验，以确保用户面数据没有被篡改。
通过利用本发明实施例六提供的主基站，用户设备与辅基站之间的用户面密钥分别由用户设备和辅基站生成，可有效降低主基站的负荷。并且，由于同一用户设备不同的DRB对应不同的密钥参数，因此同一用户设备与辅基站之间针对不同的DRB生成不同的用户面密钥，可有效提高辅基站与用户设备之间的用户面密钥的安全性。
在硬件实现上，以上发送单元620可以为发射机或收发机，以上确定单元610可以以硬件形式内嵌于或独立于主基站的处理器中，也可以以软件形式存储于主基站的存储器中，以便于处理器调用执行以上各个模块对应的操作。该处理器可以为中央处理单元(CPU)、微处理器、单片机等。
如图10所示，其为本发明实施例七所提供的一种主基站的结构示意图。该主基站包括发射机710、存储器720以及分别与发射机710和存储器720连接的处理器730。当然，主基站还可以包括天线、基带处理部件、中射频处理部件、输入输出装置等通用部件，本发明实施例在此不再任何限制。该主基站为宏基站，用以实现本发明实施例二提供的密钥生成方法。
其中，存储器720中存储一组程序代码，且处理器730用于调用存储器720中存储的程序代码，用于执行以下操作：
确定DRB对应的密钥参数；
向所述DRB对应的用户设备发送所述密钥参数，以使所述用户设备根据所述密钥参数及所述用户设备生成的基本密钥生成用户面密钥；
向所述辅基站发送所述密钥参数及所述主基站生成的基本密钥，以使辅基站根据所述密钥参数及主基站生成的基本密钥生成所述用户面密钥；
其中，所述用户设备生成的基本密钥与所述主基站生成的基本密钥相同。
进一步地，所述密钥参数包括：DRB ID。
进一步地，所述用户面密钥为用户面加密密钥或用户面完整性保护密钥。
其中，该辅基站为小基站,小基站具体为微基站或毫基站。
通过利用本发明实施例七提供的主基站，用户设备与辅基站之间的用户面密钥分别由用户设备和辅基站生成，可有效降低主基站的负荷。并且，由于同一用户设备不同的DRB对应不同的密钥参数，因此同一用户设备与辅基站之间针对不同的DRB生成不同的用户面密钥，可有效提高辅基站与用户设备之间的用户面密钥的安全性。
下面以图11为例详细说明本发明实施例八提供的一种主基站，图11为本发明实施例八提供的一种主基站的结构示意图。该主基站为宏基站，用以实现本发明实施例三提供的密钥生成方法。
如图11所示，该主基站包括：确定单元810，发送单元820和生成单元830。
确定单元810用于确定DRB对应的密钥参数。
其中，密钥参数包括：DRB ID。
具体的，用户设备与主基站建立RRC连接之后，主基站为该用户设备分配DRB，确定单元810为该DRB分配DRB ID，且每个DRB的DRB ID都是唯一的，因此确定单元810将DRB ID作为该DRB对应的密钥参数。
发送单元820用于向DRB对应的用户设备发送密钥参数。
用户设备接收到辅基站发送的密钥参数后，通过使用密钥生成功KDF将密钥参数及该用户设备生成的基本密钥(如，辅基站密钥S-KeNB)进行计算，从而生成用户面密钥。
其中，该辅基站为小基站,小基站具体为微基站或毫基站。
生成单元830用于根据密钥参数及主基站生成的基本密钥生成用户面密钥。
其中，用户设备生成的基本密钥与主基站生成的基本密钥相同。
具体的，用户设备和主基站分别通过使用密钥生成功能KDF将相同的共享密钥(如，基站密钥KeNB)和相同的共享密钥参数进行计算，从而生成基本密钥。因此，用户设备生成的基本密钥与主基站生成的基本密钥相同。
生成单元830根据密钥参数及主基站生成的基本密钥通过与用户设备生成用户面密钥同样的方式生成用户面密钥。由于用户设备生成的基本密钥与主基站生成的基本密钥相同，且采用同样的用户面密钥生成方式，因此用户设备生成的用户面密钥与生成单元830生成的用户面密钥相同。
发送单元820还用于向辅基站发送生成的用户面密钥。
辅基站将主基站发送的用户面密钥作为用户设备与辅基站之间的用户面密钥。
可选地，本实施例中生成的用户面密钥可以具体为用户面加密密钥用户设备或辅基站在发送用户面数据前，根据生成的用户面加密密钥将用户面数据加密后形成密文再发送，使得数据在发送过程中无法被破解；相应的，用户设备或辅基站在接收到用户面数据后，根据生成的用户面加密密钥将用户面数据解密，得到原始用户面数据。
可选地，本实施例中生成的用户面密钥可以具体为用户面完整性保护密钥。用户设备或辅基站在发送用户面数据前，根据生成的用户面完整性保护密钥将用户面数据进行完整性保护再发送，使得数据在发送过程中无法被篡 改；相应的，用户设备或辅基站在接收到用户面数据后，根据生成的用户面完整性保护密钥将用户面数据的完整性进行校验，以确保用户面数据没有被篡改。
通过利用本发明实施例八提供的主基站，用户设备与辅基站之间的用户面密钥分别由用户设备和主基站生成，可有效降低主基站的负荷。并且，由于同一用户设备不同的DRB对应不同的密钥参数，因此同一用户设备与辅基站之间针对不同的DRB生成不同的用户面密钥，可有效提高辅基站与用户设备之间的用户面密钥的安全性。
在硬件实现上，以上发送单元820可以为发射机或收发机，以上确定单元810和生成单元830可以以硬件形式内嵌于或独立于主基站的处理器中，也可以以软件形式存储于主基站的存储器中，以便于处理器调用执行以上各个模块对应的操作。该处理器可以为中央处理单元(CPU)、微处理器、单片机等。
如图12所示，其为本发明实施例九所提供的一种主基站的结构示意图。该主基站包括发射机910、存储器920以及分别与发射机910和存储器920连接的处理器930。当然，主基站还可以包括天线、基带处理部件、中射频处理部件、输入输出装置等通用部件，本发明实施例在此不再任何限制。该主基站为宏基站，用以实现本发明实施例二提供的密钥生成方法。
其中，存储器920中存储一组程序代码，且处理器930用于调用存储器920中存储的程序代码，用于执行以下操作：
确定DRB对应的密钥参数；
向所述DRB对应的用户设备发送所述密钥参数，以使所述用户设备根据所述密钥参数及所述用户设备生成的基本密钥生成用户面密钥；
根据所述密钥参数及主基站生成的基本密钥生成所述用户面密钥；
向辅基站发送所述用户面密钥；
其中，所述用户设备生成的基本密钥与所述主基站生成的基本密钥相同。
进一步地，所述密钥参数包括：DRB ID。
进一步地，所述用户面密钥为用户面加密密钥或用户面完整性保护密钥。
其中，该辅基站为小基站,小基站具体为微基站或毫基站。通过利用本发明实施例九提供的主基站，用户设备与辅基站之间的用户面密钥分别由用户设备和主基站生成，可有效降低主基站的负荷。并且，由于不同用户设备的密钥参数不同，因此辅基站与不同用户设备之间的用户面密钥不同由于同一用户设备不同的DRB对应不同的密钥参数，因此同一用户设备与辅基站之间针对不同的DRB生成不同的用户面密钥，可有效提高辅基站与用户设备之间的用户面密钥的安全性。
下面以图13为例详细说明本发明实施例十提供的一种用户设备，图13为本发明实施例十提供的一种用户设备的结构示意图。该用户设备可以为实施例一，实施例二或实施例三中所述的用户设备。
如图13所示，该用户设备包括：接收单元1010和生成单元1020。
接收单元1010用于接收主基站或辅基站发送的DRB对应的密钥参数。
其中，主基站为宏基站，辅基站为小基站,小基站具体为微基站或毫基站。
具体的，密钥参数可由辅基站分配，也可由主基站分配。
可选地，若密钥参数由辅基站分配，则密钥参数至少包括以下参数中的一个：DRB ID、随机数、计数器值。
具体的，用户设备与主基站建立RRC连接之后，辅基站会接收到主基站发送的DRB建立或新增请求，辅基站在接收到该DRB建立或新增请求后，为该用户设备分配DRB，并为该DRB分配DRB ID，且每个DRB的DRB ID都是唯一的，因此可将DRB ID作为该DRB对应的密钥参数。
辅基站中可以包括随机数生成器，当用户设备与主基站建立RRC连接之后，辅基站会接收到主基站发送的DRB建立或新增请求，辅基站在接收到该DRB建立或新增请求后，为该用户设备分配DRB，然后针对该DRB随机数生成 器生成一个随机数，随机数生成器生成的每一个随机数都是唯一的，因此可将该随机数作为该DRB对应的密钥参数。
辅基站中还可以包括计数器，当用户设备与主基站建立RRC连接之后，辅基站会接收到主基站发送的DRB建立或新增请求，辅基站在接收到该DRB建立或新增请求后，为该用户设备分配DRB，然后针对该DRB计数器生成一个计数器值，计数器生成的每一个计数器值都是唯一的，因此可将该计数器值作为该DRB对应的密钥参数。
辅基站分配完密钥参数后，可将密钥参数直接发送至该用户设备，也可先将密钥参数发送至主基站，由主基站转发至该用户设备。
可选地，若密钥参数由主基站分配，则密钥参数仅包括：DRB ID。
具体的，用户设备与主基站建立RRC连接之后，主基站为该用户设备分配DRB，且每个DRB的DRB ID都是唯一的，因此可将DRB ID作为该DRB对应的密钥参数。
主基站分配完密钥参数后，可将密钥参数直接发送至该用户设备，也可先将密钥参数发送至辅基站，由辅基站转发至该用户设备。
生成单元1020用于根据密钥参数及基本密钥生成用户面密钥。
接收单元1010接收到密钥参数后，生成单元1020通过使用密钥生成功能KDF将密钥参数及该用户设备生成的基本密钥(如，辅基站密钥S-KeNB)进行计算，从而生成用户面密钥。
相应的，辅基站的用户面密钥有辅基站或主基站生成。辅基站或主基站该密钥参数及主基站生成的基本密钥生成用户面密钥。
其中，用户设备生成的基本密钥与主基站生成的基本密钥相同。
具体的，用户设备和主基站分别通过使用密钥生成功能KDF将相同的共享密钥(如，基站密钥KeNB)和相同的共享密钥参数进行计算，从而生成基本密钥。因此，用户设备生成的基本密钥与主基站生成的基本密钥相同。
并且，辅基站或主基站根据密钥参数及主基站生成的基本密钥通过与用 户设备生成用户面密钥同样的方式生成用户面密钥。由于用户设备生成的基本密钥与辅基站或主基站生成的基本密钥相同，且采用同样的用户面密钥生成方式，因此用户设备生成的用户面密钥与辅基站或主基站生成的用户面密钥相同。
可选地，本实施例中生成的用户面密钥可以具体为用户面加密密钥。用户设备或辅基站在发送用户面数据前，根据生成的用户面加密密钥将用户面数据加密后形成密文再发送，使得数据在发送过程中无法被破解；相应的，用户设备或辅基站在接收到用户面数据后，根据生成的用户面加密密钥将用户面数据解密，得到原始用户面数据。
可选地，本实施例中生成的用户面密钥可以具体为用户面完整性保护密钥。用户设备或辅基站在发送用户面数据前，根据生成的用户面完整性保护密钥将用户面数据进行完整性保护再发送，使得数据在发送过程中无法被篡改；相应的，用户设备或辅基站在接收到用户面数据后，根据生成的用户面完整性保护密钥将用户面数据的完整性进行校验，以确保用户面数据没有被篡改。
通过利用本发明实施例十提供的用户设备，用户设备与辅基站之间的用户面密钥分别由用户设备和辅基站生成，或分别由用户设备和主基站生成，可有效降低主基站的负荷。并且，由于同一用户设备不同的DRB对应不同的密钥参数，因此同一用户设备与辅基站之间针对不同的DRB生成不同的用户面密钥，可有效提高辅基站与用户设备之间的用户面密钥的安全性。
在硬件实现上，以上接收单元1010可以为接收机机或收发机，以上生成单元1020可以以硬件形式内嵌于或独立于用户设备的处理器中，也可以以软件形式存储于用户设备的存储器中，以便于处理器调用执行以上各个模块对应的操作。该处理器可以为中央处理单元(CPU)、微处理器、单片机等。
如图14所示，其为本发明实施例十一所提供的一种用户设备的结构示意图。该用户设备包括接收机1110、存储器1120以及分别与接收机1110和存 储器1120连接的处理器1130。当然，用户设备还可以包括天线、基带处理部件、中射频处理部件、输入输出装置等通用部件，本发明实施例在此不再任何限制。该用户设备可以为实施例一，实施例二或实施例三中所述的用户设备。
其中，存储器1120中存储一组程序代码，且处理器1130用于调用存储器1120中存储的程序代码，用于执行以下操作：
接收主基站或辅基站发送的DRB对应的密钥参数；
根据所述密钥参数及基本密钥生成用户面密钥。
进一步地，所述密钥参数至少包括以下参数中的一个：DRB ID、随机数、计数器值。
进一步地，所述用户面密钥为用户面加密密钥或用户面完整性保护密钥。
其中，主基站为宏基站，辅基站为小基站,小基站具体为微基站或毫基站。通过利用本发明实施例十一提供的用户设备，用户设备与辅基站之间的用户面密钥分别由用户设备和辅基站生成，或分别由用户设备和主基站生成，可有效降低主基站的负荷。并且，由于同一用户设备不同的DRB对应不同的密钥参数，因此同一用户设备与辅基站之间针对不同的DRB生成不同的用户面密钥，可有效提高辅基站与用户设备之间的用户面密钥的安全性。
专业人员应该还可以进一步意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、计算机软件或者二者的结合来实现，为了清楚地说明硬件和软件的可互换性，在上述说明中已经按照功能一般性地描述了各示例的组成及步骤。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本发明的范围。
结合本文中所公开的实施例描述的方法或算法的步骤可以用硬件、处理 器执行的软件模块，或者二者的结合来实施。软件模块可以置于随机存储器(RAM)、内存、只读存储器(ROM)、电可编程ROM、电可擦除可编程ROM、寄存器、硬盘、可移动磁盘、CD-ROM、或技术领域内所公知的任意其它形式的存储介质中。
以上所述的具体实施方式，对本发明的目的、技术方案和有益效果进行了进一步详细说明，所应理解的是，以上所述仅为本发明的具体实施方式而已，并不用于限定本发明的保护范围，凡在本发明的精神和原则之内，所做的任何修改、等同替换、改进等，均应包含在本发明的保护范围之内。

Claims (19)

  1. 一种密钥生成方法，其特征在于，所述方法包括：
    确定无线数据承载DRB对应的密钥参数；
    向所述DRB对应的用户设备发送所述密钥参数，以使所述用户设备根据所述密钥参数及所述用户设备生成的基本密钥生成用户面密钥；
    接收主基站发送的所述主基站生成的基本密钥；
    根据所述密钥参数及所述主基站生成的基本密钥生成所述用户面密钥。
  2. 根据权利要求1所述的方法，其特征在于，所述确定DRB对应的密钥参数具体为：
    为所述DRB分配或生成密钥参数，所述密钥参数至少包括以下参数中的一个：DRB ID、随机数、计数器值。
  3. 根据权利要求1所述的方法，其特征在于，在所述确定DRB对应的密钥参数之前，所述方法还包括：
    接收主基站发送的DRB建立或新增请求，所述DRB建立或新增请求携带所述密钥参数；
    所述确定DRB对应的密钥参数具体为：
    从所述DRB建立或新增请求获取所述密钥参数，所述密钥参数包括：DRB ID。
  4. 根据权利要求1-3任一所述的方法，其特征在于，所述向所述DRB对应的用户设备发送所述密钥参数具体为：
    通过所述主基站将所述密钥参数发送至所述用户设备。
  5. 根据权利要求1-4任一所述的方法，其特征在于，所述用户面密钥为用户面加密密钥或用户面完整性保护密钥。
  6. 一种密钥生成方法，其特征在于，所述方法包括：
    确定无线数据承载DRB对应的密钥参数；
    向所述DRB对应的用户设备发送所述密钥参数，以使所述用户设备根据 所述密钥参数及所述用户设备生成的基本密钥生成用户面密钥；
    向所述辅基站发送所述密钥参数及所述主基站生成的基本密钥，以使辅基站根据所述密钥参数及主基站生成的基本密钥生成所述用户面密钥；或者，根据所述密钥参数及主基站生成的基本密钥生成所述用户面密钥，向辅基站发送所述用户面密钥。
  7. 根据权利要求6所述的方法，其特征在于，所述密钥参数包括：DRB ID。
  8. 根据权利要求6或7所述的方法，其特征在于，所述用户面密钥为用户面加密密钥或用户面完整性保护密钥。
  9. 一种辅基站，其特征在于，所述辅基站包括：
    确定单元，用于确定无线数据承载DRB对应的密钥参数；
    发送单元，用于向所述DRB对应的用户设备发送所述密钥参数，以使所述用户设备根据所述密钥参数及所述用户设备生成的基本密钥生成用户面密钥；
    接收单元，用于接收主基站发送的所述主基站生成的基本密钥；
    生成单元，用于根据所述密钥参数及所述主基站生成的基本密钥生成所述用户面密钥。
  10. 根据权利要求9所述的辅基站，其特征在于，所述确定单元具体用于：
    为所述DRB分配或生成密钥参数，所述密钥参数至少包括以下参数中的一个：DRB ID、随机数、计数器值。
  11. 根据权利要求9所述的辅基站，其特征在于，所述接收单元还用于：接收主基站发送的DRB建立或新增请求，所述DRB建立或新增请求携带所述密钥参数；
    所述确定单元具体用于：
    从所述DRB建立或新增请求获取所述密钥参数，所述密钥参数包括：DRB ID。
  12. 根据权利要求9-11任一所述的辅基站，其特征在于，所述发送单元具体用于：
    通过所述主基站将所述密钥参数发送至所述用户设备。
  13. 根据权利要求9-12任一所述的辅基站，其特征在于，所述用户面密钥为用户面加密密钥或用户面完整性保护密钥。
  14. 一种主基站，其特征在于，所述主基站包括：
    确定单元，用于确定无线数据承载DRB对应的密钥参数；
    发送单元，用于向所述DRB对应的用户设备发送所述密钥参数，以使所述用户设备根据所述密钥参数及所述用户设备生成的基本密钥生成用户面密钥；
    所述发送单元还用于向所述辅基站发送所述密钥参数及所述主基站生成的基本密钥，以使辅基站根据所述密钥参数及主基站生成的基本密钥生成所述用户面密钥；或者，所述主基站还包括：生成单元，用于根据所述密钥参数及主基站生成的基本密钥生成所述用户面密钥，所述发送单元还用于向辅基站发送所述用户面密钥。
  15. 根据权利要求14所述的主基站，其特征在于，所述密钥参数包括：DRB ID。
  16. 根据权利要求14或15所述的主基站，其特征在于，所述用户面密钥为用户面加密密钥或用户面完整性保护密钥。
  17. 一种用户设备，其特征在于，所述用户设备包括：
    接收单元，用于接收主基站或辅基站发送的无线数据承载DRB对应的密钥参数；
    生成单元，用于根据所述密钥参数及基本密钥生成用户面密钥。
  18. 根据权利要求17所述的用户设备，其特征在于，所述密钥参数至少包括以下参数中的一个：DRB ID、随机数、计数器值。
  19. 根据权利要求17或18所述的用户设备，其特征在于，所述用户 面密钥为用户面加密密钥或用户面完整性保护密钥。
PCT/CN2015/074324 2014-03-18 2015-03-16 密钥生成方法、主基站、辅基站及用户设备 WO2015139596A1 (zh)

Priority Applications (4)

Application Number Priority Date Filing Date Title
ES15765368T ES2821818T3 (es) 2014-03-18 2015-03-16 Método de generación de claves, eNodoB maestro, eNodoB secundario y equipo de usuario
EP20179098.7A EP3768039B1 (en) 2014-03-18 2015-03-16 Key generation method, master enodeb, secondary enodeb and user equipment
EP15765368.4A EP3163923B1 (en) 2014-03-18 2015-03-16 Key generation method, master enodeb, secondary enodeb and user equipment
US15/268,808 US20170005795A1 (en) 2014-03-18 2016-09-19 Key Generation Method, Master eNodeB, Secondary eNodeB and User Equipment

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201410100651.8A CN104936173B (zh) 2014-03-18 2014-03-18 密钥生成方法、主基站、辅基站及用户设备
CN201410100651.8 2014-03-18

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US15/268,808 Continuation US20170005795A1 (en) 2014-03-18 2016-09-19 Key Generation Method, Master eNodeB, Secondary eNodeB and User Equipment

Publications (1)

Publication Number Publication Date
WO2015139596A1 true WO2015139596A1 (zh) 2015-09-24

Family

ID=54123078

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2015/074324 WO2015139596A1 (zh) 2014-03-18 2015-03-16 密钥生成方法、主基站、辅基站及用户设备

Country Status (5)

Country Link
US (1) US20170005795A1 (zh)
EP (2) EP3768039B1 (zh)
CN (1) CN104936173B (zh)
ES (1) ES2821818T3 (zh)
WO (1) WO2015139596A1 (zh)

Families Citing this family (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108810899A (zh) * 2017-04-28 2018-11-13 维沃移动通信有限公司 完整性检测方法、终端及网络侧设备
CN109845300B (zh) * 2017-06-17 2021-11-30 Lg 电子株式会社 无线通信系统中支持用于cu-cp和cu-up的分离的安全性的方法和装置
CN109391939B (zh) * 2017-08-10 2021-11-02 中兴通讯股份有限公司 密钥、参数发送方法及装置、用户面实体、控制面实体
JP7178604B2 (ja) * 2017-12-27 2022-11-28 パナソニックＩｐマネジメント株式会社 自転車
WO2019158117A1 (en) * 2018-02-15 2019-08-22 Huawei Technologies Co., Ltd. System and method for providing security in a wireless communications system with user plane separation
CN110831007B (zh) * 2018-08-10 2021-09-17 华为技术有限公司 用户面完整性保护方法、装置及设备
US10979902B2 (en) 2018-10-15 2021-04-13 Wipro Limited Method and system for securing user plane communication between user equipments and evolved NodeBs
WO2020087286A1 (zh) 2018-10-30 2020-05-07 华为技术有限公司 一种密钥生成方法、设备及系统
US11075944B2 (en) * 2018-12-18 2021-07-27 SOURCE Ltd. System and method for protection of computer networks against man-in-the-middle attacks
CN113766498B (zh) * 2020-06-01 2023-03-21 中国电信股份有限公司 密钥分发方法、装置、计算机可读存储介质及基站

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102056157A (zh) * 2009-11-04 2011-05-11 大唐移动通信设备有限公司 一种确定密钥和密文的方法、系统及装置
CN102487507A (zh) * 2010-12-01 2012-06-06 中兴通讯股份有限公司 一种实现完整性保护的方法及系统
CN102740289A (zh) * 2012-06-15 2012-10-17 电信科学技术研究院 一种密钥更新方法、装置及系统

Family Cites Families (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8396037B2 (en) * 2008-06-23 2013-03-12 Htc Corporation Method for synchronizing PDCP operations after RRC connection re-establishment in a wireless communication system and related apparatus thereof
US20110274038A1 (en) * 2009-11-09 2011-11-10 Qualcomm Incorporated Method and apparatus for avoiding unnecessary bearer establishment in circuit switched fallback
CN103096308B (zh) * 2011-11-01 2016-01-20 华为技术有限公司 生成组密钥的方法和相关设备
WO2013168850A1 (ko) * 2012-05-09 2013-11-14 삼성전자 주식회사 이동통신 시스템에서 불연속 수신을 제어하는 방법 및 장치
US9848322B2 (en) * 2013-01-17 2017-12-19 Intel IP Corporation Method, apparatus and system for managing bearers in a wireless communication system
PL2951975T3 (pl) * 2013-01-30 2017-01-31 Telefonaktiebolaget Lm Ericsson (Publ) Generowanie klucza bezpieczeństwa dla połączeń podwójnych
EP3087769A1 (en) * 2013-12-24 2016-11-02 Nec Corporation Apparatus, system and method for sce
EP3668044B1 (en) * 2014-01-28 2021-12-15 Huawei Technologies Co., Ltd. Security key change method, base station, and user equipment
EP3114880A1 (en) * 2014-03-06 2017-01-11 Nec Corporation Apparatus, system and method for small cell enhancement / dual connectivity
WO2016182580A1 (en) * 2015-05-14 2016-11-17 Nokia Technologies Oy Bearer setup in dual connectivity

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102056157A (zh) * 2009-11-04 2011-05-11 大唐移动通信设备有限公司 一种确定密钥和密文的方法、系统及装置
CN102487507A (zh) * 2010-12-01 2012-06-06 中兴通讯股份有限公司 一种实现完整性保护的方法及系统
CN102740289A (zh) * 2012-06-15 2012-10-17 电信科学技术研究院 一种密钥更新方法、装置及系统

Also Published As

Publication number Publication date
EP3768039A1 (en) 2021-01-20
CN104936173B (zh) 2022-02-25
ES2821818T3 (es) 2021-04-27
EP3163923A4 (en) 2017-05-03
CN104936173A (zh) 2015-09-23
EP3163923A1 (en) 2017-05-03
EP3163923B1 (en) 2020-07-08
EP3768039B1 (en) 2024-02-28
US20170005795A1 (en) 2017-01-05

Similar Documents

Publication Publication Date Title
WO2015139596A1 (zh) 密钥生成方法、主基站、辅基站及用户设备
KR102347524B1 (ko) 보안 보호를 위한 방법, 장치 및 시스템
CN109548017B (zh) 一种密钥交互方法及装置
CN104737570B (zh) 生成用于第一用户设备和第二用户设备之间的设备对设备通信的密钥的方法和设备
US20200336899A1 (en) Method, Apparatus, and System for Dual-Connectivity Communication
US8452007B2 (en) Security key generating method, device and system
CN102056157B (zh) 一种确定密钥和密文的方法、系统及装置
CN109729524B (zh) 一种rrc连接恢复方法及装置
EP2815623B1 (en) Device to device security using naf key
US10321308B2 (en) Method of refreshing a key in a user plane architecture 1A based dual connectivity situation
CN101309503A (zh) 无线切换方法、基站及终端
CN112449323B (zh) 一种通信方法、装置和系统
US20180249331A1 (en) Senb key update method and apparatus
CN109819439B (zh) 密钥更新的方法及相关实体
WO2013143387A1 (zh) 一种配置传输和数据传输的方法、系统及设备
US20200067702A1 (en) Key generation method and related device
EP4145787A1 (en) Communication method and apparatus
CN113795024A (zh) 一种获取密钥的方法及装置
CN109168161A (zh) 安全模式激活方法、装置、系统和计算机存储介质
CN113766494B (zh) 密钥获取方法、装置、用户设备及网络侧设备
CA3183089A1 (en) Key negotiation method, apparatus, and system
CN115529588A (zh) 安全链路建立方法、用户设备、pkmf设备和通信系统
KR20150134133A (ko) 단말의 인증 키 생성 장치 및 그 방법
CN113766494A (zh) 密钥获取方法、装置、用户设备及网络侧设备
CN102065420A (zh) 一种确定密钥的方法、系统和装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 15765368

Country of ref document: EP

Kind code of ref document: A1

REEP Request for entry into the european phase

Ref document number: 2015765368

Country of ref document: EP

WWE Wipo information: entry into national phase

Ref document number: 2015765368

Country of ref document: EP

NENP Non-entry into the national phase

Ref country code: DE