WO2016019586A1

WO2016019586A1 - Encryption keystream element updating device, method and double connection system

Info

Publication number: WO2016019586A1
Application number: PCT/CN2014/084023
Authority: WO
Inventors: 张冬梅; 张丽佳; 陈璟
Original assignee: 华为技术有限公司
Priority date: 2014-08-08
Filing date: 2014-08-08
Publication date: 2016-02-11
Also published as: CN105900471B; CN105900471A

Abstract

Provided are an encryption keystream element updating device, method and double connection system. A first access node and a second access node in the double connection system provide a wireless connection to a user equipment (UE), and the updating device is characterized by comprising: a receiving unit for acquiring a triggering message from the second access node, the triggering message being used to trigger the updating of an encryption keystream generation element; and a processing unit for updating the encryption keystream generation element according to the triggering message. The embodiment of the present invention updates the encryption keystream generation element when a change potentially causing a repetition of the encryption keystream occurs in a bearing state, thus preventing encryption keystream repetition caused by bearing switching.

Description

Key stream element updating device, method and dual connection system

[01] The present invention relates to the field of mobile communications, and in particular, to a key stream element updating apparatus, method, and dual connectivity system. Background technique

[02] With the development of mobile communication technologies and the increasing number of mobile terminals, mobile operators' base station capacity pressure is increasing. To alleviate the capacity pressure on base stations, the 3GPP (The 3rd Generation Partnership Project) standards organization has introduced a dual connectivity system. The dual-connection system includes a primary base station (Macro eNB, referred to as Me B) and a secondary base station (Secondary eNB, referred to as SeNB). The user equipment (User Equipment, UE for short) can establish a bearer access network through the primary base station or the secondary base station. At the same time, the bearer may also be transferred to the bearer, for example, the bearer is switched from the MeNB to the Se B, or the Se B is switched to the MeNB, thereby achieving the purpose of alleviating the capacity pressure of the base station.

[03] In the dual connectivity system, user plane data transmitted between the UE and the MeNB and between the UE and the SeNB is encrypted to ensure data transmission security. To further ensure the security of data transmission, in the security processing of LTE, it is necessary to avoid the repetition of the key stream used to encrypt the user plane data. The key stream elements that affect the key stream generation are: encryption key (Kupenc), Packet Data Convergence Protocol Count (PDCP COUNT for short), Data Radio Bearer Identity (DRB ID for short) ), data flow (Direction) and key stream length (Length).

[04] Direction has uplink and downlink directions. Length is a specific value depending on the encryption algorithm. Therefore, corresponding to a specific encryption algorithm, in each transmission direction, if Kupenc, PDCP COUNT value and DRB ID are the same, then generate The key stream will be the same. For example, if the encryption algorithm EEA1 is selected for all bearers, in the uplink direction of the SeNB, if the first bearer with the DRB ID of 1 is released and the second bearer with the DRB ID of 1 is established, the PDCP COUNT of the second bearer will be re-established. count. In this process, if the SeNB's root key S-KeNB is not updated, Kupenc will not change, resulting in two different bearers having the same Kupenc, PDCP COUNT value and DRB ID, which will produce the same for two different bearers. Key stream. To prevent the repetition of the key stream, the method adopted in the prior art is: if the previously established bearer has been released, assigning different DRB IDs to consecutive bearers, and the MeNB and the SeNB share one DRB ID resource pool, when the DRB When the ID is used up, the key update is triggered. In this way, different bearers can be avoided to have the same DRB ID, thereby avoiding The problem of free key stream duplication.

[05] However, the inventor found in the research process that with the prior art, when the bearer performs base station handover, the same bearer may have the same DRB ID and Kupenc, and the PDCP COUNT is repeated, causing the key stream to be duplicated. For example, in actual use, the following situation may occur: when the PDCP COUNT of the third bearer is 1000, the MeNB switches to the Se B, and the bearer ID does not change before and after the bearer handover; during the third bearer, the SeNB generates a key update. The PDCP COUNT of the third bearer is restarted to count; when the PDCP COUNT of the third bearer is 100, the SeNB is switched back to the MeNB, and the PDCP COUNT continues counting from 101. If the encryption key Kupenc of the MeNB does not change during the two handovers of the third bearer, the key stream of the data packet of the PDCP COUNT of 101 to 1000 after the third bearer is switched back from the SeNB to the MeNB, and the The key stream of the data packet with the PDCP COUNT of 101 to 1000 before the handover from the MeNB to the SeNB is repeated. Summary of the invention

An embodiment of the present invention provides a key stream element update apparatus, method, and dual connectivity system to solve the problem that a key stream repetition occurs when a bearer performs handover of a base station by using the prior art. [07] In a first aspect, an embodiment of the present invention provides a key stream generation element updating apparatus of a dual connectivity system, where the first access node and the second access node are simultaneously The user equipment UE provides a wireless connection, and the device includes:

a receiving unit, configured to acquire a trigger message from the second access node, where the trigger message is used to trigger an update of a key stream generating element, and a processing unit, configured to perform key stream generation according to the trigger message Element update. [09] In combination with the first aspect, in a first possible implementation manner of the first aspect,

[10] The processing unit, configured to perform the key stream generation element update according to the trigger message, is configured to: when acquiring the first information used to indicate the second access node key update, The first access node performs key stream generation element update.

[11] In combination with the first possible implementation manner of the first aspect, in a second possible implementation manner of the first aspect, [12] the processing unit is configured to: when used to indicate the second access And performing the key stream generation element update on the first access node, where the method includes: when acquiring the first information used to indicate the second access node key update And if there is a transfer bearer on the second access node, performing a key stream generation element update on the first access node, where the transfer bearer refers to the first access node Transfer to the bearer of the second access node.

[13] In combination with the first possible implementation of the first aspect, in a third possible implementation manner of the first aspect,

[14] The processing unit is configured to perform a key stream generation element update on the first access node when acquiring the first information that is used to indicate the second access node key update, including: For acquiring the first information of the second access node key update, if the first information carries the presence indication, performing key stream generation element update on the first access node, The presence indication is used to indicate that a transfer bearer exists on the second access node.

[15] In combination with the first possible implementation manner of the first aspect, in a fourth possible implementation manner of the first aspect,

[16] The processing unit is configured to perform a key stream generation element update on the first access node when acquiring the first information used to indicate the second access node key update, including: For acquiring a bearer transfer record, where the bearer transfer record is used to record a transfer bearer, where the transfer bearer refers to a bearer transferred from the first access node to the second access node; Recording all current bearers on the second access node, determining that there is a transfer bearer on the second access node, and performing key stream generation element update on the first access node. [17] In combination with the fourth possible implementation manner of the first aspect, in a fifth possible implementation manner of the first aspect,

[18] the processing unit is configured to acquire a bearer transfer record; if it is determined that the transfer bearer exists on the second access node according to the bearer transfer record and all current bearers on the second access node, The first access node performs the key stream generation element update, and further includes: deleting the bearer transfer record after performing the key stream generation element update on the first access node. [19] combining the first aspect, the first possible implementation manner of the first aspect, the second possible implementation manner of the first aspect, the third possible implementation manner of the first aspect, and the fourth possible implementation of the first aspect The fifth possible implementation manner of the first aspect, in the sixth possible implementation manner of the first aspect,

[20] The processing unit, configured to perform a key stream generation element update on the first access node, includes: updating a key of the first access node. [21] In combination with the fourth possible implementation manner of the first aspect or the fifth possible implementation manner of the first aspect, in the seventh possible implementation manner of the first aspect,

[22] The processing unit, configured to perform a key stream generation element update on the first access node, includes: used to re-allocate a DRB ID for the transfer bearer. [23] In combination with the first aspect, in the eighth possible implementation manner of the first aspect,

[24] the processing unit, configured to perform a key stream generation element update according to the trigger message, and the method includes: when used to indicate that the target bearer is transferred from the second access node to the first interface When the second information of the node is entered, the key stream generation element update is performed on the first access node. [25] In combination with the eighth possible implementation manner of the first aspect, in the ninth possible implementation manner of the first aspect,

[26] the processing unit is configured to: when acquiring the second information used to indicate that the target bearer is transferred from the second access node to the first access node, perform the first access node And the key stream generating element is updated, if: when the second information used to indicate that the target bearer is transferred from the second access node to the first access node is obtained, if according to the second information The switchback indication indicates that the target bearer is a transfer bearer, and the first access node performs a key stream generation element update, where the cutback indication is used to indicate that the target bearer is a transfer bearer.

[27] In combination with the eighth possible implementation manner of the first aspect, in the tenth possible implementation manner of the first aspect,

[28] the processing unit is configured to: when acquiring the second information used to indicate that the target bearer is transferred from the second access node to the first access node, perform the first access node The key stream generation element update includes: acquiring a bearer transfer record; and if the target bearer is determined to be a transfer bearer according to the bearer transfer record, performing key stream generation element update on the first access node.

[29] In combination with the ninth possible implementation manner of the first aspect or the tenth possible implementation manner of the first aspect, in the eleventh possible implementation manner of the first aspect,

[30] The processing unit, configured to perform a key stream generation element update on the first access node, includes: determining, according to the reset indication in the second information, that the target bearer is in the A PDCP COUNT reset occurs during the second access node, and a key stream generation element update is performed on the first access node.

[31] In combination with the ninth possible implementation of the first aspect or the tenth possible implementation of the first aspect, in a twelfth possible implementation manner of the first aspect,

[32] The processing unit, configured to perform a key stream generation element update on the first access node, to be: configured to determine, according to the reset identifier in the bearer transfer record, that the target bearer is in the A PDCP COUNT reset occurs during the second access node, and a key stream generation element update is performed on the first access node.

[33] In combination with the ninth possible implementation manner of the first aspect or the tenth possible implementation manner of the first aspect, in the thirteenth possible implementation manner of the first aspect, [34] the processing unit, configured to perform a key stream generation element update on the first access node, including: acquiring a current PDCP COUNT value of the target bearer, and the target bearer from the first connection a PDCP COUNT value when the ingress node transfers to the second access node; if the current PDCP COUNT value of the target bearer is less than or equal to the PDCP COUNT when the first access node is transferred to the second access node And performing a key stream generation element update on the first access node.

[35] combining the eighth possible implementation manner of the first aspect, the ninth possible implementation manner of the first aspect, the tenth possible implementation manner of the first aspect, the eleventh possible implementation manner of the first aspect, The twelfth possible implementation manner of the first aspect or the thirteenth possible implementation manner of the first aspect, in the fourteenth possible implementation manner of the first aspect, [36] the processing unit, configured to The first access node performs the key stream generation element update, including: updating the key of the first access node or reallocating the DRB ID for the target bearer.

[37] In a second aspect, an embodiment of the present invention provides a key stream generation element updating apparatus of a dual connectivity system, where the first access node and the second access node are simultaneously The UE provides a wireless connection, and the device includes: [38] a processing unit, configured to generate a trigger message when the preset condition is met, where the trigger message is used to instruct the first access node to trigger an update of a key stream generation element And a sending unit, configured to send a trigger message to the first access node.

[39] In combination with the second aspect, in a first possible implementation manner of the second aspect,

[40] The processing unit, configured to generate a trigger message when the preset condition is met, the method includes: generating, when the second access node performs a key update, generating first information; The sending the trigger message to the first access node includes: sending the first information to the first access node.

[41] In combination with the second first possible implementation aspect, in the second possible implementation manner of the second aspect,

[42] the processing unit, configured to: when the second access node performs a key update, generate the first information, where: the method is: when the second access node performs a key update, if A transfer bearer exists on the second access node to generate first information.

[43] In combination with the second aspect, in a third possible implementation of the second aspect,

[44] the processing unit, configured to generate a trigger message when the preset condition is met, the method includes: generating, when the target bearer is switched from the second access node to the first access node, generating a second The sending unit, configured to send the trigger message to the first access node, where: the method is: sending, to the first access node, the first Two information.

[45] In combination with the third possible implementation manner of the second aspect, in the fourth possible implementation manner of the second aspect,

[46] the processing unit, configured to: when the target bearer is handed over from the second access node to the first access node, generate the second information, including: when the target bearer is from the second When the ingress node switches to the first access node, if the target bearer is a transfer bearer, the second information carrying the switchback indication is generated.

[47] In combination with the third possible implementation manner of the second aspect, in a fifth possible implementation manner of the second aspect,

[48] the processing unit, configured to: when the target bearer is switched from the second access node to the first access node, generate the second information, where: the method is: when the target bearer is from the second When the ingress node switches to the first access node, if the target bearer is a transfer bearer, and the target bearer has a PDCP COUNT reset during the second access node, generating a carry-back indication and a heavy Set the second information indicated.

In a third aspect, an embodiment of the present invention provides a method for updating a key stream generation element of a dual connectivity system, where the first access node and the second access node are simultaneously The UE provides a wireless connection, the method includes: the first access node acquires a trigger message from the second access node, where the trigger message is used to trigger an update of a key stream generation element; the first access node The key stream generation element update is performed according to the trigger message.

[50] In combination with the third aspect, in a first possible implementation manner of the third aspect,

[51] The first access node performs the key stream generation element update on the first access node according to the trigger message, and includes: when acquiring, indicating that the second access node is updated by the key When a message is received, the key stream generation element update is performed on the first access node. [52] In combination with the first possible implementation manner of the third aspect, in a second possible implementation manner of the third aspect,

[53] The performing the key stream generation element update on the first access node includes: if there is a transfer bearer on the second access node, performing key stream generation element update on the first access node .

[54] In combination with the first possible implementation manner of the third aspect, in a third possible implementation manner of the third aspect,

[55] The performing the key stream generation element update on the first access node includes: performing keystream generation element update on the first access node if the first information carries a presence indication.

[56] In combination with the first possible implementation manner of the third aspect, in a fourth possible implementation manner of the third aspect,

[57] The performing the key stream generation element update on the first access node includes: acquiring a bearer transfer record; determining, according to the bearer transfer record and all current bearers on the second access node, Second access There is a transfer bearer on the node, and the key flow generation element update is performed on the first access node.

[58] In combination with the fourth possible implementation manner of the third aspect, in a fifth possible implementation manner of the third aspect,

After performing the key stream generation element update on the first access node, the method further includes: deleting the bearer transfer record. [60] combining the third aspect, the first possible implementation manner of the third aspect, the second possible implementation manner of the third aspect, the third possible implementation manner of the third aspect, and the fourth possible implementation of the third aspect The fifth possible implementation manner of the third aspect, in the sixth possible implementation manner of the third aspect,

[61] The performing a key stream generation element update on the first access node includes: updating a key of the first access node. [62] In combination with the fourth possible implementation manner of the third aspect or the fifth possible implementation manner of the third aspect, in the seventh possible implementation manner of the third aspect,

[63] The performing a key stream generation element update on the first access node includes: reassigning a DRB ID to the transfer bearer.

With reference to the third aspect, in an eighth possible implementation manner of the third aspect, [65] the first access node performs a key stream generation element on the first access node according to the trigger message. The updating includes: performing keystream generation element update to the first access node when acquiring second information indicating that the target bearer is transferred from the second access node to the first access node.

[66] In combination with the eighth possible implementation manner of the third aspect, in a ninth possible implementation manner of the third aspect,

[67] The performing the key stream generation element update on the first access node includes: determining, according to the switchback indication in the second information, that the target bearer is a transfer bearer, to the first access The node performs key stream generation element update.

[68] In combination with the eighth possible implementation manner of the third aspect, in a tenth possible implementation manner of the third aspect,

[69] The performing the key stream generation element update on the first access node includes: acquiring a bearer transfer record, where the bearer transfer record is used to record a transfer bearer; and determining the target bearer according to the bearer transfer record To transfer the bearer, the key stream generation element update is performed on the first access node.

[70] In combination with the ninth possible implementation manner of the third aspect or the tenth possible implementation manner of the third aspect, [71] The performing the key stream generation element update on the first access node includes: determining that the target bearer occurred during the second access node according to the reset indication in the second information The PDCP COUNT is reset, and the key stream generation element update is performed on the first access node.

[72] In combination with the ninth possible implementation manner of the third aspect or the tenth possible implementation manner of the third aspect, in the twelfth possible implementation manner of the third aspect,

The performing the key stream generation element update on the first access node includes: determining that the target bearer has a PDCP COUNT during the second access node according to the reset identifier in the bearer transfer record And performing key stream generation element update on the first access node.

[73] In combination with the ninth possible implementation manner of the third aspect or the tenth possible implementation manner of the third aspect, in the thirteenth possible implementation manner of the third aspect,

[74] The performing a key stream generation element update on the first access node includes: acquiring a current PDCP COUNT value of the target bearer, and transferring the target bearer from the first access node to the a PDCP COUNT value when the second access node is; if the current PDCP COUNT value of the target bearer is less than or equal to a PDCP COUNT value when the first access node is transferred to the second access node, An access node performs key stream generation element update.

[75] combining the eighth possible implementation manner of the third aspect, the ninth possible implementation manner of the third aspect, the tenth possible implementation manner of the third aspect, the eleventh possible implementation manner of the third aspect, The twelfth possible implementation manner of the third aspect or the thirteenth possible implementation manner of the third aspect, in the fourteenth possible implementation manner of the third aspect, [76] the first access node Performing the key stream generation element update includes: updating a key of the first access node or reallocating a DRB ID for the target bearer.

[77] In a fourth aspect, an embodiment of the present invention provides a method for updating a key stream generation element of a dual connectivity system, where the first access node and the second access node are simultaneously The UE provides a wireless connection, and the method includes: the second access node generates a trigger message when the preset condition is met, where the trigger message is used to instruct the first access node to trigger an update of the key stream generation element; Sending a trigger message to the first access node.

[78] In combination with the fourth aspect, in a first possible implementation manner of the fourth aspect,

The generating the triggering message includes: when the second access node performs the key update, generating the first information; the sending the trigger message to the first access node includes: The ingress node sends the first letter Interest.

[80] In combination with the fourth first possible implementation aspect, in a second possible implementation manner of the fourth aspect,

[81] The generating the first information includes: generating a first information if a transfer bearer exists on the second access node. [82] In combination with the fourth aspect, in a third possible implementation manner of the fourth aspect,

[83] The generating the trigger message includes: generating, when the target bearer is handed over from the second access node to the first access node, second information; sending the trigger message to the first access node The method includes: transmitting the second information to the first access node.

[84] In combination with the third possible implementation manner of the fourth aspect, in the fourth possible implementation manner of the fourth aspect, the generating the second information includes: if the target bearer is a transfer bearer, generating and carrying Switching back the indicated second information.

[86] In combination with the third possible implementation manner of the fourth aspect, in a fifth possible implementation manner of the fourth aspect,

[87] The generating the second information includes: if the target bearer is a transfer bearer, and the target bearer has a PDCP COUNT reset during the second access node, generating a carry-back indication and a reset indication The second message.

In a fifth aspect, an embodiment of the present invention provides a dual connectivity system, where the first access node and the second access node simultaneously provide a wireless connection for a UE, where , including:

[89] the second access node is configured to generate a trigger message when the preset condition is met, where the trigger message is used to instruct the first access node to trigger an update of a key stream generation element; The first access node sends a trigger message; the first access node is configured to acquire a trigger message from the second access node; and perform key stream generation element update according to the trigger message.

According to the embodiment of the present invention, the first access node may perform the key stream generation element update on the first access node when the second access node changes the bearer state that may cause the key stream to be duplicated. Thereby avoiding the occurrence of key stream repetition. DRAWINGS

[91] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the embodiments or the description of the prior art will be briefly described below, and it is obvious that it is common in the art. Technology For the personnel, other drawings can be obtained based on these drawings without paying for creative labor.

1 is a schematic diagram of an embodiment of a key stream generation element updating apparatus according to the present invention; [93] FIG. 2 is a schematic diagram of another embodiment of a key stream generation element updating apparatus according to the present invention; [94] FIG. FIG. 4 is a flowchart of another embodiment of a method for updating a key stream generation element according to the present invention; [96] FIG. 5 is a key stream generation method of the present invention. FIG. 6 is a flowchart of another embodiment of a method for updating a key stream generation element according to the present invention; [98] FIG. 7 is a schematic diagram of an embodiment of a dual connectivity system according to the present invention; [99] FIG. 8 is a schematic diagram of another embodiment of a key stream generation element updating apparatus according to the present invention; [100] FIG. 9 is a schematic diagram of another embodiment of a key stream generation element updating apparatus according to the present invention. detailed description

The technical solutions in the embodiments of the present invention are clearly and completely described in the following with reference to the accompanying drawings in the embodiments of the present invention. The embodiments are only a part of the embodiments of the invention, and not all of the embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention.

Referring to FIG. 1, FIG. 1 is a schematic diagram of an embodiment of a key stream generation element updating apparatus according to the present invention.

As shown in FIG. 1, the apparatus includes a receiving unit 101 and a processing unit 102. The device is disposed on a first access node. [104] The receiving unit 101 is configured to acquire a trigger message from the second access node, where the trigger message is used to trigger an update of a key stream generation element.

The receiving unit 101 first obtains a trigger message from the second access node, where the first access node may be Se B or Me B, and correspondingly, the second access node is MeNB or Se B. The trigger information is used to indicate that a state change occurs on a bearer on the second access node.

[106] In a possible implementation manner, the PDCP COUNT reset caused by the key update may cause the key stream to be duplicated, and the trigger message may be used to indicate the second access node key. Updated first letter Interest. The first information may carry a presence indication, where the presence indication is used to indicate that a transfer bearer exists on the second access node.

In another possible implementation manner, since the bearer transfer may also cause the key stream to be repeated, the trigger message may also be used to indicate that the target bearer is transferred from the second access node to the a second information of the first access node, where the second message may carry a switchback indication, where the switchback indication is used to indicate that the target bearer is a transfer bearer, and further, the second message may further carry a reset indication The reset indication is used to indicate that the target bearer has undergone a PDCP COUNT reset during the second access node.

[108] The trigger message may also be used to indicate that the second access node has other information that may cause the key stream to be repeated, and details are not described herein.

[109] The processing unit 102 is configured to perform a key stream generation element update according to the trigger message.

When the receiving unit 101 acquires the first information or the second message or other message, it indicates that the second access node has a bearer status change that may cause the key stream to be repeated. At this time, the processing unit 102 may initiate a key stream generation element update procedure, perform key stream generation element update on the first access node, such as updating an encryption key or reconfiguring a DRB ID, thereby preventing key stream repetition. After receiving the trigger information, the processing unit 102 may further determine whether the state change of the bearer on the second access node may cause key stream repetition. If not, the first connection is not performed. The ingress node performs key stream generation element update; if possible, the first access node performs key stream generation element update. This can reduce the number of times the first access node performs key stream generation element update and save system resources.

In a first possible implementation manner, if the trigger message is the first message, the processing unit 102 may determine, according to the information about the bearer transfer record, the presence indication, and the like, whether the transfer bearer exists on the second access node. If not, it indicates that the PDCP COUNT reset caused by the key update of the second access node does not cause the key stream to be duplicated. At this time, the first access node is not required to perform the key stream generation element update; if yes, The key update PDCP COUNT reset of the second access node may cause the key stream to be duplicated. At this time, the processing unit 102 may perform a key stream generation element update, where the transfer bearer refers to the first The bearer transferred to the bearer of the second access node; wherein the presence indication is used to indicate that there is a transfer bearer on the second access node; and the bearer transfer record is used to record the transfer bearer.

Specifically, the processing unit 102 may perform key stream generation element update on the first access node when acquiring the first information used to indicate the second access node key update. .

[114] The processing unit 102 may also be configured to: when the second access node key update is obtained a message, and when there is a transfer bearer on the second access node, performing a key stream generation element update on the first access node, where the transfer bearer refers to transferring from the first access node to the The bearer of the second access node.

The processing unit 102 may also, when acquiring the first information used to indicate the second access node key update, and the first information carries the presence indication, to the first access The node performs a key stream generation element update, where the presence indication is used to indicate that a transfer bearer exists on the second access node.

[116] The processing unit 102 may also determine, when the transfer bearer exists on the second access node, according to the obtained bearer transfer record and all current bearers on the second access node, The access node performs key stream generation element update. And deleting the bearer transfer record after performing key stream generation element update on the first access node.

[117] When the key stream generation element is updated, the processing unit 102 may perform a key stream generation element on the first access node by updating the key of the first access node. Update. Or performing key stream generation element update on the first access node in a manner of reassigning the DRB ID to the transfer bearer.

In a second possible implementation manner, if the trigger message is the second message, the second access node may determine, according to information such as a bearer transfer record and a switchback indication, whether the target bearer is a transfer bearer, if the target If the bearer is not a transfer bearer, the combination of the DRB ID of the target bearer and the first access node key does not occur, and the key bearer does not occur in the target bearer. In this case, the first access node does not need to perform the key. The stream generation element is updated; if the target bearer is a transfer bearer, it indicates that the target bearer may have a key stream repetition, and the processing unit 102 may perform the key stream generation element update. Alternatively, when the second information is obtained, the key stream generation element update may be directly performed on the first access node.

In a second possible implementation manner, after determining that the target bearer is a transfer bearer, the processing unit 102 may further determine whether the target bearer has a PDCP COUNT reset during the second access node. If no, it indicates that the DCP COUNT carried by the target does not overlap, and the key bearer does not repeat the key stream. In this case, the first access node does not need to perform key stream generation element update; if yes, the target bearer The PDCP COUNT may be duplicated, and the key bearer may be duplicated in the target bearer. At this time, the first access node may perform key stream generation element update.

[120] The processing unit 102 may be configured as a transfer bearer in the target bearer, and determine, according to the reset indication in the second information, that the target bearer has undergone a PDCP COUNT reset during the second access node. And performing key stream generation element update on the first access node. The processing unit 102 may be configured as a transfer bearer in the target bearer, and determine, according to the reset identifier in the bearer transfer record, that the target bearer has undergone a PDCP COUNT reset during the second access node. And performing key stream generation element update on the first access node.

[122] In the second possibility, after determining that the target bearer is a transfer bearer, the processing unit 102 may further determine whether the target bearer current PDCP COUNT value is greater than the transfer from the first access node to the first The PDCP COUNT value of the two access nodes. If yes, it indicates that the PDCP COUNT will not be duplicated, and the target bearer will not repeat the key stream. If not, the PDCP COUNT of the target bearer may be duplicated. In other words, key stream repetition may occur, and the first access node may perform key stream generation element update. [123] In this embodiment, the receiving unit is configured to acquire a trigger message from the second access node, where the trigger message is used to trigger an update of a key stream generation element; The trigger message performs key stream generation element update. With the embodiment, the first access node may perform key stream generation element update on the first access node when the second access node changes the bearer status that may cause the key stream to be duplicated, thereby avoiding the key. The flow of repetition occurs. Referring to FIG. 2, it is a schematic diagram of another embodiment of a key stream generation element updating apparatus according to the present invention.

As shown in FIG. 2, the apparatus includes a processing unit 201 and a transmitting unit 202. The device is disposed on a second access node.

The processing unit 201 is configured to generate a trigger message when the preset condition is met, where the trigger message is used to instruct the first access node to trigger an update of the key stream generation element. The preset condition may be that the second access node generates a key update, or may be the first access node that carries the transfer on the second access node, or may be caused by another second access node. The bearer status of the key stream is changed.

The processing unit 201 may generate first information when the second access node performs key update, or perform key update on the second access node, and the second access node The first information is generated when there is a transfer bearer. The processing unit 201 may generate second information when the target bearer switches from the second access node to the first access node. The second information may also carry a switchback indication if the target bearer is a transfer bearer. And if the target bearer is a transfer bearer, and the target bearer has a PDCP COUNT reset during the second access node, the second information may further carry a switchback indication and a reset indication.

The sending unit 202 is configured to send a trigger message to the first access node. The trigger message can The first message may also be a second message, or may be another trigger message generated by the processing unit.

[130] The first access node may perform the key stream generation element update immediately after receiving the trigger information, or may further determine whether the key stream is repeated according to the content of the trigger information and/or the trigger information. The key stream generation element update is performed when a key stream duplication may be sent. The specific process can participate in the foregoing embodiments, and will not be described again here.

In the embodiment, the processing unit is configured to generate a trigger message when the preset condition is met, where the trigger message is used to indicate that the first access node triggers update of the key stream generation element; Sending a trigger message to the first access node. With the embodiment, the second access node may send the trigger information to the first node when the bearer state change that may cause the key stream to be repeated, indicating that the first access node performs the key stream generation element update, thereby Avoid the occurrence of duplicate key streams.

The embodiment of the present invention further provides a method for updating a key stream generation element of a dual connectivity system, where the first access node and the second access node simultaneously provide a wireless connection for the UE.

Referring to FIG. 3, it is a flowchart of an embodiment of a method for updating a key stream generation element according to the present invention.

[134] Step 301: The first access node acquires a trigger message from the second access node, where the trigger message is used to trigger an update of a key stream generation element.

The first access node first obtains a trigger message from the second access node, where the first access node may be Se B or Me B, and the second access node is Me B or Se B. The trigger information is used to indicate that a status change occurs on a bearer on the second access node.

In a possible implementation, the PDCP COUNT reset due to the key update may cause the key stream to be duplicated, so the trigger message may be used to indicate the second access node key. Updated first information. The first information may carry a presence indication, where the presence indication is used to indicate that a transfer bearer exists on the second access node.

In another possible implementation manner, the trigger message may also be used to indicate that the target bearer is transferred from the second access node to the a second information of the first access node, where the second message may carry a switchback indication, where the switchback indication is used to indicate that the target bearer is a transfer bearer, and further, the second message may further carry a reset indication The reset indication is used to indicate that the target bearer has undergone a PDCP COUNT reset during the second access node.

[138] The trigger message may also be used to indicate that the second access node has other information that may cause the key stream to be repeated, and details are not described herein. [139] Step 302: The first access node performs key stream generation element update according to the trigger message.

When the first access node obtains the first information or the second message, it indicates that the second access node has a bearer status change that may cause the key stream to be duplicated. At this time, the first access node may initiate. The key stream generation element update process performs key stream generation element update on the first access node, such as updating an encryption key or reconfiguring a DRB ID, thereby preventing the key stream from being duplicated.

After receiving the trigger information, the first access node may further determine whether the change of the bearer status on the second access node may cause the key stream to be duplicated. If not, the first connection is not performed. The ingress node performs key stream generation element update; if possible, the first access node performs key stream generation element update. This can reduce the number of times the first access node performs key stream generation element update and save resources.

[142] In a first possible implementation manner, if the trigger message is the first message, the first access node may determine, according to information such as a bearer transfer record and a presence indication, whether the transfer bearer exists on the second access node. If not, it indicates that the PDCP COUNT reset caused by the key update of the second access node does not cause the key stream to be duplicated. At this time, the first access node is not required to perform the key stream generation element update; if yes, The key update PDCP COUNT reset of the second access node may cause the key stream to be duplicated. At this time, the first access node may perform key stream generation element update, where the transfer bearer refers to the first The bearer transferred to the bearer of the second access node; wherein the presence indication is used to indicate that there is a transfer bearer on the second access node; and the bearer transfer record is used to record the transfer bearer.

[143] In the second possible implementation manner, if the trigger message is the second message, the second access node may determine, according to information such as the bearer transfer record and the switchback indication, whether the target bearer is a transfer bearer, if the target If the bearer is not a transfer bearer, the combination of the DRB ID of the target bearer and the first access node key does not occur, and the key bearer does not occur in the target bearer. In this case, the first access node does not need to perform the key. If the target bearer is a transfer bearer, the key bearer may be duplicated. The first access node may perform key stream generation element update.

In a second possible implementation manner, after determining that the target bearer is a transfer bearer, the first access node may further determine whether the target bearer has a PDCP COUNT reset during the second access node, If no, it indicates that the DCP COUNT of the target bearer does not overlap, and the key bearer does not repeat the key stream. In this case, the first access node does not need to perform key stream generation element update; if yes, the target bearer The PDCP COUNT may be duplicated, and the key bearer may be duplicated in the target bearer. At this time, the first access node may perform key stream generation element update.

[145] In the second possibility, after determining that the target bearer is a transfer bearer, the first access node may further enter Step determining whether the target bearer current PDCP COUNT value is greater than a PDCP COUNT value when transferring from the first access node to the second access node, and if yes, indicating that PDCP COUNT does not repeat, the target bearer does not The key stream is duplicated. If not, the PDCP COUNT of the target bearer may be duplicated, and the key bearer may be duplicated. The first access node may perform key stream generation element update.

[146] In this embodiment, the first access node acquires a trigger message from the second access node, where the trigger message is used to trigger an update of a key stream generation element; the first access node The key stream generation element update is performed according to the trigger message. With the embodiment, the first access node may perform key stream generation element update on the first access node when the second access node changes the bearer status that may cause the key stream to be duplicated, thereby avoiding the key. The flow of repetition occurs.

[147] The method for updating the key stream generation element of the present invention will be further described below.

[148] Referring to FIG. 4, it is a flowchart of another embodiment of a method for updating a key stream generation element according to the present invention.

[149] Step 401: Acquire a key stream generation element update trigger message from the second access node.

[150] Step 402: When obtaining the first information used to indicate the second access node key update, detecting whether there is a transfer bearer on the second access node.

[151] The first access node may determine whether the second access node exists according to the bearer transfer record and all current bearers on the second access node, or according to the presence indication carried by the first information. Transfer the bearer.

[152] The bearer transfer record may be a list or other data structure for describing a transfer bearer, where the transfer bearer refers to a bearer transferred from the first access node to the second access node. . The bearer transfer record records the DRB ID of the transfer bearer. Generating a bearer transfer record containing the DRB ID of the bearer or adding the DRB ID of the bearer to the bearer transfer record when a bearer is transferred from the first access node to the second, when the first access node generates a key flow When the element is updated, delete or empty the bearer transfer record.

[153] The presence indication is used to indicate that there is a transfer bearer on the second access node. When the transfer bearer exists on the second access node, the presence indication may be added to the generated first information, or the preset field in the first information may be set to a preset value. The first access node determines that there is a transfer bearer on the second access node according to whether the first information includes a presence indication, or whether the preset field is a preset value.

[154] Step 403: If there is a transfer bearer on the second access node, perform keystream generation element update on the first access node.

[155] The first access node may perform the key stream generation element update on the first access node. The key is updated or only the DRB ID is reassigned for the transfer bearer to reduce system overhead.

[156] In this embodiment, the key stream generation element update trigger message is obtained from the second access node; when the first information for indicating the second access node key update is acquired, detecting Whether there is a transfer bearer on the second access node; if there is a transfer bearer on the second access node, performing keystream generation element update on the first access node. With this embodiment, the key stream generation element update may be performed on the first access node when the second access node generates a key update, thereby avoiding the occurrence of the key stream repetition caused by the key update.

[157] Referring to FIG. 5, it is a flowchart of an embodiment of a method for updating a key stream generation element according to the present invention. [158] Step 501: Acquire a key stream generation element update trigger message from the second access node. [159] Step 502: When acquiring the second information used to indicate that the target bearer is transferred from the second access node to the first access node, detecting whether the target bearer is a transfer bearer.

The first access node may determine whether the target bearer is a transfer bearer according to the bearer transfer record or according to the switchback indication carried by the second information. If the target bearer is a transfer bearer, the target bearer may have a key stream repetition. If the target bearer is not a transfer bearer, the target bearer does not have a key stream repetition.

[161] The bearer transfer record may also be used to record whether the transfer bearer and the transfer bearer have undergone PDCP COUNT reset, and may also be used to record when the transfer bearer is transferred from the first access node to the second access node. PDCP COUNT. For example, the bearer transfer record may record the DRB ID of the transfer bearer and the reset flag bit. When a bearer is transferred from the first access node to the second, the bearer transfer record including the DRB ID of the bearer and the reset identifier bit is generated, or the DRB ID and the reset flag bit of the bearer are added to the bearer transfer record. When the PDCP COUNT of the bearer is reset, the value of the reset flag is set to a preset value, and when the key stream element is updated by the first access node, the bearer transfer record is deleted or emptied. The first access node determines, according to the bearer transfer record and the DRB ID of the target bearer, whether the target bearer is a transfer bearer.

[162] The switchback indication is used to indicate that the target bearer is a transfer bearer. When the second access node determines that there is a transfer bearer on the second access node, the switchback indication may be added to the generated second information, or the preset field in the first information may be set to a preset value. The first access node determines whether the target bearer is a transfer bearer according to whether the second information includes a switchback indication, or whether the preset field is a preset value.

[163] If the target bearer is a transfer bearer, the key stream generation element update may be directly performed on the first access node, or step 303 may be performed to perform further judgment. [164] Step 503: If the target bearer is a transfer bearer, detecting whether the target bearer PDCP COUNT has been reset.

[165] The first access node may determine that the target bearer PDCP COUNT by detecting whether the reset flag of the target bearer in the bearer transfer record is a predetermined value, or detecting whether the second information includes a reset indication. Has a reset occurred?

[166] Step 504: The target bearer has undergone a PDCP COUNT reset, and the first access node performs a key stream generation element update.

[167] Due to the reset of the PDCP COUNT of the target bearer, the PDCP COUNT of the target bearer may be duplicated, which may cause the key stream to be duplicated. Therefore, if the PDCP COUNT reset occurs in the target bearer, the key stream generation element update can be performed on the first access node.

[168] Since the target bearer PDCP COUNT does not necessarily have a key stream repetition even if a reset occurs, for example, the current PDCP COUNT value of the target bearer is greater than the transfer from the first access node to the The PDCP COUNT value of the second access node does not cause the key stream to be duplicated on the target bearer.

[169] Therefore, if the target bearer is a transfer bearer, it may not detect whether the target bearer PDCP COUNT has been reset, but acquire the current PDCP COUNT value of the target bearer, and the target bearer from the a PDCP COUNT value when the first access node transfers to the second access node; if the current PDCP COUNT value of the target bearer is less than or equal to the transfer from the first access node to the second access node The PDCP COUNT value is used to perform key stream generation element update on the first access node.

[170] In this embodiment, acquiring a keystream generation element update trigger message from the second access node; when acquiring, indicating that the target bearer is transferred from the second access node to the first interface When the second information of the ingress node is sent, detecting whether the target bearer is a transfer bearer; if the target bearer is a transfer bearer, detecting whether the target bearer PDCP COUNT has been reset; the target bearer has undergone PDCP COUNT reset And performing key stream generation element update on the first access node. With this embodiment, the key stream generation element update may be performed on the first access node when the target bearer is a transfer bearer and the PDCP COUNT reset occurs, so that the key flow caused by the bearer transfer can be avoided. Repeated occurrences can also reduce the number of key stream generation element updates and reduce system resource consumption.

The invention is further described below from the second access node side.

[172] FIG. 6 is a flowchart of another embodiment of a method for updating a key stream generation element according to the present invention.

[173] Step 601: The second access node generates a trigger message when the preset condition is met, where the trigger message is generated. And used to instruct the first access node to trigger an update of a key stream generation element.

[174] The preset condition may be that the second access node generates a key update, or may be the first access node that carries the transfer on the second access node, or may be the second access node. Other bearer state changes that may cause duplicate key streams. [175] In one possible implementation, the trigger message may be the first information.

The first information may be generated when the second access node performs a key update, or may be generated when the second access node performs a key update and a transfer bearer exists on the second access node. The first information may carry a presence indication, where the presence indication is used to indicate that a transfer bearer exists on the second access node.

In another possible implementation manner, the trigger message may be the second information. The first information may be generated when the target bearer is transferred from the second access node to the first access node. The second information may also carry a switchback indication if the target bearer is a transfer bearer. The second information may also carry a reset indication if the target bearer has undergone a PDCP COUNT reset.

[179] Whether the target bearer is a transfer bearer, and whether the target bearer has undergone PDCP COUNT reset can be judged according to the bearer transfer record. For the specific judgment process, refer to the foregoing embodiment, and details are not described herein again. [180] Step 602: Send a trigger message to the first access node.

[181] The first access node may perform the key stream generation element update immediately after receiving the trigger information, or may further determine whether the key stream is repeated according to the content of the trigger information and/or the trigger information. The key stream generation element update is performed when a key stream duplication may be sent. The specific process can participate in the foregoing embodiments, and will not be described again here. [182] In this embodiment, the second access node generates a trigger message when the preset condition is met, where the trigger message is used to indicate that the first access node triggers update of the key stream generation element. Sending a trigger message to the first access node. With this embodiment, the second access node may send a trigger message to the first access node to indicate that the first access node performs the key stream generation element update when a bearer state change that may cause the key stream to be duplicated occurs. , to avoid the occurrence of key stream duplication. As shown in FIG. 7, the embodiment of the present invention further provides a dual connectivity system, where the dual connectivity system includes: a first access node 701 and a second access node 702, the first interface The ingress node 701 and the second access node 702 simultaneously provide a wireless connection to the UE.

The second access node 702 is configured to generate a trigger message when the preset condition is met, where The trigger message is used to instruct the first access node 701 to trigger an update of the key stream generation element; and send a trigger message to the first access node 701.

The second access node 702 is further configured to: when the key is updated, generate first information; and send the first information to the first access node 701. The second access node 702 is further configured to generate the first information if the transfer bearer exists on the second access node 702 when the key update is performed.

The second access node 702 is further configured to: when the target bearer switches from the second access node 702 to the first access node 701, generate second information; to the first access The node 701 sends the second information.

The second access node 702 is further configured to: when the target bearer is switched from the second access node 702 to the first access node 701, if the target bearer is a transfer bearer, generate a bearer Returning the second information indicated.

The second access node 702 is further configured to: when the target bearer is switched from the second access node 702 to the first access node 701, if the target bearer is a transfer bearer, and The target bearer has undergone PDCP COUNT reset during the second access node 702, and generates second information carrying the switchback indication and the reset indication.

The first access node 701 is configured to acquire a trigger message from the second access node 702, and perform key stream generation element update according to the trigger message.

The first access node 701 is further configured to acquire a trigger message from the second access node 702, where the trigger message is used to trigger an update of a key stream generation element; and perform a key according to the trigger message. The stream generates element updates.

The first access node 701 is further configured to perform key flow on the first access node 701 when acquiring the first information used to indicate the key update of the second access node 702. Generate element updates.

The first access node 701 is further configured to perform a key stream generation element update on the first access node 701 if there is a transfer bearer on the second access node 702, where the transfer bearer is Refers to a bearer that is transferred from the first access node 701 to the second access node 702.

The first access node 701 is further configured to perform a key stream generation element update on the first access node 701 if the first information carries a presence indication, where the presence indication is used to indicate There is a transfer bearer on the second access node 702. The first access node 701 is further configured to acquire a bearer transfer record; if the second access node 702 is determined according to the bearer transfer record and all current bearers on the second access node 702, There is a transfer bearer, and the first access node 701 performs key stream generation element update.

The first access node 701 is further configured to delete the bearer transfer record after performing key stream generation element update on the first access node 701.

The first access node 701 may only update the key of the first access node 701 when performing key stream generation element update on the first access node 701.

[198] When the first access node 701 further performs key stream generation element update on the first access node 701, it may also re-allocate the DRB ID only for the transfer bearer.

In this embodiment, the second access node may send a trigger message to the first access node when the bearer state change that may cause the key stream to be duplicated, and the first access node receives the trigger message. After that, the key stream generation element is updated to avoid the occurrence of key stream repetition.

FIG. 8 is a schematic structural diagram of a key stream generation element updating apparatus of a dual connectivity system according to an embodiment of the present invention. As shown in FIG. 8, the device includes: a processor 801, a memory 802, and a communication interface 803, and modules are connected to each other.

The memory 802 is used to store programs. In particular, the program can include program code, the program code including computer operating instructions. The memory 802 may include a random access memory (RAM) memory, and may also include a non-volatile memory such as at least one disk memory.

The communication interface 803 is configured to acquire a trigger message from the second access node, where the trigger message is used to trigger an update of a key stream generation element.

The processor 801 is configured to execute the memory 802 storage program, and perform key stream generation element update according to the trigger message. The processor 801 is further configured to perform a key stream generation element update on the first access node when acquiring the first information used to indicate the second access node key update.

[206] The processor 801 is further configured to perform a key stream generation element update on the first access node if a transfer bearer exists on the second access node, where the transfer bearer refers to the Transferring the first access node to the The bearer of the second access node.

[207] The processor 801 is further configured to: if the first information carries a presence indication, perform a key stream generation element update on the first access node, where the presence indication is used to indicate the second There is a transfer bearer on the access node. [208] The processor 801 is further configured to acquire a bearer transfer record, and determine, if the transfer bearer exists on the second access node, according to the bearer transfer record and all current bearers on the second access node, Performing a key stream generation element update on the first access node.

The processor 801 is further configured to delete the bearer transfer record after performing key stream generation element update on the first access node.

The processor 801 is further configured to update a key of the first access node. The processor 801 is further configured to re-allocate the DRB ID for the transfer bearer.

[212] The processor 801 is further configured to, when acquiring the second information used to indicate that the target bearer is transferred from the second access node to the first access node, to the first access The node performs key stream generation element update.

[213] The processor 801 is further configured to: if the target bearer is determined to be a transfer bearer according to the switchback indication in the second information, perform keystream generation element update on the first access node, where The switchback indication is used to indicate that the target bearer is a transfer bearer.

The processor 801 is further configured to acquire a bearer transfer record, where the bearer transfer record is used to record a transfer bearer, and if the target bearer is determined to be a transfer bearer according to the bearer transfer record, the first connection is performed. The ingress node performs key stream generation element update.

The processor 801 is further configured to: if it is determined that the target bearer has a PDCP COUNT reset during the second access node according to the reset indication in the second information, to the first The access node performs key stream generation element update.

The processor 801 is further configured to: if it is determined that the target bearer has undergone a PDCP COUNT reset during the second access node according to the reset identifier in the bearer transfer record, to the first The access node performs key stream generation element update.

The processor 801 is further configured to acquire a current PDCP COUNT value of the target bearer, and a PDCP COUNT value when the target bearer is transferred from the first access node to the second access node. And if the current PDCP COUNT value carried by the target is less than or equal to the transfer from the first access node to the second connection The PDCP COUNT value at the time of the ingress, the key stream generation element update is performed on the first access node.

The processor 801 is further configured to update a key of the first access node or re-allocate a DRB ID for the target bearer.

FIG. 9 is a schematic structural diagram of a key stream generation element updating apparatus of a dual connectivity system according to an embodiment of the present invention.

As shown in FIG. 9, the device includes: a processor 901, a memory 902, and a communication interface 903, and the modules are connected to each other.

The memory 902 is used to store programs. In particular, the program can include program code, the program code including computer operating instructions. The memory 902 may include a random access memory (RAM) memory, and may also include a non-volatile memory such as at least one disk memory.

The processor 901 is configured to execute the memory 802 storage program, and when the preset condition is met, generate a trigger message, where the trigger message is used to instruct the first access node to trigger a key stream generation element. Update

The processor 901 is further configured to generate first information when the second access node performs a key update. The processor 901 is further configured to: when the second access node performs a key update, if the transfer bearer exists on the second access node, generating the first information.

The processor 901 is further configured to generate second information when the target bearer switches from the second access node to the first access node.

The processor 901 is further configured to: when the target bearer is handed over from the second access node to the first access node, if the target bearer is a transfer bearer, generate a bearer indication The second information is described.

The processor 901 is further configured to: when the target bearer is handed over from the second access node to the first access node, if the target bearer is a transfer bearer, and the target bearer is in the A PDCP COUNT reset occurs during the second access node, and generates second information carrying the switchback indication and the reset indication.

The communication interface 903 is configured to acquire a trigger message from the second access node, where the trigger message is used to trigger an update of a key stream generation element. The trigger message may be the first message or the second message.

In a specific implementation, the present invention further provides a computer storage medium, wherein the computer storage medium may store a program, and the program may include some or all of the steps in each embodiment of the calling method provided by the present invention. . The storage medium may be a magnetic disk, an optical disk, or a read-only memory (ROM). Or random access memory (RAM), etc.

It will be apparent to those skilled in the art that the techniques in the embodiments of the present invention can be implemented by means of software plus the necessary general hardware platform. Based on such understanding, the technical solution in the embodiments of the present invention may be embodied in the form of a software product in essence or in the form of a software product, which may be stored in a storage medium such as a ROM/RAM. , a disk, an optical disk, etc., including instructions for causing a computer device (which may be a personal computer, server, or network device, etc.) to perform the methods described in various embodiments of the present invention or portions of the embodiments.

The various embodiments in the present specification are described in a progressive manner, and the same or similar parts of the various embodiments may be referred to each other, and each embodiment focuses on differences from other embodiments. In particular, for the device, the server, and the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the description of the method embodiment.

The embodiments of the invention described above are not intended to limit the scope of the invention. Any modifications, equivalent substitutions and improvements made within the spirit and scope of the invention are intended to be included within the scope of the invention.

Claims

Rights request

A key stream generation element updating apparatus of a dual connectivity system, in which the first access node and the second access node simultaneously provide a wireless connection for a user equipment UE, wherein Includes:

a receiving unit, configured to acquire a trigger message from the second access node, where the trigger message is used to trigger an update of a key stream generating element;

And a processing unit, configured to perform key stream generation element update according to the trigger message.

2. Apparatus according to claim 1 wherein:

The processing unit, configured to perform a key stream generation element update according to the trigger message, to be used to: when acquiring the first information used to indicate the second access node key update, An access node performs key stream generation element update.

3. Apparatus according to claim 2 wherein:

The processing unit is configured to perform a key stream generation element update on the first access node when acquiring the first information used to indicate the second access node key update, including: When the first information indicating the second access node key update is obtained, if there is a transfer bearer on the second access node, performing key stream generation element update on the first access node, The transfer bearer refers to a bearer that is transferred from the first access node to the second access node.

4. Apparatus according to claim 2 wherein:

The processing unit is configured to perform a key stream generation element update on the first access node when acquiring the first information used to indicate the second access node key update, including: When the first information indicating the second access node key update is obtained, if the first information carries a presence indication, performing key stream generation element update on the first access node, where A presence indication is used to indicate the presence of a transfer bearer on the second access node.

5. Apparatus according to claim 2 wherein:

The processing unit is configured to perform a key stream generation element update on the first access node when acquiring the first information used to indicate the second access node key update, including: Carrying a transfer record, the bearer transfer record is used to record a transfer bearer, and the transfer bearer refers to the first access Transferring the node to the bearer of the second access node; if it is determined that there is a transfer bearer on the second access node according to the bearer transfer record and all current bearers on the second access node, An access node performs key stream generation element update.

6. Apparatus according to claim 5 wherein:

The processing unit is configured to acquire a bearer transfer record, and determine, if the transfer bearer exists on the second access node, according to the bearer transfer record and all current bearers on the second access node, to the first The access node performs the key stream generation element update, and further includes: deleting the bearer transfer record after performing the key stream generation element update on the first access node.

7. Apparatus according to any one of claims 1 to 6 wherein:

The processing unit, configured to perform a key stream generation element update on the first access node, includes: configured to update a key of the first access node.

8. Apparatus according to claim 5 or claim 6 wherein:

The processing unit, configured to perform a key stream generation element update on the first access node, includes: configured to re-allocate a DRB ID for the transfer bearer.

9. Apparatus according to claim 1 wherein:

The processing unit, configured to perform a key stream generation element update according to the trigger message, to: when used to indicate that a target bearer is transferred from the second access node to the first access node In the second information, the key stream generation element update is performed on the first access node.

10. Apparatus according to claim 9 wherein:

The processing unit is configured to perform key flow on the first access node when acquiring second information indicating that the target bearer is transferred from the second access node to the first access node Generating an element update, comprising: when acquiring, according to the second information in the second information, the second information in the second information is used to indicate that the target bearer is transferred from the second access node to the first access node And indicating that the target bearer is a transfer bearer, and performing a key stream generation element update on the first access node, where the switchback indication is used to indicate that the target bearer is a transfer bearer.

11. Apparatus according to claim 9 wherein: The processing unit is configured to perform key flow on the first access node when acquiring second information indicating that the target bearer is transferred from the second access node to the first access node Generating an element update includes: acquiring a bearer transfer record; and if the target bearer is determined to be a transfer bearer according to the bearer transfer record, performing key stream generation element update on the first access node.

12. Apparatus according to claim 10 or claim 11 wherein:

The processing unit, configured to perform a key stream generation element update on the first access node, includes: determining, if the target bearer is in the second connection, according to a reset indication in the second information A PDCP COUNT reset occurs during the ingress, and a key stream generation element update is performed on the first access node.

13. Apparatus according to claim 10 or claim 11 wherein:

The processing unit, configured to perform the key stream generation element update on the first access node, includes: determining, if the target bearer is in the second connection, according to the reset identifier in the bearer transfer record A PDCP COUNT reset occurs during the ingress, and a key stream generation element update is performed on the first access node.

14. Apparatus according to claim 10 or claim 11 wherein:

The processing unit, configured to perform a key stream generation element update on the first access node, includes: acquiring a current PDCP COUNT value of the target bearer, and transferring the target bearer from the first access node a PDCP COUNT value to the second access node; if the current PDCP COUNT value of the target bearer is less than or equal to a PDCP COUNT value when the first access node is transferred to the second access node, The first access node performs key stream generation element update.

15. Apparatus according to any of claims 9 to 14, wherein:

The processing unit, configured to perform a key stream generation element update on the first access node, includes: updating a key of the first access node or re-allocating a DRB ID for the target bearer.

A key stream generation element updating apparatus of a dual connectivity system, wherein the first access node and the second access node provide a wireless connection to a UE in the dual connectivity system, and the method includes: a processing unit, configured to generate a trigger message when the preset condition is met, where the trigger message is used to instruct the first access node to trigger an update of a key stream generation element; And a sending unit, configured to send a trigger message to the first access node.

17. Apparatus according to claim 16 wherein:

The processing unit is configured to generate a trigger message when the preset condition is met, and the method is configured to: when the second access node performs a key update, generate the first information;

The sending unit, configured to send the trigger message to the first access node, includes: sending, by the first access node, the first information.

18. Apparatus according to claim 17 wherein:

The processing unit, configured to: when the second access node performs a key update, generate the first information, where: the method is: when the second access node performs a key update, if the second connection A transfer bearer exists on the ingress node to generate the first information.

19. Apparatus according to claim 16 wherein:

The processing unit, configured to generate a trigger message when the preset condition is met, includes: configured to generate second information when the target bearer is handed over from the second access node to the first access node;

The sending unit, configured to send the trigger message to the first access node, includes: sending the second information to the first access node.

20. Apparatus according to claim 19, wherein:

The processing unit, configured to: when the target bearer is handed over from the second access node to the first access node, generate second information, including: used to switch when the target bearer is switched from the second access node When the first access node is sent to the first access node, if the target bearer is a transfer bearer, the second information carrying the switchback indication is generated.

21. Apparatus according to claim 19, wherein

The processing unit, configured to: when the target bearer is handed over from the second access node to the first access node, generate second information, including: used to switch when the target bearer is switched from the second access node And when the target bearer is a transfer bearer, and the target bearer has a PDCP COUNT reset during the second access node, generating a carry-back indication and a reset indication Second message.

22. A method for updating a key stream generation element of a dual connectivity system, said method in said dual connectivity system An access node and the second access node provide a wireless connection for the UE at the same time, the method includes: the first access node acquiring a trigger message from the second access node, where the trigger message is used Triggering an update of the keystream generation element;

The first access node performs key stream generation element update according to the trigger message.

The method according to claim 22, wherein the performing, by the first access node, the key stream generation element update to the first access node according to the triggering message comprises:

When the first information indicating the second access node key update is obtained, the key stream generation element update is performed on the first access node.

The method according to claim 23, wherein the performing the key stream generation element update on the first access node comprises:

If there is a transfer bearer on the second access node, the key stream generation element update is performed on the first access node.

And if the first information carries a presence indication, performing keystream generation element update on the first access node.

Obtain a bearer transfer record;

And determining, according to the bearer transfer record and all current bearers on the second access node, that there is a transfer bearer on the second access node, and performing key stream generation element update on the first access node.

The method according to claim 26, further comprising: after performing the keystream generation element update on the first access node, further comprising:

Delete the bearer transfer record.

The method according to any one of claims 22 to 27, wherein the performing the key stream generation element update on the first access node comprises: Updating the key of the first access node.

The method according to any one of claims 24 to 27, wherein the performing the key stream generation element update on the first access node comprises:

Reassign the DRB ID for the transfer bearer.

When the second information indicating that the target bearer is transferred from the second access node to the first access node is obtained, the key flow generation element update is performed on the first access node.

The method according to claim 30, wherein the performing the key stream generation element update on the first access node comprises:

And if the target bearer is determined to be a transfer bearer according to the switchback indication in the second information, performing keystream generation element update on the first access node.

Obtaining a bearer transfer record, where the bearer transfer record is used to record a transfer bearer;

And if the target bearer is determined to be a transfer bearer according to the bearer transfer record, performing keystream generation element update on the first access node.

The method according to claim 31 or 32, wherein the performing the key stream generation element update on the first access node comprises:

If it is determined according to the reset indication in the second information that the target bearer has undergone a PDCP COUNT reset during the second access node, the key flow generation element is updated to the first access node.

If it is determined that the target bearer has undergone PDCP COUNT reset during the second access node according to the reset identifier in the bearer transfer record, performing keystream generation on the first access node Updated.

Obtaining a current PDCP COUNT value carried by the target, and a PDCP COUNT value when the target bearer is transferred from the first access node to the second access node;

And if the current PDCP COUNT value of the target bearer is less than or equal to a PDCP COUNT value when the first access node is transferred to the second access node, performing key stream generation element update on the first access node. .

The method according to any one of claims 30 to 35, wherein the performing the key stream generation element update on the first access node comprises:

Updating a key of the first access node or reallocating a DRB ID for the target bearer.

37. A method for updating a key stream generation element of a dual connectivity system, wherein the first access node and the second access node provide a wireless connection for the UE in the dual connectivity system, and the method includes: And generating, by the second access node, a trigger message, where the triggering message is used to instruct the first access node to trigger an update of a key stream generating element;

Sending a trigger message to the first access node.

38. The method of claim 37, wherein

The generating trigger message includes:

Generating first information when the second access node performs key update;

The sending the trigger message to the first access node includes:

Sending the first information to the first access node.

The method of claim 38, wherein the generating the first information comprises: generating a first information if a transfer bearer exists on the second access node.

40. The method of claim 37, wherein

The generating trigger message includes:

Generating a second letter when the target bearer switches from the second access node to the first access node Interest rate

The sending the trigger message to the first access node includes:

Sending the second information to the first access node.

The method of claim 40, wherein the generating the second information comprises: generating the second information carrying the switchback indication if the target bearer is a transfer bearer.

The method of claim 40, wherein the generating the second information comprises: if the target bearer is a transfer bearer, and the target bearer has a PDCP COUNT during the second access node Reset, generating a second message carrying a switchback indication and a reset indication.

43. A dual connectivity system, wherein the first access node and the second access node provide a wireless connection to the UE in the dual connectivity system, and the method includes:

The second access node is configured to generate a trigger message when the preset condition is met, where the trigger message is used to instruct the first access node to trigger an update of a key stream generation element; The ingress node sends a trigger message;

The first access node is configured to acquire a trigger message from the second access node, and perform key stream generation element update according to the trigger message.