WO2016074444A1 - 一种密钥更新方法、装置和主传输节点tp - Google Patents

一种密钥更新方法、装置和主传输节点tp Download PDF

Info

Publication number
WO2016074444A1
WO2016074444A1 PCT/CN2015/077540 CN2015077540W WO2016074444A1 WO 2016074444 A1 WO2016074444 A1 WO 2016074444A1 CN 2015077540 W CN2015077540 W CN 2015077540W WO 2016074444 A1 WO2016074444 A1 WO 2016074444A1
Authority
WO
WIPO (PCT)
Prior art keywords
key
virtual cell
node
generating
data encryption
Prior art date
Application number
PCT/CN2015/077540
Other languages
English (en)
French (fr)
Inventor
陈林
张芳
阮玉峰
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Priority to US15/526,805 priority Critical patent/US10567172B2/en
Publication of WO2016074444A1 publication Critical patent/WO2016074444A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0891—Revocation or update of secret information, e.g. encryption key update or rekeying
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/03—Protecting confidentiality, e.g. by encryption
    • H04W12/033—Protecting confidentiality, e.g. by encryption of the user plane, e.g. user's traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/03—Protecting confidentiality, e.g. by encryption
    • H04W12/037—Protecting confidentiality, e.g. by encryption of the control plane, e.g. signalling traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/041—Key generation or derivation

Definitions

  • the present invention relates to the field of mobile communications, and in particular to a key update method, apparatus, and primary transport node (TP).
  • TP primary transport node
  • Ultra-Dense Networks is an important means to achieve the first two indicators of 5G.
  • the key technology of UDN networking is to enable a large number of nodes to be effectively in a homogeneous or heterogeneous manner in a dense manner. coexist.
  • a virtual cell solution is proposed in the 5G research; the virtual cell construction manner is mainly divided into centralized and distributed.
  • the services of the UE may be carried on different transit nodes in the virtual cell at different times.
  • Different data packets of the same bearer are transmitted on different transport nodes in the virtual cell, and the data packets need to be encrypted in the air interface.
  • the encryption complexity of the UE is high.
  • the UE is avoided.
  • multiple sets of key security contexts are maintained, and the keys used by different transport nodes in the virtual cell need to be unified. Therefore, in the ultra-dense networking scenario, how to solve the problem of updating the key of different transit nodes in the virtual cell needs to be solved.
  • the present invention provides a key update method and apparatus, and a primary transport node (TP), to at least solve the problem of how to solve the update of different transport node keys in a virtual cell in the ultra-dense networking scenario in the prior art.
  • TP primary transport node
  • a key update method includes: receiving a key parameter for generating a data encryption key of a transit node in a virtual cell; and according to the key parameter and the virtual cell The cell identity ID generates a data encryption key of the transport node in the virtual cell.
  • generating the data encryption key of the transit node in the virtual cell according to the key parameter and the cell identifier ID of the virtual cell comprises: selecting a predetermined encryption algorithm; and according to the key parameter and the virtual cell Generating a first key of a primary transport node (TP) in the virtual cell; transmitting the predetermined encryption algorithm and the first key to a secondary transmitting node; wherein the predetermined encryption algorithm and The first key is used to generate a data encryption key of the primary transmission node and the secondary transmission node.
  • TP primary transport node
  • the method further includes: receiving a key update from the slave transport node (TP) Completing a signal; transmitting a Radio Resource Control Protocol (RRC) connection reconfiguration message to the user equipment (UE), where the RRC connection reconfiguration message carries information for generating a data encryption key of the transmission node in the virtual cell .
  • TP slave transport node
  • RRC Radio Resource Control Protocol
  • the key parameter for generating a key for transmitting a node in the virtual cell is received at least one of the following triggering conditions: receiving an update signal from the core network, where the update signal carries The key parameter; receiving a reuse signal of a data radio bearer identifier (DRB-ID) from the core network; receiving a packet data convergence protocol sequence number (PDCPSN) flip signal from a slave node (TP).
  • DRB-ID data radio bearer identifier
  • PDCPSN packet data convergence protocol sequence number
  • any of the above methods further comprises: performing data transmission according to the data encryption key.
  • a key update apparatus including: a first receiving module, configured to receive a key parameter for generating a data encryption key of a transit node in a virtual cell; and a generating module, And configured to generate a data encryption key of the transit node in the virtual cell according to the key parameter and a cell identifier ID of the virtual cell.
  • the generating module includes: a selecting unit configured to select a predetermined encryption algorithm; and a generating unit configured to generate a primary transit node (TP) in the virtual cell according to the key parameter and a cell identifier ID of the virtual cell And a transmitting unit configured to transmit the predetermined encryption algorithm and the first key to the slave transmission node; wherein the predetermined encryption algorithm and the first key are used to generate a data encryption key of the primary transport node and the secondary transport node.
  • TP primary transit node
  • the apparatus further comprises: a second receiving module configured to receive a key update completion signal from the secondary transmitting node (TP); and a transmitting module configured to send a radio resource control protocol to the user equipment (UE) ( The RRC) connection reconfiguration message, wherein the RRC connection reconfiguration message carries information for generating a data encryption key of the transmission node in the virtual cell.
  • TP secondary transmitting node
  • UE user equipment
  • the first receiving module is further configured to receive, by using at least one of the following triggering conditions, the key parameter set to generate a key of a transit node in the virtual cell: receiving the core network More a new signal, wherein the update signal carries the key parameter; receives a reuse signal of a data radio bearer identifier (DRB-ID) from the core network; and receives packet data from a transit node (TP) The convergence protocol sequence number (PDCPSN) flips the signal.
  • DRB-ID data radio bearer identifier
  • TP transit node
  • PDCPSN convergence protocol sequence number
  • any of the foregoing apparatus further includes: a data transmission module configured to perform data transmission according to the data encryption key.
  • a primary transport node comprising any of the above preferred devices.
  • a data encryption key parameter for receiving a key for generating a transmission node in a virtual cell is adopted; and a transmission node of the virtual cell is generated according to the key parameter and a cell identifier ID of the virtual cell.
  • the data encryption key solves the problem of how to solve the key update of different transmission nodes in the virtual cell in the ultra-dense networking scenario, thereby achieving the effect of key unification.
  • FIG. 1 is a flow chart of a method for updating a key according to an embodiment of the present invention
  • FIG. 2 is a structural block diagram of a key update apparatus according to an embodiment of the present invention.
  • FIG. 3 is a block diagram 1 of a preferred structure of a key updating apparatus according to a preferred embodiment of the present invention.
  • FIG. 4 is a block diagram 2 showing a preferred structure of a key updating apparatus according to a preferred embodiment of the present invention
  • FIG. 5 is a block diagram 3 of a preferred structure of a key updating apparatus according to a preferred embodiment of the present invention.
  • TP primary transport node
  • FIG. 7 is a schematic structural diagram of a distributed virtual cell networking used in an embodiment of the present invention.
  • FIG. 8 is a schematic structural diagram of a centralized virtual cell networking used in an embodiment of the present invention.
  • FIG. 9 is a flowchart of a key update method according to a preferred embodiment 1 of the present invention.
  • FIG. 10 is a flowchart of a key update method according to a preferred embodiment 2 of the present invention.
  • FIG. 11 is a flowchart of a key update method according to a preferred embodiment 3 of the present invention.
  • Figure 12 is a flowchart of a key update method in accordance with a preferred embodiment 4 of the present invention.
  • FIG. 1 is a flowchart of a key update method according to an embodiment of the present invention. As shown in FIG. 1, the process includes the following steps:
  • Step S102 Receive a data encryption key parameter for generating a key of a transit node in the virtual cell.
  • Step S104 Generate a data encryption key of the transit node in the virtual cell according to the key parameter and the cell identifier ID of the virtual cell.
  • the data encryption key of the transmission node in the virtual cell is generated according to the key parameter and the cell identifier ID of the virtual cell, thereby solving the problem of updating the key of different transmission nodes in the virtual cell, and reducing the problem.
  • generating a key of the transit node in the virtual cell according to the key parameter and the cell identifier ID of the cell comprises: selecting a predetermined encryption algorithm; and generating a primary transport node (TP) in the virtual cell according to the key parameter and the cell identifier ID of the virtual cell. a first key; transmitting a predetermined encryption algorithm and a first key to the slave transmission node; wherein the predetermined encryption algorithm and the first key are used to generate a primary transport node and a data encryption key from the transport node by placing the virtual
  • the cell ID serves as a parameter for generating the transmission node key, ensuring the timeliness of the transmission node key update.
  • the first key of the primary transport node (TP) and a predetermined encryption algorithm are sent to the secondary transport node.
  • the encryption algorithm ID is selected by the primary controller/primary transport node (CC/Master TP) to reduce the signaling interaction overhead caused by the selection of the encryption algorithm from the transport node (Slave TP).
  • the method further includes: receiving a key update completion signal from the transit node (TP); and transmitting the signal to the user equipment (
  • the UE transmits a Radio Resource Control Protocol (RRC) connection reconfiguration message, where the RRC connection reconfiguration message carries information for generating a data encryption key of the transmission node in the virtual cell.
  • RRC Radio Resource Control Protocol
  • the update of the key informs the UE through the RRC connection reconfiguration message, and does not need to perform signaling interaction with the core network; and the service interruption delay is greatly shortened compared with the counter (Small Cell Counter) release/addition process.
  • the key parameter for generating a data encryption key of the transit node in the virtual cell is received when at least one of the following trigger conditions is met: receiving an update signal from the core network, where the update signal is carried There is a key parameter; a reuse signal for receiving a data radio bearer identifier (DRB-ID) from the core network; and a packet data convergence protocol sequence number (PDCPSN) flip signal from the slave node (TP) is received.
  • DRB-ID data radio bearer identifier
  • PDCPSN packet data convergence protocol sequence number
  • the UE Because the keys of the CC/Master TP and each of the slave TPs in the virtual cell are unified, the UE only needs to maintain one key for each radio bearer, which reduces the complexity of the UE-side adding/reducing process.
  • any of the above methods further comprises: performing data transmission according to the data encryption key.
  • the unified data encryption key when the data is transmitted, when the primary transmission node and the secondary transmission node transmit, the same first key and a predetermined encryption algorithm are used to generate a unified data encryption key through the key generation function. , achieved the effect of unified data encryption key.
  • module may implement a combination of software and/or hardware of a predetermined function.
  • apparatus described in the following embodiments is preferably implemented in software, hardware, or a combination of software and hardware, is also possible and contemplated.
  • FIG. 2 is a structural block diagram of a key updating apparatus according to an embodiment of the present invention. As shown in FIG. 2, the apparatus includes: a first receiving module 22 and a generating module 24, which will be described below.
  • the first receiving module 22 is configured to receive a key parameter for generating a data encryption key of the transit node in the virtual cell
  • the generating module 24 is connected to the first receiving module 22, and configured to be based on the key parameter and the virtual cell.
  • the cell identification ID generates a data encryption key of the transmission node in the virtual cell.
  • the first receiving module 22 receives a key parameter for generating a data encryption key of the transmitting node in the virtual cell, and the generating module 24 generates a transit node in the virtual cell according to the key parameter and the cell identifier ID of the virtual cell.
  • the key parameter of the data encryption key solves the problem of updating the key of different transmission nodes in the virtual cell, and reduces the complexity of implementing the process of adding/reducing the UE end.
  • FIG. 3 is a block diagram showing a preferred structure of the generating module 24 in the key updating apparatus according to the embodiment of the present invention.
  • the generating module 24 includes: a selecting unit 32, a generating unit 34, and a transmitting unit 36. The generation module 24 is described.
  • the selecting unit 32 is configured to select a predetermined encryption algorithm; the generating unit 34 is connected to the selecting unit 32, and is configured to generate a data encryption key of the primary transit node (TP) in the virtual cell according to the key parameter and the cell identifier ID of the virtual cell.
  • a transmitting unit 36 connected to the above selecting unit 32, configured to transmit a predetermined encryption algorithm and a first key to the slave transmission node; wherein the predetermined encryption algorithm and the first key are used to generate a data encryption key of the primary transmission node and the secondary transmission node, by using the virtual cell ID as a parameter for generating a transmission node key, It ensures the timeliness of the transmission node key update.
  • the first key of the primary transport node (TP) and the predetermined encryption algorithm are sent to the secondary transmitting node, and the encryption algorithm ID is selected by the CC/Master TP, which can reduce the signaling interaction overhead caused by the Slave TP selecting the encryption algorithm.
  • FIG. 4 is a block diagram of a preferred structure of a key updating apparatus according to an embodiment of the present invention. As shown in FIG. 4, the apparatus includes a second receiving module 42 and a transmitting module 44, in addition to all the modules shown in FIG. The device will be described.
  • the second receiving module 42 is connected to the generating module 24, and is configured to receive a key update completion signal from the slave transmitting node (TP); the sending module 44 is connected to the second receiving module 42 and configured to be to the user equipment (UE). And transmitting a Radio Resource Control Protocol (RRC) connection reconfiguration message, where the RRC connection reconfiguration message carries information for generating a data encryption key of the transmission node in the virtual cell.
  • RRC Radio Resource Control Protocol
  • the update of the key informs the UE through the RRC connection reconfiguration message, and does not need to perform signaling interaction with the core network; and the service interruption delay is greatly shortened compared with the micro cell counter SCC (Small Cell Counter) release/add process.
  • SCC Small Cell Counter
  • the first receiving module 22 is further configured to receive a key parameter for generating a data encryption key of the transit node in the virtual cell when at least one of the following trigger modes is met: receiving the core network Updating a signal, wherein the update signal carries a key parameter; receiving a reuse signal of a data radio bearer identifier (DRB-ID) from the core network; receiving a packet data convergence protocol sequence number (PDCPSN) from the transit node (TP) ) Flip the signal.
  • DRB-ID data radio bearer identifier
  • PDCPSN packet data convergence protocol sequence number
  • FIG. 5 is a block diagram showing a preferred structure of a key updating apparatus according to an embodiment of the present invention. As shown in FIG. 5, the apparatus includes a data transmission module 52 in addition to all the modules shown in FIG. Description.
  • the data transmission module 52 is configured to perform data transmission according to the data encryption key.
  • the unified data encryption key when the data is transmitted, when the primary transmission node and the secondary transmission node transmit, the same first key and a predetermined encryption algorithm are used to generate a unified data encryption key through the key generation function. , achieved the effect of unified data encryption key.
  • the UE Because the keys of the CC/Master TP and each of the slave TPs in the virtual cell are unified, the UE only needs to maintain one key for each radio bearer, which reduces the complexity of the UE-side adding/reducing process.
  • FIG. 6 is a structural block diagram of a primary transport node (TP) according to an embodiment of the present invention. As shown in FIG. 6, the primary transport node (TP) 60 includes the key update device 62 described in any of the above.
  • a method for generating and transmitting a virtual cell key is provided.
  • the method is briefly described below, and the method includes the following steps:
  • the CC/Master TP passes the key generation function (Key Derivation Function) according to the latest KeNB, the current value of the SCC, and the virtual cell ID (Identity). KDF) generating a new transport node key TP-KeNB;
  • the CC/Master TP If the Secure Key Update Request message of the Slave TP is received, the CC/Master TP generates a new transport node key TP-KeNB through the key generation function KDF according to the current value of the KeNB, the SCC+1 and the virtual cell ID. ;
  • the CC/Master TP notifies all the slave TP update keys TP-KeNB through the security key update command message, and the message also includes the selected encryption algorithm ID; the slave TP passes the secret according to the latest TP-KeNB and the selected security algorithm.
  • the key generation function KDF generates a new encryption key K UPenc (same as the above-mentioned slave transfer node key);
  • the CC/Master TP After receiving the security key command confirmation message of all the slave TPs, the CC/Master TP notifies the UE to update the key through the RRC connection reconfiguration information; the RRC connection reconfiguration message includes the current value of the SCC, the selected security algorithm, and the virtual Cell ID;
  • the UE first calculates the TP-KeNB according to the KeNB latest value, the SCC current value, and the virtual cell ID acquired from the core; secondly, generates a new encryption key by using the key generation function KDF according to the new TP-KeNB and the selected security algorithm.
  • Key K UPenc Key K UPenc ;
  • the UE notifies the CC/Master TP key update process by the RRC connection reconfiguration message
  • the CC/Master TP notifies all the slave TP security key update procedures through the security key update confirmation message.
  • one transport node key TP-KeNB is separately generated; and for the same transport node key and the same DRB-ID, the PDCP sequence number cannot be repeated.
  • the input parameter includes the virtual cell ID in addition to the current value of the key KeNB and the micro cell counter SCC obtained from the core network; The timely update of the key provides a guarantee.
  • the encryption algorithm ID that generates the encryption key is uniformly selected by the CC/Master TP, which can reduce the signaling interaction overhead caused by the Slave TP selection encryption algorithm.
  • the transport node keys of all the slave TPs can be updated at the same time to ensure that all the transport node keys used by the slave TP and the UE are consistent.
  • the RRC connection reconfiguration process is used to update the transit node key, and there is no signaling interaction with the core network. Compared with the release/add process of the Small Cell, the service interruption time is greatly shortened, and the user experience can be improved.
  • the timeliness of the transmission node key update is ensured by using the virtual cell ID as a parameter for generating a transmission node key.
  • the encryption algorithm ID is selected by the CC/Master TP to reduce the signaling interaction overhead caused by the Slave TP selective encryption algorithm.
  • the update of the key informs the UE through the RRC connection reconfiguration message, and does not need to perform signaling interaction with the core network; and the service interruption delay is greatly shortened compared with the Small Cell release/addition process. Because the keys of the CC/Master TP and each of the slave TPs in the virtual cell are unified, the UE only needs to maintain one key for each radio bearer, which reduces the complexity of the UE-side adding/reducing process.
  • TP1 is the master station TP of the virtual cell
  • Slave TP is the service station Slave TP of the virtual cell.
  • the Master TP is a high-level control anchor. It generates all high-level control signaling, performs all scheduling and radio resource allocation, manages the update of the Slave TP key, and resolves conflicts in the resource allocation process.
  • the role of the Slave TP is based on the Master.
  • the indication of the TP is for cooperative transmission of data.
  • the transmission node and the core network are connected by a backhaul interface of the wired backhaul line, and the cooperation between the TP and the TP is implemented by the wireless forward path (Fronthaul) interactive control signaling.
  • Information such as a User Identifier, an Authentication/Authorization Key, an L2 Connection Identifier, and a required service context are shared between the base stations in the virtual cell.
  • the Master TP is responsible for the user's control plane and user plane data processing.
  • the Slave TP is only responsible for the user's data plane processing.
  • FIG. 8 is a schematic diagram of a centralized virtual cell networking structure according to a preferred embodiment of the present invention.
  • the centralized virtual cell of the centralized virtual cell has a central controller, which is a logical node, and has a macro. When the station exists, it can usually be placed in the macro station.
  • the central controller is responsible for controlling the processing of the surface data, and the Slave TP is negative.
  • each Slave TP and the central controller are connected by a Backhaul link.
  • the central controller is responsible for the scheduling and allocation of each Slave TP resource, and the update of the security key.
  • FIG. 9 is a flowchart of a method for updating a key according to a preferred embodiment 1 of the present invention.
  • a frame diagram of a virtual cell transmission node key TP-KeNB and an encryption key K UPenc is shown in FIG. 9.
  • the Master TP/CC generates a transmission node key TP-KeNB by inputting a key generation function KDF based on the key KeNB, the SCC counter current value and the virtual cell number VC-ID acquired from the core network.
  • the Master TP/CC After the calculation is completed, the Master TP/CC notifies each of the Slave TPs of the transmission node key TP-KeNB and the selected encryption algorithm, and the Slave TP calculates the encryption key K UPenc according to the TP-KeNB and the encryption algorithm. After the above process ends, the Master TP/CC notifies the UE of the SCC counter current value, the encryption algorithm, and the virtual cell number VC-ID, for the UE to calculate the transport node key TP-KeNB and the encryption key K UPenc .
  • FIG. 10 is a flowchart of a key update method according to a preferred embodiment 2 of the present invention.
  • different radio bearer DRB-IDs are provided for the same UE, and Master TP/CC, Slave TP, and UE work respectively. process.
  • the figure shows the process of generating different encryption keys K UPenc for different DRB-IDs of the same UE.
  • FIG. 11 is a flowchart of a method for updating a key according to a preferred embodiment 3 of the present invention. As shown in FIG. 11, the method includes:
  • Step S1101 The Master TP/CC receives the core network KeNB update indication or the DRB-ID needs to be reused, triggering the security key update process;
  • Step S1102 The Master TP/CC generates a new transport node key TP-KeNB according to the new KeNB value, the current value after the SCC counter is incremented by 1, and the virtual cell ID, and the Master TP/CC selects a new one.
  • Encryption Algorithm
  • Steps S1103-S1105 The Master TP/CC sends a key update command to the Slave TP1, the Slave TP2, the ...Slave TPn, respectively; the key update command includes the newly generated transport node key TP-KeNB and the selected encryption algorithm;
  • Steps S1106-S1108 Slave TP1, Slave TP2, ... Slave TPn generate a new encryption key K UPenc according to the received new transmission node key and encryption algorithm, input key generation function KDF;
  • Steps S1109-S1111 Slave TP1, Slave TP2, ... Slave TPn send a security key update confirmation message to the Master TP after calculating the encryption key;
  • Step S1112 After receiving the security key update confirmation message of all the slave TPs, the master TP/CC sends an RRC connection reconfiguration message to the UE.
  • the message includes the current value of the SCC counter, the encryption algorithm, and the virtual cell ID.
  • Step S1113 The UE triggers the calculation of the transport node key TP-KeNB based on the received RRC connection reconfiguration message, and simultaneously calculates the encryption key K UPenc ; the process of calculating the transport node key is the same as the Master TP/CC, and the encryption key is calculated. The process is the same as the Slave TP;
  • Step S1114 The UE sends an RRC connection reconfiguration complete message to the Master TP/CC.
  • Step S1115 The Master TP/CC sends a Security Key Update Complete Confirmation message to each Slave TP to confirm that the key update process is completed.
  • FIG. 12 is a flowchart of a key update method according to a preferred embodiment 4 of the present invention; as shown in FIG. 12, the method includes:
  • Step S1201 The Slave TP1 PDCP sequence number is reversed, and the security key update process is triggered.
  • Step S1202 The Slave TP1 sends a key update request message to the Master TP/CC.
  • Step S1203 The Master TP/CC generates a new transport node key TP-KeNB by inputting a key generation function KDF according to the current value of the KeNB, the current value of the SCC counter plus 1 and the virtual cell ID; the Master TP/CC selects a new one.
  • Encryption Algorithm
  • Steps S1204-S1206 The Master TP/CC sends a key update command to the Slave TP1, the Slave TP2, the ...Slave TPn, respectively;
  • the key update command includes the newly generated transport node key TP-KeNB and an encryption algorithm;
  • Steps S1207-S1209 Slave TP1, Slave TP2, ... Slave TPn generate an encryption key K UPenc according to the received new transmission node key and encryption algorithm, input key generation function KDF;
  • Steps S1210-S1212 Slave TP1, Slave TP2, ... Slave TPn send a security key update confirmation message to the Master TP after calculating the encryption key;
  • Step S1213 After receiving the security key update confirmation message of all the slave TPs, the master TP/CC sends an RRC connection reconfiguration message to the UE; the message includes the current value of the SCC counter, the encryption algorithm, and the virtual cell ID.
  • Step S1214 The UE triggers the calculation of the transport node key TP-KeNB based on the received RRC connection reconfiguration message, and simultaneously calculates the encryption key K UPenc ; the process of calculating the transport node key is the same as the Master TP/CC, and the encryption key is calculated. The process is the same as the Slave TP;
  • Step S1215 The UE sends an RRC connection reconfiguration complete message to the Master TP/CC.
  • Step S1216 The Master TP/CC sends a Security Key Update Complete Confirmation message to each Slave TP to confirm that the key update process is completed.
  • modules or steps of the present invention described above can be implemented by a general-purpose computing device that can be centralized on a single computing device or distributed across a network of multiple computing devices. Alternatively, they may be implemented by program code executable by the computing device such that they may be stored in the storage device by the computing device and, in some cases, may be different from the order herein.
  • the steps shown or described are performed, or they are separately fabricated into individual integrated circuit modules, or a plurality of modules or steps thereof are fabricated as a single integrated circuit module.
  • the invention is not limited to any specific combination of hardware and software.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本发明公开了一种密钥更新方法、装置和主传输节点。所述方法包括：接收用于生成虚拟小区中传输节点的数据加密密钥的密钥参数(S102)；依据所述密钥参数和所述虚拟小区的小区标识生成所述虚拟小区中传输节点的数据加密密钥(S104)。通过应用本发明的密钥更新方法、装置和主传输节点，虚拟小区中不同传输节点密钥之更新的问题得以解决。

Description

一种密钥更新方法、装置和主传输节点TP 技术领域
本发明涉及移动通信领域，具体而言，涉及一种密钥更新方法、装置和主传输节点(TP)。
背景技术
随着移动通信技术的发展，实现第五代移动通信技术(5Generation，5G)的目标势在必行，在5G技术中，每区域1000倍的移动数据流量增长，每用户10到100倍的吞吐量增长，连接设备数10到100倍的增长，低功率设备10倍的电池寿命延长和端到端5倍延迟的下降，所以，5G中必须提出一些新的无线技术解决方案。其中，超密组网技术(Ultra-Dense Networks，UDN)是达成5G前两项指标的重要手段，UDN组网的关键技术是使得大量节点在密集范围内以同构或异构的方式有效地共存。为了解决超密组网场景下用户设备(UE)的频繁切换问题，现有技术中，5G研究中提出了虚拟小区的解决方案；虚拟小区的构建方式主要分为集中式和分布式两种。在虚拟小区工作模式下，UE的业务在不同时间可以承载在虚拟小区中的不同传输节点上。对同一个承载的不同数据包，分别在虚拟小区中的不同传输节点上传输，数据包在空口需要加密，但是，UE的加密复杂度较高，为了降低UE端实现的复杂度，避免UE端同时维护多套密钥安全上下文，虚拟小区中不同传输节点所使用的密钥需要统一。因此，在超密组网场景下，如何解决虚拟小区中不同传输节点密钥的更新问题亟待解决。
针对现有技术中在超密组网场景下如何解决虚拟小区中不同传输节点密钥的更新的问题，目前尚未提出有效的解决方案。
发明内容
本发明提供了一种密钥更新方法、装置和主传输节点(TP)，以至少解决现有技术在超密组网场景下如何解决虚拟小区中不同传输节点密钥的更新的问题。
根据本发明实施例的一个方面，提供了一种密钥更新方法，包括：接收用于生成虚拟小区中传输节点的数据加密密钥的密钥参数；依据所述密钥参数和所述虚拟小区的小区标识ID生成所述虚拟小区中传输节点的数据加密密钥。
优选地，依据所述密钥参数和所述虚拟小区的小区标识ID生成所述虚拟小区中传输节点的数据加密密钥包括：选择预定加密算法；依据所述密钥参数和所述虚拟小区的小区标识ID生成所述虚拟小区中主传输节点(TP)的第一密钥；发送所述预定的加密算法和所述第一密钥至从传输节点；其中，所述预定的加密算法和所述第一密钥用于生成所述主传输节点和所述从传输节点的数据加密密钥。
优选地，在依据所述密钥参数和所述虚拟小区的小区标识ID生成所述虚拟小区中传输节点的数据加密密钥之后还包括：接收来自所述从传输节点(TP)的密钥更新完成信号；向用户设备(UE)发送无线资源控制协议(RRC)连接重配消息，其中，所述RRC连接重配消息中携带有用于生成所述虚拟小区中传输节点的数据加密密钥的信息。
可选地，在满足以下触发条件至少之一，接收用于生成虚拟小区中传输节点的密钥的所述密钥参数：接收到来自核心网的更新信号，其中，所述更新信号中携带有所述密钥参数；接收到来自所述核心网的数据无线承载标识(DRB-ID)的重用信号；接收到来自从传输节点(TP)的分组数据汇聚协议序列号(PDCPSN)翻转信号。
优选地，上述任一项方法还包括：依据所述数据加密密钥进行数据传输。
根据本发明实施例的另一方面，提供了一种密钥更新装置，包括：第一接收模块，设置为接收用于生成虚拟小区中传输节点的数据加密密钥的密钥参数；生成模块，设置为依据所述密钥参数和所述虚拟小区的小区标识ID生成所述虚拟小区中传输节点的数据加密密钥。
优选地，所述生成模块包括：选择单元，设置为选择预定加密算法；生成单元，设置为依据所述密钥参数和所述虚拟小区的小区标识ID生成所述虚拟小区中主传输节点(TP)的第一密钥；和发送单元，设置为发送所述预定的加密算法和所述第一密钥至从传输节点；其中，所述预定的加密算法和所述第一密钥用于生成所述主传输节点和所述从传输节点的数据加密密钥。
优选地，所述装置还包括：第二接收模块，设置为接收来自所述从传输节点(TP)的密钥更新完成信号；发送模块，设置为向用户设备(UE)发送无线资源控制协议(RRC)连接重配消息，其中，所述RRC连接重配消息中携带有用于生成所述虚拟小区中传输节点的数据加密密钥的信息。
可选地，所述第一接收模块，还设置为在满足以下触发条件至少之一的情况下，接收设置为生成虚拟小区中传输节点的密钥的所述密钥参数：接收到来自核心网的更 新信号，其中，所述更新信号中携带有所述密钥参数；接收到来自所述核心网的数据无线承载标识(DRB-ID)的重用信号；接收到来自从传输节点(TP)的分组数据汇聚协议序列号(PDCPSN)翻转信号。
优选地，上述任一项装置还包括：数据传输模块，设置为依据所述数据加密密钥进行数据传输。
根据本发明实施例的又一方面，提供了一种主传输节点(TP)，包括上述任一项优选的装置。
通过本发明实施例，采用接收用于生成虚拟小区中传输节点的密钥的数据加密密钥参数；依据所述密钥参数和所述虚拟小区的小区标识ID生成所述虚拟小区中传输节点的数据加密密钥，解决了在超密组网场景下如何解决虚拟小区中不同传输节点密钥的更新的问题，进而达到了密钥统一的效果。
附图说明
此处所说明的附图用来提供对本发明的进一步理解，构成本申请的一部分，本发明的示意性实施例及其说明用于解释本发明，并不构成对本发明的不当限定。在附图中：
图1是根据本发明实施例的一种密钥更新方法的流程图；
图2是根据本发明实施例的一种密钥更新装置的结构框图；
图3是根据本发明优选实施例的密钥更新装置的优选结构框图一；
图4是根据本发明优选实施例的密钥更新装置的优选结构框图二；
图5是根据本发明优选实施例的密钥更新装置的优选结构框图三；
图6是根据本发明实施例的一种主传输节点(TP)的结构框图；
图7是用于本发明实施例的分布式虚拟小区组网结构示意图；
图8是用于本发明实施例的集中式虚拟小区组网结构示意图；
图9是根据本发明优选实施方式1的密钥更新方法的流程图；
图10是根据本发明优选实施方式2的密钥更新方法的流程图；
图11是根据本发明优选实施方式3的密钥更新方法的流程图；
图12是根据本发明优选实施方式4的密钥更新方法的流程图。
具体实施方式
下文中将参考附图并结合实施例来详细说明本发明。需要说明的是，在不冲突的情况下，本申请中的实施例及实施例中的特征可以相互组合。
在本实施例中提供了一种密钥更新方法，图1是根据本发明实施例的一种密钥更新方法的流程图，如图1所示，该流程包括如下步骤：
步骤S102，接收用于生成虚拟小区中传输节点的密钥的数据加密密钥参数；
步骤S104，依据密钥参数和虚拟小区的小区标识ID生成虚拟小区中传输节点的数据加密密钥。
通过上述步骤，通过接收密钥参数，依据密钥参数和虚拟小区的小区标识ID生成虚拟小区中传输节点的数据加密密钥，解决了虚拟小区中不同传输节点密钥的更新的问题，降低了UE端加/减密处理流程实现的复杂度。
优选地，依据密钥参数和小区的小区标识ID生成虚拟小区中传输节点的密钥包括：选择预定加密算法；依据密钥参数和虚拟小区的小区标识ID生成虚拟小区中主传输节点(TP)的第一密钥；发送预定的加密算法和第一密钥至从传输节点；其中，预定的加密算法和第一密钥用于生成主传输节点和从传输节点的数据加密密钥通过把虚拟小区ID作为产生传输节点密钥的参数，确保了传输节点密钥更新的及时性。
将主传输节点(TP)的第一密钥和预定的加密算法发送给从传输节点。加密算法ID由主控制器/主传输节点(CC/Master TP)选择，可降低由从传输节点(Slave TP)选择加密算法带来的信令交互开销。
可选地，在依据密钥参数和虚拟小区的小区标识ID生成虚拟小区中传输节点的数据加密密钥之后还包括：接收来自从传输节点(TP)的密钥更新完成信号；向用户设备(UE)发送无线资源控制协议(RRC)连接重配消息，其中，RRC连接重配消息中携带有用于生成虚拟小区中传输节点的数据加密密钥的信息。密钥的更新通过RRC连接重配消息通知UE，不需要与核心网进行信令交互；且与计数器(Small Cell Counter)释放/增加过程相比，业务的中断时延大大缩短。
可选地，在满足以下触发条件至少之一的情况下，接收用于生成虚拟小区中传输节点的数据加密密钥的密钥参数：接收到来自核心网的更新信号，其中，更新信号中携带有密钥参数；接收到来自核心网的数据无线承载标识(DRB-ID)的重用信号；接收到来自从传输节点(TP)的分组数据汇聚协议序列号(PDCPSN)翻转信号。
由于虚拟小区中CC/Master TP和各Slave TP的密钥统一，UE对每一无线承载只要保持一个密钥，降低了UE端加/减密处理流程实现的复杂度。
优选地，上述任一项方法还包括：依据所述数据加密密钥进行数据传输。通过统一的数据加密密钥，当数据进行传输时，在主传输节点和从传输节点进行传输时，运用相同的第一密钥和预定的加密算法通过密钥生成函数生成统一的数据加密密钥，达到了数据加密密钥统一的效果。
在本实施例中还提供了一种更新密钥装置，该装置用于实现上述实施例及优选实施方式，已经进行过说明的不再赘述。如以下所使用的，术语“模块”可以实现预定功能的软件和/或硬件的组合。尽管以下实施例所描述的装置较佳地以软件来实现，但是硬件，或者软件和硬件的组合的实现也是可能并被构想的。
图2是根据本发明实施例的一种密钥更新装置的结构框图，如图2所示，该装置包括：第一接收模块22和生成模块24，下面对该装置进行说明。
第一接收模块22，设置为接收用于生成虚拟小区中传输节点的数据加密密钥的密钥参数；生成模块24，连接至上述第一接收模块22，设置为依据密钥参数和虚拟小区的小区标识ID生成虚拟小区中传输节点的数据加密密钥。
通过上述装置，通过第一接收模块22接收用于生成虚拟小区中传输节点的数据加密密钥的密钥参数，通过生成模块24依据密钥参数和虚拟小区的小区标识ID生成虚拟小区中传输节点的数据加密密钥的密钥参数，解决了虚拟小区中不同传输节点密钥的更新的问题，降低了UE端加/减密处理流程实现的复杂度。
图3是根据本发明实施例的密钥更新装置中生成模块24的优选结构框图，如图3所示，该生成模块24包括：选择单元32、生成单元34和发送单元36，下面对该生成模块24进行说明。
选择单元32，设置为选择预定加密算法；生成单元34，连接至上述选择单元32，设置为依据密钥参数和虚拟小区的小区标识ID生成虚拟小区中主传输节点(TP)的数据加密密钥；发送单元36，连接至上述选择单元32，设置为发送预定的加密算法和 第一密钥至从传输节点；其中，预定的加密算法和第一密钥用于生成主传输节点和从传输节点的数据加密密钥，通过把虚拟小区ID作为产生传输节点密钥的参数，确保了传输节点密钥更新的及时性。
将主传输节点(TP)的第一密钥和预定的加密算法发送给从传输节点，加密算法ID由CC/Master TP选择，可降低由Slave TP选择加密算法带来的信令交互开销。
图4是根据本发明实施例的密钥更新装置的优选结构框图，如图4所示，该装置除包括图2所示的所有模块外，还包括第二接收模块42和发送模块44，下面对该装置进行说明。
第二接收模块42，连接至上述生成模块24，设置为接收来自从传输节点(TP)的密钥更新完成信号；发送模块44，连接至上述第二接收模块42，设置为向用户设备(UE)发送无线资源控制协议(RRC)连接重配消息，其中，RRC连接重配消息中携带有用于生成虚拟小区中传输节点的数据加密密钥的信息。密钥的更新通过RRC连接重配消息通知UE，不需要与核心网进行信令交互；且与微小区计数器SCC(Small Cell Counter)释放/增加过程相比，业务的中断时延大大缩短。
优选地，上述第一接收模块22，还设置为在满足以下触发方式至少之一的情况下，接收用于生成虚拟小区中传输节点的数据加密密钥的密钥参数：接收到来自核心网的更新信号，其中，更新信号中携带有密钥参数；接收到来自核心网的数据无线承载标识(DRB-ID)的重用信号；接收到来自从传输节点(TP)的分组数据汇聚协议序列号(PDCPSN)翻转信号。
图5是根据本发明实施例的密钥更新装置的优选结构框图，如图5所示，该装置除包括图4所示的所有模块外，还包括数据传输模块52，下面对该装置进行说明。
数据传输模块52，设置为依据所述数据加密密钥进行数据传输。通过统一的数据加密密钥，当数据进行传输时，在主传输节点和从传输节点进行传输时，运用相同的第一密钥和预定的加密算法通过密钥生成函数生成统一的数据加密密钥，达到了数据加密密钥统一的效果。
由于虚拟小区中CC/Master TP和各Slave TP的密钥统一，UE对每一无线承载只要保持一个密钥，降低了UE端加/减密处理流程实现的复杂度。
图6是根据本发明实施例的主传输节点(TP)的结构框图；如图6所示，主传输节点(TP)60包括上述任一项所述的密钥更新装置62。
针对相关技术中的上述问题，在本实施例中，提供了一种虚拟小区密钥产生、传递的方法，下面对该方法进行简要说明，该方法包括如下步骤：
(1)当CC/Master TP侧收到核心网KeNB(功能同上述密钥参数)的更新指示、DRB-ID需要重用，Slave TP侧PDCP SN序列号翻转时，触发传输节点密钥TP-KeNB的更新过程；
(2)如果是CC/Master TP侧触发的安全密钥更新过程，则CC/Master TP根据最新的KeNB、SCC当前值和虚拟小区ID(Identity，标识)通过密钥产生函数(Key Derivation Function，KDF)生成新的传输节点密钥TP-KeNB；
(3)如果收到Slave TP的安全密钥更新请求消息，则CC/Master TP根据KeNB的当前值、SCC+1和虚拟小区ID通过密钥产生函数KDF生成新的传输节点密钥TP-KeNB；
(4)CC/Master TP通过安全密钥更新命令消息通知所有Slave TP更新密钥TP-KeNB，消息中还包括选择的加密算法ID；Slave TP根据最新的TP-KeNB、选择的安全算法通过密钥产生函数KDF生成新的加密密钥KUPenc(同上述从传输节点密钥)；
(5)CC/Master TP收到所有Slave TP的安全密钥命令确认消息后，通过RRC连接重配置信息通知UE更新密钥；RRC连接重配置消息中包括SCC当前值、选择的安全算法和虚拟小区ID；
(6)UE首先根据从核心获取的KeNB最新值、SCC当前值和虚拟小区ID计算TP-KeNB；其次，根据新的TP-KeNB、选择的安全算法通过密钥产生函数KDF生成新的加密密钥KUPenc；
(7)UE通过RRC连接重配置消息通知CC/Master TP密钥更新过程完成；
(8)CC/Master TP通过安全密钥更新确认消息通知所有Slave TP安全密钥更新过程完成。
其中，对每个UE的每个无线承载DRB-ID，单独产生一个传输节点密钥TP-KeNB；且对同一传输节点密钥和同一DRB-ID，PDCP序列号不能重复。
其中，CC/Master TP产生传输节点密钥时，输入参数中除了使用从核心网获取的密钥KeNB、微小区计数器SCC当前值外，还包括虚拟小区ID；为超密组网场景传输节点密钥的及时更新提供了保证。
其中，产生加密密钥的加密算法ID由CC/Master TP统一选择，可降低由Slave TP选择加密算法带来的信令交互开销。
其中，可以同时更新所有Slave TP的传输节点密钥，保证所有Slave TP、UE使用的传输节点密钥保持一致。
其中，虚拟小区中所有成员包括CC/Master TP和各Slave TP具有独立的PDCP层，且使用相同的加密密钥。
其中，使用RRC连接重配置过程更新传输节点密钥，与核心网之间没有信令交互，且与通过Small Cell的释放/增加过程相比，业务中断的时间大大缩短，可以提高用户体验。
通过上述实施例及优选实施方式，通过把虚拟小区ID作为产生传输节点密钥的参数，确保了传输节点密钥更新的及时性。加密算法ID由CC/Master TP选择，可降低由Slave TP选择加密算法带来的信令交互开销。密钥的更新通过RRC连接重配消息通知UE，不需要与核心网进行信令交互；且与Small Cell释放/增加过程相比，业务的中断时延大大缩短。由于虚拟小区中CC/Master TP和各Slave TP的密钥统一，UE对每一无线承载只要保持一个密钥，降低了UE端加/减密处理流程实现的复杂度。
下面对本发明优选实施方式进行说明。
图7是根据本发明优选实施方式的分布式虚拟小区组网结构示意图；如图7所示，传输节点(TP)1、TP2、TP3和TP4组成一个虚拟小区，各传输节点具有独立的PDCP层；其中TP1是虚拟小区的主控站点Master TP，其它站点是虚拟小区的服务站点Slave TP。Master TP是高层的控制锚点，它产生所有的高层控制信令，执行所有的调度和无线资源分配，管理Slave TP密钥的更新，解决资源分配过程中的冲突；Slave TP的作用是根据Master TP的指示进行数据的协作传输。传输节点与核心网之间通过有线回程线路Backhaul接口相连，TP与TP之间协作通过无线前程线路(Fronthaul)交互控制信令实现。虚拟小区中各基站之间共享用户标识(User Identifier)、认证/授权密钥、L2连接标识符和必需的服务上下文等信息。Master TP负责用户的控制面和用户面数据的处理，Slave TP仅负责用户的数据面处理。
图8是根据本发明优选实施方式的集中式虚拟小区组网结构示意图，如图8所示，集中式虚拟小区的组网集中式虚拟小区具有一个中央控制器，是一个逻辑节点，当有宏站存在时通常可以放在宏站实现。中央控制器负责控制面数据的处理，Slave TP负 责用户面数据的处理，各Slave TP和中央控制器之间通过反程(Backhaul)链路相连。中央控制器统一负责各Slave TP资源的调度和分配、安全密钥的更新等。
图9是根据本发明优选实施方式1的密钥更新方法的流程图，如图9所示，虚拟小区传输节点密钥TP-KeNB、加密密钥KUPenc产生的框架图如图9所示。Master TP/CC根据从核心网获取的密钥KeNB、SCC计数器当前值和虚拟小区号VC-ID，输入密钥生成函数KDF产生传输节点密钥TP-KeNB。计算完成后，Master TP/CC把传输节点密钥TP-KeNB和选择的加密算法通知各Slave TP，Slave TP根据TP-KeNB和加密算法计算加密密钥KUPenc。以上过程结束后，Master TP/CC把SCC计数器当前值、加密算法和虚拟小区号VC-ID通知UE，供UE计算传输节点密钥TP-KeNB和加密密钥KUPenc。
图10是根据本发明优选实施方式2的密钥更新方法的流程图，如图10所示，给出了针对同一UE不同的无线承载DRB-ID，Master TP/CC、Slave TP和UE各自工作过程。图中给出了针对同一UE不同的DRB-ID，最终生成不同的加密密钥KUPenc的过程。
图11是根据本发明优选实施方式3的密钥更新方法的流程图，如图11所示，该方法包括：
步骤S1101：Master TP/CC收到核心网KeNB更新指示或DRB-ID需要重用，触发安全密钥更新过程；
步骤S1102：Master TP/CC根据新的KeNB值、SCC计数器加1后的当前值和虚拟小区ID，输入密钥产生函数KDF生成新的传输节点密钥TP-KeNB；Master TP/CC选择新的加密算法；
步骤S1103-S1105：Master TP/CC分别向Slave TP1、Slave TP2、……Slave TPn发送密钥更新命令；密钥更新命令中包含新生成的传输节点密钥TP-KeNB和选择的加密算法；
步骤S1106-S1108：Slave TP1、Slave TP2、……Slave TPn根据收到的新传输节点密钥和加密算法，输入密钥产生函数KDF生成新的加密密钥KUPenc；
步骤S1109-S1111：Slave TP1、Slave TP2、……Slave TPn计算加密密钥完成后，向Master TP发送安全密钥更新确认消息；
步骤S1112：Master TP/CC收到所有Slave TP的安全密钥更新确认消息后，向UE发送RRC连接重配消息；消息中包含SCC计数器当前值、加密算法和虚拟小区ID；
步骤S1113：UE基于收到的RRC连接重配置消息，触发计算传输节点密钥TP-KeNB，同时计算加密密钥KUPenc；计算传输节点密钥的过程同Master TP/CC，计算加密密钥的过程同Slave TP；
步骤S1114：UE向Master TP/CC发送RRC连接重配置完成消息；
步骤S1115：Master TP/CC向各Slave TP发送安全密钥更新完成确认消息，以确认密钥更新过程完成。
图12是根据本发明优选实施方式4的密钥更新方法的流程图；如图12所示，该方法包括：
步骤S1201：Slave TP1PDCP序列号翻转，触发安全密钥更新流程；
步骤S1202：Slave TP1向Master TP/CC发送密钥更新请求消息；
步骤S1203：Master TP/CC根据KeNB的当前值、SCC计数器加1后的当前值和虚拟小区ID，输入密钥产生函数KDF生成新的传输节点密钥TP-KeNB；Master TP/CC选择新的加密算法；
步骤S1204-S1206：Master TP/CC分别向Slave TP1、Slave TP2、……Slave TPn发送密钥更新命令；密钥更新命令中包含新生成的传输节点密钥TP-KeNB和加密算法；
步骤S1207-S1209：Slave TP1、Slave TP2、……Slave TPn根据收到的新传输节点密钥和加密算法，输入密钥产生函数KDF生成加密密钥KUPenc；
步骤S1210-S1212：Slave TP1、Slave TP2、……Slave TPn计算加密密钥完成后，向Master TP发送安全密钥更新确认消息；
步骤S1213：Master TP/CC收到所有Slave TP的安全密钥更新确认消息后，向UE发送RRC连接重配消息；消息中包含SCC计数器当前值、加密算法和虚拟小区ID；
步骤S1214：UE基于收到的RRC连接重配置消息，触发计算传输节点密钥TP-KeNB，同时计算加密密钥KUPenc；计算传输节点密钥的过程同Master TP/CC，计算加密密钥的过程同Slave TP；
步骤S1215：UE向Master TP/CC发送RRC连接重配置完成消息；
步骤S1216：Master TP/CC向各Slave TP发送安全密钥更新完成确认消息，以确认密钥更新过程完成。
工业实用性：通过上述描述可知，本发明实施例解决了在超密组网场景下如何解决虚拟小区中不同传输节点密钥的更新的问题，进而达到了密钥统一的效果。
显然，本领域的技术人员应该明白，上述的本发明的各模块或各步骤可以用通用的计算装置来实现，它们可以集中在单个的计算装置上，或者分布在多个计算装置所组成的网络上，可选地，它们可以用计算装置可执行的程序代码来实现，从而，可以将它们存储在存储装置中由计算装置来执行，并且在某些情况下，可以以不同于此处的顺序执行所示出或描述的步骤，或者将它们分别制作成各个集成电路模块，或者将它们中的多个模块或步骤制作成单个集成电路模块来实现。这样，本发明不限制于任何特定的硬件和软件结合。
以上所述仅为本发明的优选实施例而已，并不用于限制本发明，对于本领域的技术人员来说，本发明可以有各种更改和变化。凡在本发明的精神和原则之内，所作的任何修改、等同替换、改进等，均应包含在本发明的保护范围之内。

Claims (11)

  1. 一种密钥更新方法，包括：
    接收用于生成虚拟小区中传输节点的数据加密密钥的密钥参数；
    依据所述密钥参数和所述虚拟小区的小区标识ID生成所述虚拟小区中传输节点的数据加密密钥。
  2. 根据权利要求1所述的方法，其中，依据所述密钥参数和所述虚拟小区的小区标识ID生成所述虚拟小区中传输节点的数据加密密钥包括：
    选择预定加密算法；
    依据所述密钥参数和所述虚拟小区的小区标识ID生成所述虚拟小区中主传输节点TP的第一密钥；
    发送所述预定加密算法和所述第一密钥至从传输节点；
    其中，所述预定加密算法和所述第一密钥用于生成所述主传输节点和所述从传输节点的数据加密密钥。
  3. 根据权利要求1所述的方法，其中，在依据所述密钥参数和所述虚拟小区的小区标识ID生成所述虚拟小区中传输节点的数据加密密钥之后，还包括：
    接收来自所述从传输节点TP的密钥更新完成信号；
    向用户设备UE发送无线资源控制协议RRC连接重配消息，其中，所述RRC连接重配消息中携带有用于生成所述虚拟小区中传输节点的数据加密密钥的信息。
  4. 根据权利要求1所述的方法，其中，在满足以下触发条件至少之一的情况下，接收用于生成虚拟小区中传输节点的数据加密密钥的所述密钥参数：
    接收到来自核心网的更新信号，其中，所述更新信号中携带有所述密钥参数；
    接收到来自所述核心网的数据无线承载标识DRB-ID的重用信号；
    接收到来自从传输节点TP的分组数据汇聚协议序列号PDCPSN翻转信号。
  5. 根据权利要求1至4任一项所述的方法，其中，该方法还包括：
    依据所述数据加密密钥进行数据传输。
  6. 一种密钥更新装置，包括：
    第一接收模块，设置为接收用于生成虚拟小区中传输节点的数据加密密钥的密钥参数；
    生成模块，设置为依据所述密钥参数和所述虚拟小区的小区标识ID生成所述虚拟小区中传输节点的数据加密密钥。
  7. 根据权利要求6所述的装置，其中，所述生成模块包括：
    选择单元，设置为选择预定加密算法；
    生成单元，设置为依据所述密钥参数和所述虚拟小区的小区标识ID生成所述虚拟小区中主传输节点TP的第一密钥；
    发送单元，用于发送所述预定加密算法和所述第一密钥至从传输节点；
    其中，所述预定加密算法和所述第一密钥用于生成所述主传输节点和所述从传输节点的数据加密密钥。
  8. 根据权利要求6所述的装置，其中，还包括：
    第二接收模块，设置为接收来自所述从传输节点TP的密钥更新完成信号；
    发送模块，设置为向用户设备UE发送无线资源控制协议RRC连接重配消息，其中，所述RRC连接重配消息中携带有用于生成所述虚拟小区中传输节点的数据加密密钥的信息。
  9. 根据权利要求6所述的装置，其中，所述第一接收模块，还设置为在满足以下触发条件至少之一的情况下，接收用于生成虚拟小区中传输节点的数据加密密钥的所述密钥参数：
    接收到来自核心网的更新信号，其中，所述更新信号中携带有所述密钥参数；
    接收到来自所述核心网的数据无线承载标识DRB-ID的重用信号；
    接收到来自从传输节点TP的分组数据汇聚协议序列号PDCPSN翻转信号。
  10. 根据权利要求6至9任一项所述的装置，其中，还包括：
    数据传输模块，设置为依据所述数据加密密钥进行数据传输。
  11. 一种主传输节点TP，包括权利要求6至10中任一项所述的装置。
PCT/CN2015/077540 2014-11-13 2015-04-27 一种密钥更新方法、装置和主传输节点tp WO2016074444A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US15/526,805 US10567172B2 (en) 2014-11-13 2015-04-27 Method for updating a key, and master transmission point

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201410642077.9A CN105592455B (zh) 2014-11-13 2014-11-13 一种密钥更新方法、装置和主传输节点tp
CN201410642077.9 2014-11-13

Publications (1)

Publication Number Publication Date
WO2016074444A1 true WO2016074444A1 (zh) 2016-05-19

Family

ID=55931590

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2015/077540 WO2016074444A1 (zh) 2014-11-13 2015-04-27 一种密钥更新方法、装置和主传输节点tp

Country Status (3)

Country Link
US (1) US10567172B2 (zh)
CN (1) CN105592455B (zh)
WO (1) WO2016074444A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111132157A (zh) * 2019-12-31 2020-05-08 京信通信技术(广州)有限公司 密钥处理方法、装置、基站和存储介质

Families Citing this family (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105828337A (zh) * 2014-09-17 2016-08-03 中兴通讯股份有限公司 一种动态构建虚拟小区的方法和装置
KR20190045287A (ko) * 2016-09-19 2019-05-02 후아웨이 테크놀러지 컴퍼니 리미티드 키 협상 방법 및 장치
CN110248382B (zh) * 2017-01-05 2020-09-08 华为技术有限公司 信息传输的方法和装置
EP3570577B1 (en) * 2017-06-17 2021-04-07 LG Electronics Inc. -1- Method and apparatus for supporting security for separation of cu-cp and cu-up in wireless communication system
CN109409118B (zh) * 2017-08-17 2020-12-11 中国移动通信有限公司研究院 一种文件保护方法、装置和计算机可读存储介质
CN110022206B (zh) * 2018-01-08 2021-04-09 华为技术有限公司 一种更新密钥的方法及装置
CN111385276B (zh) * 2018-12-29 2022-11-01 中兴通讯股份有限公司 数据传输方法、数据传输系统及其发送装置与接收装置
WO2020221612A1 (en) 2019-04-29 2020-11-05 Telefonaktiebolaget Lm Ericsson (Publ) Handling of multiple authentication procedures in 5g

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101257723A (zh) * 2008-04-08 2008-09-03 中兴通讯股份有限公司 密钥生成方法、装置及系统
CN101299888A (zh) * 2008-06-16 2008-11-05 中兴通讯股份有限公司 密钥生成方法、切换方法、移动管理实体和用户设备
CN102056160A (zh) * 2009-11-03 2011-05-11 华为技术有限公司 一种密钥生成的方法、装置和系统
CN102215485A (zh) * 2010-04-04 2011-10-12 中兴通讯股份有限公司 多载波通信系统中保证多载波切换或重建安全性的方法

Family Cites Families (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2012077999A2 (en) * 2010-12-08 2012-06-14 Lg Electronics Inc. Traffic encryption key management for machine to machine multicast group
WO2013008990A1 (en) * 2011-07-11 2013-01-17 Lg Electronics Inc. Traffic encryption key management for machine to machine multicast group

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101257723A (zh) * 2008-04-08 2008-09-03 中兴通讯股份有限公司 密钥生成方法、装置及系统
CN101299888A (zh) * 2008-06-16 2008-11-05 中兴通讯股份有限公司 密钥生成方法、切换方法、移动管理实体和用户设备
CN102056160A (zh) * 2009-11-03 2011-05-11 华为技术有限公司 一种密钥生成的方法、装置和系统
CN102215485A (zh) * 2010-04-04 2011-10-12 中兴通讯股份有限公司 多载波通信系统中保证多载波切换或重建安全性的方法

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111132157A (zh) * 2019-12-31 2020-05-08 京信通信技术(广州)有限公司 密钥处理方法、装置、基站和存储介质
CN111132157B (zh) * 2019-12-31 2023-08-18 京信网络系统股份有限公司 密钥处理方法、装置、基站和存储介质

Also Published As

Publication number Publication date
US10567172B2 (en) 2020-02-18
CN105592455A (zh) 2016-05-18
US20170331625A1 (en) 2017-11-16
CN105592455B (zh) 2020-09-29

Similar Documents

Publication Publication Date Title
WO2016074444A1 (zh) 一种密钥更新方法、装置和主传输节点tp
CN109005540B (zh) 一种密钥推演的方法、装置及计算机可读存储介质
EP2663107B1 (en) Key generating method and apparatus
JP6416918B2 (ja) セキュリティキー変更方法、基地局、およびユーザ機器
KR20210142179A (ko) 시간-민감형 네트워크의 데이터 송신을 실현하기 위한 방법, 관련 디바이스 및 매체
KR101931601B1 (ko) 무선 통신 시스템에서 단말과의 통신 인증을 위한 보안키 관리하는 방법 및 장치
JP4804454B2 (ja) 鍵配信制御装置、無線基地局装置および通信システム
US11483705B2 (en) Method and device for generating access stratum key in communications system
US20090088134A1 (en) Mobile station, radio access network apparatus mobility switching station, mobile communication system, and communication service access method
CN108282830B (zh) 一种网络实体切换的方法、终端及网络实体设备
CN106102105B (zh) 一种小区内切换的方法及装置
CN109417740A (zh) 保持相同无线终端的切换期间的安全密钥使用
JP7082198B2 (ja) レイヤ２処理方法、ｃｕおよびｄｕ
WO2011054288A1 (zh) 一种中继系统的安全密钥获取方法、装置
CN105532035B (zh) 路径切换方法、移动锚点及基站
WO2018113402A1 (zh) 一种加入接入节点组的方法及设备
WO2015018094A1 (zh) 一种消息传输方法及设备
CN104185177B (zh) 一种安全密钥管理方法、装置和系统
WO2015139434A1 (zh) 安全算法的确定方法及装置
CN101471720B (zh) 通讯系统及其相关方法
CN108293211A (zh) 无线通信装置（wcd）转发它自己的wcd上下文以用于移交
WO2014111049A1 (zh) 小区优化方法及装置
JP6586212B2 (ja) セキュリティキー変更方法、基地局、およびユーザ機器
CN117812584A (zh) 一种通信的方法和装置
CN115334501A (zh) 一种通信的方法、装置及系统

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 15858788

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

WWE Wipo information: entry into national phase

Ref document number: 15526805

Country of ref document: US

122 Ep: pct application non-entry in european phase

Ref document number: 15858788

Country of ref document: EP

Kind code of ref document: A1