WO2016177107A1 - Procédé, équipement d'utilisateur, et nœud pour l'implémentation d'une sécurité de couche d'accès - Google Patents

Procédé, équipement d'utilisateur, et nœud pour l'implémentation d'une sécurité de couche d'accès Download PDF

Info

Publication number
WO2016177107A1
WO2016177107A1 PCT/CN2016/076290 CN2016076290W WO2016177107A1 WO 2016177107 A1 WO2016177107 A1 WO 2016177107A1 CN 2016076290 W CN2016076290 W CN 2016076290W WO 2016177107 A1 WO2016177107 A1 WO 2016177107A1
Authority
WO
WIPO (PCT)
Prior art keywords
access
node
layer
wireless
link
Prior art date
Application number
PCT/CN2016/076290
Other languages
English (en)
Chinese (zh)
Inventor
施小娟
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2016177107A1 publication Critical patent/WO2016177107A1/fr

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/02—Details
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication

Definitions

  • the present application relates to, but is not limited to, mobile communication technologies, and in particular, to a method for implementing access layer security, and user equipment and nodes.
  • FIG. 1 is a schematic diagram of the network topology of the traditional cellular wireless access network. As shown in Figure 1, each macro base station (MNB) The location of macro(e)NB is determined by the operator's plan. Each macro base station can reach wireless coverage of several hundred meters or even several kilometers, so that nearly continuous seamless coverage within the operator's operating area can be achieved.
  • MNB macro base station
  • Each macro base station can reach wireless coverage of several hundred meters or even several kilometers, so that nearly continuous seamless coverage within the operator's operating area can be achieved.
  • SRAN-node Small Radio Access Network node, which may be referred to as a small node in this paper
  • SRAN-node means that the transmit power is lower than that of the traditional macro base station, and the coverage is also larger than the traditional macro.
  • the base station has a small coverage area of the radio access network node. Therefore, the SRAN-node may also be referred to as a low power node (LPN), such as a Pico Node or a home base station (Femto/Home (e). NB), wireless relay access equipment (Relay), and any other access network equipment that may occur that is much lower than the traditional macro base station that can access the network through a wireless communication link.
  • LPN low power node
  • NB home base station
  • Relay wireless relay access equipment
  • UDN Ultra Dense Network
  • UDN can increase network capacity. While increasing network capacity, future networks do not want to increase network capital expenditure (CAPEX, Capital Expenditure) and operating expenses (OPEX, Operating Expense), which means that UDN deployment needs to reduce man-made
  • the planning, optimization, and management can be flexibly and rapidly deployed in indoor and outdoor hotspots or large traffic areas according to network topology, network load, and service requirements, and achieve self-configuration, self-optimization, and self-healing.
  • the industry generally believes that only a small part or a small number of SRAN-nodes in the UDN can access the core network equipment through wired backhaul (such as fiber, cable, etc.); other SRAN-nodes need to support wireless backhaul.
  • wireless backhaul utilizing the characteristics of dense short-distance deployment between SRAN-nodes, realizes interworking between SRAN-nodes through wireless backhaul links between SRAN-nodes, and passes two SRANs through wireless backhaul links.
  • a wireless connection (one hop) between nodes or a wireless connection (multi-hop) between multiple SRAN-nodes in turn accesses a core network device.
  • the communication data of the user equipment UE, User Equipment
  • the two air interfaces include the SRAN-node accessed by the UE and the UE.
  • Air interface wireless backhaul link Between the SRAN-node-x), the Radio Access Link (RAL), and between the SRAN-node-x and the SRAN-node with the wired backhaul (named SRAN-node-z) Air interface wireless backhaul link.
  • RAL Radio Access Link
  • SRAN-node-x In the case of more than two air ports, take three air ports as an example, including RAL, SRAN-node-x and some The air interface wireless backhaul link between the intermediate nodes (designated as SRAN-node-y) and the air interface wireless backhaul link between SRAN-node-y and SRAN-node-z.
  • the embodiments of the present invention provide a method for implementing access layer security, a user equipment, and a node, which can ensure the security of the communication data of the UE when two or more segments are transmitted.
  • An embodiment of the present invention provides a method for implementing access layer security, including: performing end-to-end wireless access link access layer security between a UE and an initial access node; and performing initial access node and gateway node End-to-end wireless backhaul link access layer security;
  • the UE communicates with the initial access node through a wireless access link, and the initial access node communicates with the gateway node through a wireless backhaul link.
  • the communication path further includes at least one intermediate routing node;
  • the initial access node communicates with the intermediate routing node through a wireless backhaul link, and the intermediate routing node and the gateway node pass a wireless backhaul chain.
  • Road communication
  • the intermediate route Nodes communicate over a wireless backhaul link.
  • the wireless access air interface Uu port is adopted between the UE and the initial access node;
  • a wireless backhaul interface Ub port is adopted between the initial access node and the gateway node.
  • a wireless backhaul interface Ub port is used between the intermediate routing node and the initial access node, and a wireless backhaul interface Ub port is used between the intermediate routing node and the gateway node;
  • a wireless backhaul interface Ub port is adopted between the intermediate routing nodes.
  • the initial access node is a wireless access small node that the UE accesses through a wireless access link
  • the gateway node is a wireless access small node or a macro base station capable of accessing the core network through a wired interface
  • the intermediate routing node provides wireless communication for relay transmission by implementing communication between the initial access node and the gateway node to finally implement communication between the UE accessing the initial access node and the core network.
  • Small node
  • the end-to-end wireless access link access layer security between the performing UE and the initial access node includes:
  • Performing the end-to-end wireless backhaul link access layer security between the initial access node and the gateway node includes: performing an end-to-end wireless backhaul link user plane between the initial access node and the gateway node Encryption and user plane integrity protection.
  • a packet convergence protocol security (PDCP-s) layer and a location at the initial access node The end-to-end wireless backhaul link access layer security is performed between the PDCP-s layers of the gateway node.
  • PDCP-s packet convergence protocol security
  • the wireless backhaul interface Ub interface side of the initial access node and the wireless backhaul interface Ub interface side of the gateway node respectively include: a physical layer (L1) using Long Term Evolution (LTE) technology, and media access control from bottom to top Layer (MAC), Radio Link Control Layer (RLC), Packet Convergence Protocol Slimming Layer (PDCP-t), and Packet Convergence Protocol Security Layer (PDCP-s);
  • L1 physical layer
  • LTE Long Term Evolution
  • MAC Radio Link Control Layer
  • RLC Radio Link Control Layer
  • PDCP-t Packet Convergence Protocol Slimming Layer
  • PDCP-s Packet Convergence Protocol Security Layer
  • the intermediate routing node includes: L1, MAC, and RLC protocol layers using LTE technology from bottom to top; or, includes L1, MAC, RLC, and PDCP-t protocol layers using LTE technology;
  • the initial access node and the PDCP-s layer and the PDCP-t layer on the gateway node are merged into one protocol layer, it is a PDCP layer;
  • the wireless backhaul interface Ub interface side of the initial access node and the wireless backhaul interface Ub interface side of the gateway node respectively include: an L1, a MAC, and a logical link control layer using a wireless local area network (WLAN) technology. LLC) and PDCP-s protocol layer;
  • WLAN wireless local area network
  • the intermediate routing node includes L1, MAC, and LLC protocol layers using WLAN technology from bottom to top.
  • performing end-to-end wireless backhaul link user plane encryption and user plane integrity protection between the initial access node and the gateway node includes:
  • the initial access node After the user plane data of the UE is sent to the initial access node through the radio access air interface Uu interface, the initial access node sends the user plane data of the UE to the wireless backhaul interface Ub port before
  • the PDCP-s layer of the initial access node performs encryption and integrity protection, and after the data is sent to the gateway node, the gateway node performs decryption and integrity verification at the PDCP-s layer; correspondingly,
  • the gateway node acquires user plane data that needs to be sent to the UE from the core network, and performs encryption and integrity protection on the PDCP-s layer of the gateway node before sending to the wireless backhaul interface Ub port, and the data is sent to the After the initial access node, the initial access node performs decryption and integrity verification at the PDCP-s layer.
  • the PDCP-s layer is used to implement: header compression and decompression, and security operations; Among them, security operations include: encryption, decryption, integrity protection and integrity verification.
  • performing end-to-end wireless access link user plane encryption between the UE and the initial access node, and performing end-to-end wireless access link control between the performing UE and the initial access node Face encryption and control plane integrity protection including:
  • the uplink user plane data of the UE and the uplink radio resource control (RRC) layer control plane signaling perform user plane encryption for the user plane data and the RRC layer control plane signal at the PDCP layer of the UE before transmitting to the air interface, respectively. Determining control plane encryption and integrity protection; after receiving the user plane data or the RRC layer control plane signaling, the initial access node decrypts user plane data and RRC layer control plane signaling and RRC Layer control plane signaling for integrity verification; accordingly,
  • the downlink user plane data and the RRC layer control plane signaling sent by the initial access node to the UE perform user plane encryption of the user plane data and the RRC layer at the PDCP layer of the initial access node before being sent to the air interface, respectively.
  • Control plane encryption and integrity protection of control plane signaling after receiving the user plane data or the RRC layer control plane signaling, the UE decrypts the user plane data and the RRC layer control plane signaling and performs RRC Layer control plane signaling for integrity verification.
  • the UE and the initial access node of the wireless access air interface on the Uu interface side include: L1, MAC, RLC, and Packet Convergence Protocol (PDCP) layer from bottom to top;
  • L1 MAC
  • RLC Radio Link Control
  • PDCP Packet Convergence Protocol
  • the performing end-to-end wireless access link access layer security between the UE and the initial access node includes:
  • End-to-end control plane access layer security is performed between the PDCP of the UE and the PDCP layer of the initial access node.
  • the method further includes: generating an end-to-end wireless backhaul link user plane encryption and a wireless backhaul link user plane integrity between the initial access node and the gateway node between the initial access node and the gateway node Wireless backhaul link user plane encryption key K UP-Wenc and wireless backhaul link user plane integrity protection key K UP-Wint required for protection;
  • UP-Wenc and wireless backhaul link user plane integrity protection key K UP-Wint including:
  • the wireless backhaul link access layer security root key K eNB-FAN of the initial access node performs an authentication and key agreement (AKA) process between the initial access node and the core network.
  • AKA authentication and key agreement
  • NAS non-access stratum
  • the wireless backhaul link access layer security root key K eNB-FAN of the gateway node performs an authentication and key agreement (AKA) process and the non-connection between the initial access node and the core network.
  • AKA authentication and key agreement
  • NAS layer
  • the method further includes: generating, by the UE and the initial access node, a user plane encryption key K UPenc required for performing end-to-end wireless access link user plane encryption between the UE and the initial access node And generating a control plane encryption key K RRCenc and a control plane integrity protection key required for performing end-to-end radio access link control plane encryption and control plane integrity protection between the performing UE and the initial access node Key K RRCint ,
  • the gateway node Generating, by the UE and the gateway node, the user plane encryption key K UPenc based on a radio access link access layer security root key K eNB , and generating the control plane encryption key K RRCenc and the control plane Integrity protection key K RRCint ; the gateway node sends the generated user plane encryption key K UPenc , control plane encryption key K RRCenc and control plane integrity protection key K RRCint to the initial access node ;or,
  • the UE and the gateway node are based on a radio access link access layer security root key K eNB , a downlink absolute carrier frequency number (EARFCN-DL) of the cell of the initial access node, and a physical cell identifier (PCI) Generating a new radio access link access layer root key K eNB* ; said gateway node transmitting said generated K eNB* to said initial access node; said UE and said initial access
  • the node generates the user plane encryption key K UPenc based on the K eNB* , and generates the control plane encryption key K RRCenc and the control plane integrity protection key K RRCint ;
  • the radio access link access layer security root key K eNB of the UE is generated after performing an AKA process and a NAS security process between the UE and the core network;
  • the wireless access link access layer security root key K eNB of the gateway node is sent by the core network to the core network after performing an AKA process and a NAS security process between the UE and the core network. Gateway node.
  • the method further includes: the gateway node transmitting the generated user plane encryption key K Upenc , a control plane encryption key K RRCenc, and a control plane integrity protection key K RRCint to the initial access node,
  • the gateway node sends the generated user plane encryption key K Upenc , the control plane encryption key K RRCenc, and the control plane integrity protection key K RRCint to the initial access node, including:
  • the embodiment of the present invention further provides a user equipment (UE), which includes at least a first processing module and a first radio access link processing module;
  • UE user equipment
  • the first processing module is configured to: implement an AKA process and NAS security with the core network;
  • the first wireless access link processing module is configured to: perform an end to the initial access node
  • the wireless access link access layer is secure
  • the UE communicates with the initial access node through a wireless access link.
  • the first radio access link processing module is configured to: perform end-to-end wireless access link user plane encryption with the initial access node, and perform execution with the initial access node. End-to-end wireless access link control plane encryption and control plane integrity protection.
  • the wireless access air interface Uu port is adopted between the UE and the initial access node;
  • the initial access node is a wireless access small node that the UE accesses through the wireless access link.
  • the L1, the MAC, the RLC, and the Packet Convergence Protocol Layer (PDCP) protocol layer are included on the UE from bottom to top;
  • the first radio access link processing module is configured to: perform the end-to-end radio access link access layer between a PDCP protocol layer of the UE and a PDCP protocol layer of the initial access node Safety.
  • the UE further includes a first user plane key generation module and a first control plane key generation module;
  • the first user plane key generation module is configured to: before the performing the end-to-end wireless access link user plane encryption with the initial access node, the access layer security root key K based on the wireless access link
  • the eNB generates the radio access link user plane encryption key K UPenc ; or, based on the radio access link access layer security root key K eNB , the EARFCN-DL of the cell of the initial access node, and the PCI Generating a new radio access link access layer root key K eNB* , and generating the user plane encryption key K UPenc based on the K eNB* ;
  • the first control plane key generation module is configured to: before the performing the end-to-end wireless access link user plane encryption with the initial access node, the access layer security root key K based on the wireless access link
  • the eNB generates the radio access link control plane encryption key K RRCenc and the radio access link control plane integrity protection key K RRCint ; or based on the radio access link access layer security root key K
  • the eNB , the EARFCN-DL of the cell of the initial access node, and the PCI generate a new radio access link access layer root key K eNB* , and generate the control plane encryption key based on the K eNB* K RRCenc and the control plane integrity protection key K RRCint ;
  • the radio access link access layer security root key K eNB is generated after the AKA process and the NAS security process are performed between the UE and the core network.
  • the embodiment of the present invention further provides a wireless access small node, and the wireless access small node and the UE are linked by using a wireless access air interface;
  • the wireless access small node includes at least a second processing module and a second wireless access link. a path processing module and a first wireless backhaul link processing module;
  • the second processing module is configured to: implement an AKA process and NAS security with the core network;
  • a second radio access link processing module configured to: perform end-to-end wireless access link access layer security with the UE;
  • the first wireless backhaul link processing module is configured to: perform end-to-end wireless backhaul link access layer security with the gateway node.
  • the second radio access link processing module is configured to:
  • the wireless access air interface Uu interface side of the wireless access small node includes an L1, a MAC, an RLC, and a PDCP protocol layer from bottom to top;
  • the second radio access link processing module is configured to perform the end-to-end wireless access link control plane encryption and control plane between the PDCP layer of the radio access small node and the PDCP layer of the UE. Integrity protection.
  • the first wireless backhaul link processing module is configured to perform end-to-end wireless backhaul link user plane encryption and user plane integrity protection with the gateway node.
  • the wireless backhaul interface Ub interface side of the wireless access small node includes, from bottom to top, a physical layer (L1), a medium access control layer (MAC), and a radio link control layer (RLC) using Long Term Evolution (LTE) technology. ), Packet Convergence Protocol Slimming Layer (PDCP-t) and Packet Convergence Protocol Security Layer (PDCP-s); or,
  • the wireless access small node includes, from bottom to top, an L1, a MAC, a logical link control layer (LLC), and a PDCP-s protocol layer using a wireless local area network (WLAN) technology;
  • L1 a MAC
  • LLC logical link control layer
  • WLAN wireless local area network
  • the first wireless backhaul link processing module is configured to perform end-to-end wireless backhaul link access layer security between a PDCP-s of the wireless access small node and a PDCP-s layer of the gateway node .
  • the wireless access small node further includes a second user plane key generation module, configured to:
  • the second user plane key generation module is configured to:
  • the wireless backhaul link access layer secure root key K eNB-FAN performs an authentication and key agreement (AKA) process and a non-access stratum between the wireless access small node and the core network. (NAS) generated after the security process.
  • AKA authentication and key agreement
  • NAS non-access stratum between the wireless access small node and the core network.
  • the wireless access small node further includes a third user plane key generation module and a second control plane key generation module, where
  • the third user plane key generation module is configured to: receive the wireless access link from the gateway node before the wireless access small node performs end-to-end wireless access link user plane encryption with the UE User plane encryption key K UPenc ; or, receiving a radio access link access layer root key K eNB* from the gateway node, and generating the user plane encryption key K UPenc based on the K eNB* ;
  • a second control plane key generating module configured to: receive the wireless access link from the gateway node before the wireless access small node performs end-to-end wireless access link user plane encryption with the UE a control plane encryption key K RRCenc and a control plane integrity protection key K RRCint ; or receiving a radio access link access layer root key K eNB* generated from the gateway node, and based on the K eNB* generation Said control plane encryption key K RRCenc and said control plane integrity protection key K RRCint ;
  • the radio access link access layer root key K eNB* is the EARFCN-DL of the gateway node based on the radio access link access layer security root key K eNB and the radio access small node cell And the PCI generated; the radio access link access layer security root key K eNB is generated after the AKA process and the NAS security process are performed between the UE and the core network.
  • the embodiment of the invention further provides a wireless access small node, wherein the wireless access small node can access the core network through a wired interface;
  • the wireless access small node includes at least a second wireless backhaul link processing module configured to perform end-to-end wireless backhaul link access layer security with an initial access node of the UE.
  • the second wireless backhaul link processing module is configured to perform end-to-end wireless backhaul link user plane encryption and user plane integrity protection with the initial access node.
  • the wireless backhaul interface Ub interface side of the wireless access small node includes, from bottom to top, a physical layer (L1), a medium access control layer (MAC), and a radio link control layer (RLC) using Long Term Evolution (LTE) technology. ), Packet Convergence Protocol Slimming Layer (PDCP-t) and Packet Convergence Protocol Security Layer (PDCP-s); or,
  • the wireless backhaul interface Ub interface side of the wireless access small node includes, from bottom to top, an L1, a MAC, a logical link control layer (LLC), and a PDCP-s protocol layer using a wireless local area network (WLAN) technology;
  • L1 a MAC
  • LLC logical link control layer
  • WLAN wireless local area network
  • the second wireless backhaul link processing module is configured to perform an end-to-end wireless backhaul link between the PDCP-s layer of the wireless access small node and the PDCP-s layer of the initial access node Into the layer security.
  • the wireless access small node further includes a fourth user plane key generation module, configured to:
  • the fourth user plane key generation module is configured to:
  • the wireless backhaul link access layer security root key K eNB-FAN performs an authentication and key agreement (AKA) process and a non-access stratum (NAS) between the initial radio access node and the core network. ) generated after the security process.
  • AKA authentication and key agreement
  • NAS non-access stratum
  • the fourth user plane key generation module is further configured to:
  • the embodiment of the invention further provides a wireless access small node, including any combination of the two wireless access small nodes.
  • the embodiment of the present invention further provides a macro base station (MNB), which includes at least a second wireless backhaul link processing module, configured to perform end-to-end wireless backhaul link access layer security with an initial access node.
  • MNB macro base station
  • the second wireless backhaul link processing module is configured to: perform end-to-end wireless backhaul link user plane encryption and user plane integrity protection with the initial access node;
  • the second wireless backhaul link processing module performs end-to-end wireless backhaul link user plane encryption and user plane integrity protection with an initial access node by: PDCP-s layer and location at the MNB
  • the end-to-end wireless backhaul link access layer security is performed between the PDCP-s layers of the initial access node.
  • an embodiment of the present invention further provides a readable storage medium, where computer executable instructions are stored, and the method for implementing access layer security is implemented when the computer executable instructions are executed.
  • the technical solution of the present application includes: performing end-to-end wireless access link access layer security between the UE and the initial access node; and performing end-to-end wireless backhaul link access between the initial access node and the gateway node Layer security; wherein the UE communicates with the core network through at least two wireless air interfaces; the communication path includes at least a UE, an initial access node, and a gateway node; when the communication path includes two wireless air interfaces, the UE The wireless communication link is communicated with the initial access node, and the initial access node communicates with the gateway node through a wireless backhaul link.
  • the wireless backhaul link security is only performed end-to-end between the gateway node and the initial access node, which ensures that the user plane data is on the wireless backhaul link.
  • the security during transmission avoids the security leakage caused by multiple air interfaces, that is, through multiple intermediate routing nodes; on the other hand, the wireless access link security is performed end-to-end between the UE and the initial access node.
  • FIG. 1 is a schematic diagram of a network topology of a conventional cellular radio access network
  • FIG. 2 is a schematic diagram of deploying a UDN in a specific area of a conventional cellular radio access network
  • Figure 3 is a schematic diagram of ultra-dense network deployment in a certain area in the future
  • FIG. 4 is a schematic diagram of a security level of an LTE system in the related art
  • FIG. 5 is a schematic diagram of an implementation of a security hierarchy diagram shown in FIG. 4 corresponding to an LTE system protocol stack;
  • FIG. 6 is a flowchart of a method for implementing access layer security according to an embodiment of the present invention.
  • FIG. 7 is a schematic diagram of an application scenario for implementing access layer security according to an embodiment of the present invention.
  • FIG. 8 is a schematic diagram of another application scenario for implementing access layer security according to an embodiment of the present invention.
  • FIG. 9 is a schematic diagram of a security protocol for implementing access layer security according to an embodiment of the present invention.
  • FIG. 10 is another security protocol architecture for implementing access layer security according to an embodiment of the present invention.
  • FIG. 11 is a flowchart of implementing key generation for implementing an end-to-end wireless backhaul link access layer security according to the application scenario shown in FIG. 7 according to an embodiment of the present invention
  • FIG. 12 is a flowchart of a first implementation of key generation for implementing an end-to-end wireless access link access layer security based on the application scenario shown in FIG. 7 according to an embodiment of the present invention
  • FIG. 13 is a flowchart of a second implementation of key generation for implementing an end-to-end wireless access link access layer security according to the application scenario shown in FIG. 7 according to an embodiment of the present invention
  • FIG. 14 is a schematic structural diagram of a user equipment according to an embodiment of the present invention.
  • FIG. 15 is a schematic structural diagram of a structure of a wireless access small node according to an embodiment of the present invention.
  • FIG. 3 is a schematic diagram of ultra-dense network deployment in a certain area in the future, taking into account the infrastructure limitations of the actual deployment network, such as the limited number of wired network ports in the indicated area, and the implementation of CAPEX and OPEX without increasing the deployment and operation network.
  • the network is deployed flexibly and quickly. As shown in FIG. 3, only the small node 303 and the small node 309 are deployed with wired network ports, which can be indicated by the thick black solid line in FIG.
  • Wired backhaul to core network equipment, operations management and maintenance (OAM, Operation Administration and Maintenance, etc., such as small node 303 can be connected to device 302, and small node 309 can be connected to device 301.
  • OAM operations management and maintenance
  • small node 303 can be connected to device 302
  • small node 309 can be connected to device 301.
  • the other five small nodes are deployed without wired network ports. Therefore, these small nodes can only pass the wireless backhaul link between themselves and other small nodes around them (as shown by the dotted line in Figure 3). ), connected to the small node 303 or the small node 309 via a one-hop wireless backhaul link or a multi-hop wireless backhaul link, and finally connected to the core network device, the OAM device, etc. through the wired port of the small node 303 or the small node 309.
  • the communication data of many UEs must be transmitted through two or more air interfaces.
  • the UE 310 in FIG. 3 is taken as an example, and between the UE 310 and the device 301.
  • the communication data needs to be transmitted through two air interfaces, that is, through a wireless access link with the small node 306 (as shown by the lightning line in FIG. 3), and the wireless backhaul between the small node 306 and the small node 309.
  • the link is to enable communication with device 301.
  • the wireless backhaul link and the wireless backhaul link between the small node 306 and the small node 309 enable communication with the device 301.
  • FIG. 4 is a schematic diagram of a security hierarchy of a Long Term Evolution (LTE) system in the related art
  • FIG. 5 is a schematic diagram of a security hierarchy diagram shown in FIG. 4 corresponding to an implementation profile in an LTE system protocol stack
  • FIG. 5 is a diagonal line.
  • the shaded portion represents the control surface and the gray shaded portion represents the user plane.
  • the user plane protocol stack and the control plane protocol stack are also shown.
  • the core network device such as the mobility management entity/service gateway/data gateway (MME/S-GW/P-GW)
  • MME/S-GW/P-GW mobility management entity/service gateway/data gateway
  • NAS Non-- Access Stratum
  • IP/SCTP Inter-Network Protocol/Flow Control Transmission Protocol
  • APP User Interface Protocol Stack Application Layer Protocol
  • IP/User Datagram Protocol/User-side Tunneling Protocol IP/
  • the LTE system performs three security operations, namely, authentication and key agreement (AKA), and non-access layer security key negotiation (NAS SMC). , Non-Access Stratum Security Mode Command), Access Stratum Security Mode Command (AS SMC).
  • AKA authentication and key agreement
  • NAS SMC non-access layer security key negotiation
  • AS SMC Access Stratum Security Mode Command
  • a secure root key K is stored in the Universal Subscriber Identity Module (USIM) of the UE on the UE side, and is located in an Authentication Center (AuC) device on the network side.
  • the same security root key K is also saved, so that in the AKA process, first, the UE and the home subscriber server (HSS, Home Subscriber server) on the network side calculate according to the saved secure root key K, respectively.
  • ASME is the root key for subsequent NAS layer security and AS layer security.
  • the UE and the HSS also complete identity authentication with each other to ensure the legitimacy of the other device.
  • the NAS SMC process can be performed between the UE and the mobility management entity (MME, Mobility Management Entity) located on the network side.
  • MME mobility management entity
  • the UE and the MME derive a NAS layer integrity key K NAS int and a NAS layer security key K NAS enc according to the security management key K ASME generated in the AKA process.
  • the NAS layer security is implemented end-to-end between the NAS protocol layer on the UE side and the NAS protocol layer on the MME side.
  • Integrity protection and encryption are performed with the NAS layer integrity key K NAS int and the NAS layer security key K NAS enc to ensure the security of the NAS signaling.
  • Root key K eNB during the NAS SMC the MME is also based on the uplink NAS count value (uplink NAS COUNT) security management key K ASME and the NAS layer, calculates and generates a root key K eNB layer AS, and the AS layer
  • uplink NAS COUNT uplink NAS count value
  • K ASME uplink NAS COUNT
  • ASME uplink NAS COUNT
  • the base station (eNB) to which the UE is connected is notified, and then the AS SMC process can be performed between the eNB and the UE to ensure the security of the air access air interface (Uu port) between the UE and the eNB.
  • Uu port air access air interface
  • the UE and the eNB derive the integrity key K RRC int of the Uu interface control plane and the security key K RRC enc of the Uu interface control plane according to the K eNB , and derive the security key K UP enc of the Uu interface user plane.
  • the communication parties are relays and eNBs (for the sake of convenience, the interface between the relay and the eNB is called the Un interface), and the user plane integrity of the air interface Un interface can also be derived.
  • Key K UP int Corresponding to the LTE system protocol stack of FIG.
  • the AS layer security is implemented end-to-end between the Packet Data Convergence Protocol (PDCP) layer on the UE side and the PDCP protocol layer on the eNB side as shown in FIG.
  • the radio resource control (RRC) layer signaling of the UE and the eNB uses the Uu interface control plane integrity key K RRC int and the Uu interface control plane security key at the PDCP layer before transmitting to the peer end.
  • K RRC enc performs integrity protection and encryption; the upper layer data of the UE and the upper layer NAS layer signaling are transmitted to the eNB before the eNB transmits the data and signaling from the S1 interface to the UE before the PDCP layer.
  • the security key K UP enc of the user interface of the Uu interface is encrypted.
  • the data and signaling are also integrity protected at the PDCP layer by using the user plane integrity key K UP int of the Un interface.
  • Security through the AS layer ensures the security of information transmission over the wireless air interface.
  • FIG. 6 is a flowchart of a method for implementing access layer security according to an embodiment of the present invention. As shown in FIG. 6, the method includes the following steps:
  • Step 600 Implement an AKA process and a NAS layer security process between the UE/initial access node and the core network.
  • the specific implementation of this step is well-known to those skilled in the art, and the specific implementation is not limited to the scope of protection of the present application, and details are not described herein again.
  • Step 601 Perform end-to-end wireless access link access layer security between the UE and the initial access node; and perform end-to-end wireless backhaul link access layer security between the initial access node and the gateway node.
  • the UE communicates with the initial access node through a wireless access link, and the initial access node communicates with the gateway node through a wireless backhaul link.
  • the communication path further includes at least one intermediate routing node;
  • the initial access node communicates with the intermediate routing node through a wireless backhaul link, and the intermediate routing node communicates with the gateway node through a wireless backhaul link;
  • the intermediate routing nodes communicate via a wireless backhaul link.
  • the initial access node is a wireless access small node that the UE accesses through the wireless access link;
  • the gateway node is a wireless access small node or a macro base station capable of accessing the core network through a wired interface
  • the intermediate routing node is a wireless access small node that implements communication between the initial access node and the gateway node to finally provide relay transmission for communication between the UE accessing the initial access node and the core network.
  • the end-to-end wireless backhaul link access layer security between the gateway node and the initial access node is used to ensure the security of the information transmitted on the wireless backhaul interface (Ub interface) in the communication path of the UE, that is, the security is ensured.
  • Security when information is transmitted over the wireless backhaul link; and the end-to-end wireless access link access layer security procedure between the UE and the initial access node is used to ensure wireless connection of information in the UE's communication path
  • the security when transmitting over the air interface (Uu interface) ensures the security of the information as it travels over the wireless access link.
  • Performing an end-to-end wireless access link access layer security procedure between the UE and the initial access node includes: performing an end-to-end wireless access link access layer security process between the UE and the initial access node End-to-end wireless access link user plane encryption, and end-to-end wireless access link control plane encryption and control plane integrity protection between the UE and the initial access node;
  • the end-to-end wireless backhaul link access layer security process between the execution gateway node and the initial access node includes performing end-to-end user plane encryption and user plane integrity protection between the gateway node and the initial access node.
  • end-to-end wireless backhaul link access layer security between the execution gateway node and the initial access node and the end-to-end wireless access chain between the initial access node and the UE are included. Secure dual-link security process at the access layer.
  • FIG. 7 is a schematic diagram of an application scenario for implementing access layer security according to an embodiment of the present invention.
  • communication data between a UE and a core network needs to pass two or more segments.
  • Air interface transmission As shown in FIG. 7, it is assumed that one UE communicates with the core network through three air interfaces, and the UE accesses the wireless access small node 1 (SRAN-node1) through the wireless access link, and refers to SRAN-node1 as the initial access node.
  • SRAN-node1 wireless access small node 1
  • FAN First Access Node
  • the interface between the UE and SRAN-node1 is the wireless access air interface, that is, the Uu interface.
  • SRAN-node1 cannot directly access the core network through a wired interface (or no wired interface).
  • SRAN-node1 communicates with the wireless access small node 2 (SRAN-node2) through a wireless backhaul link, and refers to SRAN-node2 as an intermediate routing node.
  • the interface between SRAN-node1 and SRAN-node2 is called the wireless backhaul interface, that is, the Ub interface.
  • SRAN-node2 cannot directly access the core network through the wired interface.
  • SRAN-node2 communicates with the wireless access small node 3 (SRAN-node3) through the wireless backhaul link, and the SRAN-node3 can directly access the core network through the wired interface.
  • SRAN-node3 wireless access small node 3
  • SRAN-node3 is called a gateway node, and the interface between SRAN-node2 and SRAN-node3 is also called a Ub interface.
  • the SRAN-node 3 and the Evolved Packet Core (EPC) are directly connected through a wired interface.
  • the logical interface between the SRAN-node 3 and the EPC carried on the wired interface is the S1 interface in the LTE related technology.
  • the intermediate routing node provides relay transmission for realizing communication between the initial access node and the gateway node to finally implement communication between the UE accessing the initial access node and the core network device.
  • the UE communicates with the core network through three air interfaces (a Uu interface and two Ub interfaces). In the future network, the UE may also pass through two air interfaces (a Uu interface and a Ub). The interface communicates with the core network, or the UE may communicate with the core network via more than three air interfaces (a segment of Uu interface and an n-segment Ub interface (n>2)).
  • the UE communicates with the core network through at least two wireless air interfaces
  • the communication path of the UE communicating with the core network through at least two wireless air interfaces includes at least a UE, an initial access node, and a gateway node
  • the wireless air interface includes a radio access air interface (Uu port) between the UE and the initial access node and a wireless backhaul interface (Ub port) between the initial access node and the gateway node.
  • the communication path further includes at least one intermediate routing node.
  • the two-segment wireless air interface includes: a Uu interface between the UE and the initial access node, and an initial The Ub port between the access node and the intermediate routing node, the intermediate routing node, and the Ub interface between the gateway nodes; optionally, if there are more than two intermediate routing nodes, the Ub interface between the intermediate routing nodes is also included.
  • the end-to-end wireless backhaul link access layer security in step 601 is performed between the gateway node and the initial access node.
  • FIG. 8 is a schematic diagram of another application scenario for implementing access layer security according to an embodiment of the present invention, where In practical applications, based on Figure 2, there is also a scenario in the future ultra-dense network that is deployed in an area with traditional cellular coverage or at the edge of an area with traditional macrocell coverage.
  • some small nodes of the ultra-dense network are deployed in the coverage of the macro base station (MNB), such as SRAN-node2, and some small nodes are deployed at the edge of the coverage area of the MNB, such as SRAN-node1. It is clear, only two small nodes are shown in the figure, and no other small nodes are indicated. These small nodes have no wired backhaul to connect to the core network (CN) device.
  • MNB macro base station
  • SRAN-node2 the edge of the coverage area of the MNB
  • SRAN-node2 can access the MNB through the wireless backhaul between the MNB and the final access to the core network, and SRAN-node1 can only access the SRAN through the wireless backhaul. Node2 then finally accesses the core network through the MNB.
  • the UE accesses the network through a radio access link with SRAN-node 1, that is, SRAN-node1 is the initial access node and the gateway node is the MNB.
  • the end-to-end wireless backhaul link access layer security in step 601 is performed between the macro base station and the initial access node.
  • 9 is a security protocol architecture for implementing access layer security according to an embodiment of the present invention, performing an end-to-end wireless backhaul link between a gateway node (such as SRAN-node3) and an initial access node (such as SRAN-node1) E2E wireless backhaul security, that is, end-to-end access between the gateway node (such as SRAN-node3) and the PDCP-s (PDCP security) protocol layer of the initial access node (such as SRAN-node1) Layer security.
  • a gateway node such as SRAN-node3
  • an initial access node such as SRAN-node1 E2E wireless backhaul security
  • the gateway node such as SRAN-node3
  • the initial access node such as SRAN-node1
  • the wireless backhaul interface Ub interface side of the initial access node and the wireless backhaul of the gateway node includes the L1 physical layer, the medium access control (MAC) layer, the radio link control (RLC) layer, and the packet aggregation protocol (PDCP-t). Layer and Packet Convergence Protocol Security (PDCP-s) layer.
  • MAC medium access control
  • RLC radio link control
  • PDCP-t packet aggregation protocol
  • PDCP-s Layer and Packet Convergence Protocol Security
  • the PDCP-s layer performs the following functions: header compression and decompression, and security operations; among them, security operations, including encryption, decryption, integrity protection, and integrity verification.
  • the PDCP-t layer completes the packet convergence protocol (PDCP, Packet Data Convergence) in the related LTE technology. Protocol)
  • Other functions of the sublayer except the PDCP-s layer function including: data transmission; PDCP packet sequence number maintenance; data packets are transmitted to the upper layer in sequence during RLC layer reconstruction; RLC acknowledge mode packets when RLC layer is reconstructed Duplicate packet detection and discarding; time-based packet discarding; repeated packet discarding.
  • the PDCP-s and PDCP-t layers can also be combined into one protocol layer implementation, which is the PDCP sublayer in the related LTE technology.
  • FIG. 10 is a security protocol architecture for implementing access layer security according to an embodiment of the present invention.
  • the related protocol stack on the Ub interface in the UE communication path may also adopt other wireless communication technologies, such as a wireless local area network (WLAN). , Wireless Local Area Networks technology, as indicated by the grid filled with grid lines in Figure 10.
  • WLAN wireless local area network
  • end-to-end wireless backhaul link access layer security is performed between the gateway node and the initial access node, that is, end-to-end access layer security is performed between the gateway node and the PDCP-s protocol layer of the initial access node. .
  • the gateway node and the initial access node that is, the wireless backhaul interface Ub interface side of the initial access node and the wireless backhaul interface Ub interface side of the gateway node are respectively from bottom to top.
  • WLAN technology physical layer (PHY), MAC, logical link control layer (LLC, Logical Link Control) and other protocol layers and implement the user plane end-to-end security PDCP-s layer.
  • the functions performed by the PDCP-s layer are the same as those of FIG. 9, and are not described here.
  • the intermediate routing nodes in the UE communication path do not participate in the wireless backhaul link access layer security operation, therefore, as shown in the figure 10, in the intermediate routing node of the UE communication path, such as SRAN-node2, there is no need to implement the PDCP-s protocol layer. If the communication path of the UE includes more than one intermediate routing node, all intermediate routing nodes communicate with the UE. The path does not need to participate in the security operation of the backhaul link access layer, that is, the PDCP-s layer protocol does not need to be implemented.
  • the intermediate routing node (such as SRAN-node2) implements Ub1 interface communication with the initial access node (such as SRAN-node1) in the UE communication path and with the gateway node (such as SRAN-node3).
  • the Ub2 interface communicates between the Ub1 interface and the Ub2 interface, and includes protocol layers such as L1, MAC, and RLC from bottom to top.
  • protocol layers such as L1, MAC, and RLC from bottom to top.
  • a PDCP-t protocol layer may also be included.
  • the intermediate routing node (such as SRAN-node2) implements the communication path in the UE.
  • the Ub1 interface communication between the intermediate access node (such as SRAN-node1) and the Ub2 interface communication between the gateway node (such as SRAN-node3) is included in the Ub1 interface and the Ub2 interface, respectively from bottom to top.
  • PHY, MAC, LLC and other protocol layers using WLAN technology are included in the Ub1 interface and the Ub2 interface, respectively from bottom to top.
  • the end-to-end wireless backhaul link access layer security process between the gateway node and the initial access node includes: performing end-to-end between the gateway node and the initial access node.
  • User plane encryption and user plane integrity protection As shown in FIG. 10, the upper layer user plane data of the UE, the upper layer user plane data of the specific UE refers to the data of the protocol layer from the PDCP layer of the UE, such as the application layer of the UE in FIG. 10 (APP).
  • APP application layer of the UE in FIG. 10
  • the layer performs encryption and integrity protection. After the data is sent to the gateway node SRAN-node3, it is decrypted and integrity verified by the SRAN-node3 at the PDCP-s layer.
  • the gateway node such as SRAN-node3 is from the S-GW of the core network.
  • the /P-GW obtains the user plane data that needs to be sent to the UE.
  • the SRAN-node3 Before sending the SRAN-node3 to the Ub interface of the wireless backhaul interface, the SRAN-node3 needs to perform encryption and integrity protection at the PDCP-s layer, and the data is sent to the initial access node such as SRAN. After -node1, decryption and integrity verification is performed by SRAN-node1 at the PDCP-s layer.
  • the gateway node may be a macro base station. That is to say, all user plane data will perform end-to-end user plane encryption and user plane integrity protection before the first time entering the wireless backhaul interface transmission, thus ensuring the security of user plane data transmission in the wireless backhaul interface. Sex.
  • FIG. 11 is a flowchart of implementing key generation for implementing an end-to-end wireless backhaul link access layer security according to the application scenario shown in FIG. 7 according to an embodiment of the present invention.
  • the security key generation method shown in FIG. 11 can generate the wireless required for performing end-to-end wireless backhaul link user plane encryption and user plane integrity protection between the gateway node and the initial access node in the embodiment of the present invention.
  • the backhaul link user plane encryption key K UP-Wenc and the wireless backhaul link user plane integrity protection key K UP-Wint .
  • each small node has its own Universal Integrated Circuit Card (UICC).
  • UICC Universal Integrated Circuit Card
  • USB Global Subscriber Identity Module
  • a secure root key K the same secure root key of the USIM card is also stored in the network side authentication center (AuC) device. Therefore, with this root key, the UE-like security procedure shown in Figure 4 is taken, and Figure 11 generates an end-to-end wireless backhaul between the gateway node (such as SRAN-node3) and the initial access node (such as SRAN-node1).
  • the process of the wireless backhaul link user plane encryption key K UP-Wenc and the wireless backhaul link user plane integrity protection key K UP-Wint required for link user plane encryption and user plane integrity protection specifically includes:
  • Step 1100 Perform AKA between SRAN-node1 and the core network.
  • the security management key K ASME is calculated in SRAN-node1 and the core network device (such as HSS).
  • this step is consistent with the method for performing AKA between the UE and the core network in the LTE related technology, and is easily implemented by a person skilled in the art, and is not intended to limit the scope of protection of the present application, and details are not described herein again.
  • Step 1101 Perform a NAS layer security procedure (NAS SMC) between the SRAN-node 1 and the core network device (such as the MME), and generate a security secret required for the NAS layer security at the SRAN-node 1 and the MME after performing the NAS layer security procedure.
  • the key is the NAS layer integrity key K NAS int and the NAS layer security key K NAS enc .
  • this step is consistent with the method for performing the NAS SMC between the UE and the core network in the LTE related technology, and is easily implemented by a person skilled in the art, and is not intended to limit the scope of protection of the present application, and details are not described herein again.
  • Step 1102 The MME sends the security information of the SRAN-node1 to a gateway node in the UE communication path, such as SRAN-node3.
  • the MME calculates and generates the uplink NAS count value (uplink NAS COUNT) generated based on the security management key K ASME generated by the AKA and the NAS SMC.
  • the MME sends the security information of the SRAN-node1 to the SRAN-node3, wherein the security information of the SRAN-node1 includes the root key K eNB-SRAN-node1 of the AS layer and the security capability of the SRAN-node1 (SRAN-node1 security capability) .
  • the SRAN-node1 security capability includes an integrity protection algorithm supported by SRAN-node1 and an encryption algorithm supported by SRAN-node1.
  • Step 1103 The gateway node (such as SRAN-node3) selects a security algorithm to generate an end-to-end wireless backhaul link user plane security key: wireless backhaul link user plane integrity protection key K UP-Wint and wireless backhaul link User side encryption key K UP-Wenc .
  • the SRAN-node3 selects the integrity protection algorithm and the encryption algorithm supported by the SRAN-node1 from the SRAN-node1 security capability, and derives the wireless backhaul link user plane from the root key K eNB-SRAN-node1 of the AS layer. Integrity protection key K UP-Wint and wireless backhaul link user plane encryption key K UP-Wenc .
  • the specific key derivation algorithm is consistent with the method in the LTE related art, and is not intended to limit the scope of protection of the present application, and details are not described herein again.
  • Step 1104 The gateway node (such as SRAN-node3) sends an E2E wireless backhaul link access layer security algorithm to the SRAN-node1.
  • the algorithm includes the SRAN-node3 locally derived wireless backhaul link user plane integrity protection key K UP in step 1103. -Wint and wireless backhaul link user plane encryption key K UP-Wenc used in the access layer integrity protection algorithm and access layer encryption algorithm.
  • SRAN-node3 sends an E2E wireless backhaul link access layer security algorithm to SRAN-node1 via SRAN-node2.
  • Step 1105 SRAN-node1 generates an end-to-end wireless backhaul link user plane security key, that is, a wireless backhaul link user plane integrity protection key K UP-Wint and a wireless backhaul link user plane encryption key K UP-Wenc .
  • SRAN-node1 generates the root key K eNB-SRAN-node1 of the AS layer by the security management key K ASME generated by the AKA process and the uplink NAS COUNT generated by the NAS layer security, and then by K eNB-SRAN-node1 and
  • the security algorithm received in step 1104 derives a wireless backhaul link user plane integrity protection key K UP-Wint and a wireless backhaul link user plane encryption key K UP-Wenc .
  • Step 1106 SRAN-node1 sends an E2E wireless backhaul link access layer security completion notification to SRAN-node3 via SRAN-node2.
  • the end-to-end wireless backhaul link user plane access layer security key is generated between the initial access node and the gateway node, namely the wireless backhaul link user plane integrity protection key K UP-Wint and the wireless backhaul link.
  • the user plane encryption key K UP-Wenc can perform an end-to-end wireless backhaul link user plane access layer security operation between the initial access node and the gateway node.
  • the method provided in this embodiment further includes: performing end-to-end between the initial access node and the UE.
  • the E2E access link security performs end-to-end access layer security between the initial access node (such as SRAN-node1) and the PDCP protocol layer of the UE.
  • the protocol layer such as L1, MAC, RLC, and PDCP is included from the bottom to the top, and is used on the PDCP layer.
  • An APP layer that transmits user plane data or an RRC layer that transmits AS layer control plane signaling. It should be noted that when performing the end-to-end wireless access link access layer security between the initial access node and the UE, other small nodes (including intermediate routing nodes and gateway nodes) in the UE communication path do not participate.
  • the wireless access link access layer operates securely.
  • performing end-to-end wireless access link access layer security between the initial access node and the UE includes: performing end-to-end wireless connection between the initial access node and the UE.
  • the upper layer user plane data of the UE (such as the application layer APP data of the UE in FIG. 10, the NAS layer signaling of the UE, and the RRC layer control plane signaling of the UE) are respectively sent before being sent to the Uu port.
  • User plane encryption for user plane data and control plane encryption and integrity protection for RRC layer control plane signaling need to be performed at the PDCP layer, and the initial access node (such as SRAN-node1) receives user plane data or RRC layer control plane. After the signaling, the user plane data and the RRC layer control plane signaling are decrypted and the RRC layer control plane signaling integrity is verified. Similarly, the SRAN-node1 is used as the initial access node of the UE, and the downlink user plane is sent to the UE.
  • the user plane encryption of the user plane data and the control plane encryption and integrity protection for the RRC layer control plane signaling are respectively performed at the PDCP layer, and the UE receives the After the user plane data or the RRC layer control plane signaling, the user plane data and the RRC layer control plane signaling are decrypted and the RRC layer control plane signaling is integrity verified, thereby ensuring user plane data and control plane signaling.
  • Wireless access link Safety when.
  • FIG. 12 is a flowchart of a first implementation of key generation for implementing an end-to-end wireless access link access layer security based on the application scenario shown in FIG. 7 according to an embodiment of the present invention, by using the method of FIG.
  • the foregoing process specifically includes:
  • Step 1200 Perform AKA between the UE and the core network. After performing AKA, the security management key K ASME is calculated on the UE and the core network device (such as the HSS).
  • this step is consistent with the method for performing AKA between the UE and the core network in the LTE related technology, and is easily implemented by a person skilled in the art, and is not intended to limit the scope of protection of the present application, and details are not described herein again.
  • Step 1201 The NAS SMC is executed between the UE and the core network device (such as the MME). After performing the NAS layer security process, the security key required for the NAS layer security is generated at the UE and the MME, that is, the NAS layer integrity key. K NAS int and NAS layer security key K NAS enc .
  • this step is consistent with the method for performing the NAS SMC between the UE and the core network in the LTE related technology, and is easily implemented by a person skilled in the art, and is not intended to limit the scope of protection of the present application, and details are not described herein again.
  • Step 1202 The MME sends the security information of the UE to a gateway node in the UE communication path, such as SRAN-node 3.
  • the security information of the UE includes the security capabilities of the K eNB and the UE. The specific description is similar to the step 1102, and is easily implemented by those skilled in the art, and details are not described herein again.
  • the MME may further further implement the security capability information of the SRAN-node1, that is, the integrity protection algorithm supported by the SRAN-node1 and the SRAN- The encryption algorithm supported by node1 is sent to the gateway node.
  • Step 1203 SRAN-node3 requests an initial access node (such as SRAN-node1) accessed by the UE to request a radio access link access layer security algorithm supported by SRAN-node1, including an access layer integrity protection algorithm and Intrusion encryption algorithm.
  • an initial access node such as SRAN-node1
  • SRAN-node1 accessed by the UE to request a radio access link access layer security algorithm supported by SRAN-node1, including an access layer integrity protection algorithm and Intrusion encryption algorithm.
  • the SRAN-node 3 requests the SRAN-node 1 for the message of the radio access link access layer security algorithm, and the message that the SRAN-node1 sends the radio access link access layer security algorithm to the SRAN-node 3 is sent via the SRAN-node2. Give each other.
  • step 1202 SRAN-node3 has obtained the security of SRAN-node1 from the MME. Full capability information can then be omitted in step 1203.
  • Step 1204 SRAN-node3 generates a radio access link access layer security key, that is, a user plane encryption key K UP-Aenc , a control plane encryption key K RRCenc , and a control plane integrity protection key K RRCint .
  • a radio access link access layer security key that is, a user plane encryption key K UP-Aenc , a control plane encryption key K RRCenc , and a control plane integrity protection key K RRCint .
  • the SRAN-node3 selects the integrity protection algorithm and encryption supported by the UE and the SRAN-node1 from the UE security capability and the received radio access link access layer security algorithm supported by the SRAN-node1.
  • the algorithm further derives the access key of the wireless access link access layer by the root key K eNB of the AS layer, that is, the user plane encryption key K UP-Aenc , the control plane encryption key K RRCenc , and the control plane integrity protection Key K RRCint .
  • Step 1205 SRAN-node3 notifies the SRAN-node1 radio access link access layer security key, and the notification message carries: the radio access link access layer security key, that is, the user plane encryption key K UP-Aenc , control plane encryption key K RRCenc , control plane integrity protection key K RRCint .
  • the notification message in this step is sent to SRAN-node1 via SRAN-node2.
  • the notification message can be used between SRAN-node3 and SRAN-node1 as shown in FIG. 10 when it is sent from SRAN-node3.
  • the end-to-end wireless backhaul link access layer is securely encrypted and integrity protected, and SRAN-node1 receives the decryption and integrity verification.
  • SRAN-node2 only forwards the message after receiving the message, and does not participate in security operations;
  • the notification message is transmitted between SRAN-node 3 and SRAN-node 2 and between SRAN-node 2 and SRAN-node 1, both between SRAN-node 3 and SRAN-node 2 and at SRAN-node 2 and SRAN-node 1
  • the security channel is established on the established secure channel or is secured by the access layer between SRAN-node3 and SRAN-node2 and between SRAN-node2 and SRAN-node1.
  • Step 1206 SRAN-node1 sends an access layer security mode command to the UE, where the command carries the access layer integrity protection used by the SRAN-node3 derived wireless access link access layer security key received by SRAN-node1. Algorithm and access layer encryption algorithm.
  • Step 1207 The UE generates a radio access link access layer security key, that is, a user plane encryption key K UP-Aenc , a control plane encryption key K RRCenc , and a control plane integrity protection key K RRCint .
  • a radio access link access layer security key that is, a user plane encryption key K UP-Aenc , a control plane encryption key K RRCenc , and a control plane integrity protection key K RRCint .
  • the UE In this step, the UE generates the root key K eNB of the AS layer by using the security management key K ASME generated by the AKA process and the uplink NAS COUNT generated by the NAS layer security, and then is received by the root key K eNB of the AS layer and step 1206.
  • the obtained security algorithm derives the wireless access link access layer security key, namely the user plane encryption key K UP-Aenc , the control plane encryption key K RRCenc , and the control plane integrity protection key K RRCint .
  • Step 1208 The UE sends an access layer security mode complete message to SRAN-node1.
  • the end-to-end wireless access link access layer security key is generated between the UE and the initial access node, namely, the user plane encryption key K UP-Aenc , the control plane encryption key K RRCenc , and the control plane is complete.
  • the security protection key K RRCint , the end-to-end wireless access link access layer security operation can be performed between the UE and the initial access node.
  • FIG. 13 is a flowchart of a second implementation of key generation for implementing an end-to-end wireless access link access layer security according to the application scenario shown in FIG. 7 according to an embodiment of the present invention.
  • the user plane encryption key K UP-Aenc and the control plane required for performing the end-to-end wireless access link access layer security between the initial access node and the UE in the embodiment of the present invention can be generated by the method of FIG. Encryption key K RRCenc , control plane integrity protection key K RRCint .
  • the foregoing process specifically includes:
  • the steps 1300 to 1302 are completely consistent with the steps 1200 to 1202 shown in FIG. 12, and details are not described herein again.
  • Step 1303 After the SRAN-node3 receives the security information of the UE, the downlink absolute carrier frequency of the initial access node (such as SRAN-node1) accessed by the UE (EARFCN-DL, E-UTRA Absolute Radio Frequency Channel Number ), the physical cell identifier (PCI), and the received K eNB derive the secure root key K eNB* of the access layer of the radio access link.
  • the downlink absolute carrier frequency of the initial access node such as SRAN-node1 accessed by the UE
  • E-UTRA Absolute Radio Frequency Channel Number the physical cell identifier
  • K eNB the secure root key K eNB* of the access layer of the radio access link.
  • Step 1304 SRAN-node3 sends the derived secure root key K eNB* of the access layer of the radio access link to SRAN-node1.
  • SRAN-node3 will also send the UE security capability to SRAN-node1 during this process.
  • the message in this step is sent to SRAN-node1 via SRAN-node2.
  • SRAN-node2 In order to The security of the wireless access link access layer secure root key is transmitted via SRAN-node2.
  • the message between SRAN-node3 and SRAN-node1 shown in FIG. 10 can be utilized.
  • the end-to-end wireless backhaul link access layer secures encryption and integrity protection, and SRAN-node1 receives decryption and integrity verification.
  • SRAN-node2 only forwards the message after receiving the message, and does not participate in the security operation; or, the message in this step is sent between SRAN-node3 and SRAN-node2 and is sent between SRAN-node2 and SRAN-node1.
  • the message is sent between SRAN-node3 and SRAN-node2 and on the secure channel established between SRAN-node2 and SRAN-node1, or between SRAN-node3 and SRAN-node2 and between SRAN-node2 and SRAN.
  • the access layer between -node1 is securely secured.
  • Step 1305 SRAN-node1 selects a radio access link access layer integrity protection algorithm, an access layer encryption algorithm, and a radio access link is derived from a secure root key K eNB* of the radio access link access layer.
  • the access layer security key that is, the user plane encryption key K UP-Aenc , the control plane encryption key K RRCenc , and the control plane integrity protection key K RRCint .
  • the related key derivation algorithm in this step is the same as the control plane key derivation algorithm in the LTE related technology, and the specific implementation is not limited to the scope of protection of the present application, and details are not described herein again.
  • Step 1306 SRAN-node1 sends an access layer security mode command to the UE, and the access layer selected to be used when the SRAN-node1 derives the radio access link access layer security key in the access layer security mode command command is complete. Sex protection algorithm and access layer encryption algorithm.
  • Step 1307 The UE generates a radio access link access layer security key, that is, a user plane encryption key K UP-Aenc , a control plane encryption key K RRCenc , and a control plane integrity protection key K RRCint .
  • a radio access link access layer security key that is, a user plane encryption key K UP-Aenc , a control plane encryption key K RRCenc , and a control plane integrity protection key K RRCint .
  • the UE In this step, the UE generates the root key K eNB of the AS layer by using the security management key K ASME generated by the AKA process and the uplink NAS COUNT generated by the NAS layer security; then, the SRAN-node1 cell accessed by the K eNB and the UE EARFCN-DL, PCI derives the secure root key K eNB* of the access layer of the radio access link; finally, the UE is accessed by K eNB* using the access layer integrity protection algorithm received in step 1306.
  • the layer encryption algorithm derives the wireless access link access layer security key, namely the user plane encryption key K UP-Aenc , the control plane encryption key K RRCenc , and the control plane integrity protection key K RRCint .
  • Step 1308 The UE sends an access layer security mode complete message to SRAN-node1.
  • the end-to-end wireless access link access layer security key is generated between the UE and the initial access node, namely, the user plane encryption key K UP-Aenc , the control plane encryption key K RRCenc , and the control plane is complete.
  • the security protection key K RRCint , the end-to-end wireless access link access layer security operation can be performed between the UE and the initial access node.
  • the embodiment of the present invention performs end-to-end wireless backhaul link access layer security between the gateway node and the initial access node, and an end-to-end wireless access link between the initial access node and the UE.
  • the SRAN-node1 After receiving the user plane data of the UE from the Uu interface, the SRAN-node1 first decrypts the user plane encryption key K UP-Aenc of the access layer of the wireless access link, and then decrypts Then, the wireless backhaul link user plane encryption key K UP-Wenc and the wireless backhaul link user plane integrity protection key K UP-Wint are used for encryption and integrity protection and then sent to the Ub interface.
  • the SRAN-node1 After receiving the user plane data of the UE from the Ub interface, the SRAN-node1 first uses the wireless backhaul link user plane encryption key K UP-Wenc and the wireless backhaul link user plane integrity protection key K UP-Wint respectively. The decryption and integrity verification are performed, and then the user plane encryption key K UP-Aenc of the access layer of the wireless access link is used for encryption and then transmitted to the UE through the Uu interface.
  • the end-to-end wireless backhaul link access layer security between the gateway node and the initial access node in the embodiment of the present invention and the end-to-end wireless between the initial access node and the UE are adopted.
  • Access link layer security layer dual link security mechanism no matter how many intermediate routing nodes pass through the UE's communication path, the wireless backhaul link security is only end-to-end between the gateway node and the initial access node.
  • Execution ensures the security of user plane data transmission over the wireless backhaul link, avoiding the security leakage caused by multiple air interfaces, that is, through multiple intermediate routing nodes; on the other hand, the wireless access chain
  • the road security is performed end-to-end between the UE and the initial access node.
  • no modification to the UE using the LTE technology is required, and backward compatibility is ensured.
  • FIG. 14 is a schematic structural diagram of a structure of a UE according to an embodiment of the present invention. As shown in FIG. 14, the method includes at least a first processing module and a first radio access link processing module.
  • the first processing module is configured to: implement an AKA process and a NAS layer security with the core network;
  • the first wireless access link processing module is configured to: perform end-to-end wireless access link access layer security with the initial access node;
  • the UE communicates with the initial access node through a wireless access link.
  • the first wireless access link processing module is configured to: perform an end-to-end wireless access link user plane between the end-to-end wireless access link access layer security process and the initial access node Encryption, and perform end-to-end wireless access link control plane encryption and control plane integrity protection with the initial access node.
  • the radio access air interface Uu port is used between the UE and the initial access node; the initial access node is a radio access small node that the UE accesses through the radio access link.
  • the UE includes: L1, MAC, RLC, and Packet Convergence Protocol Layer (PDCP) protocol layers from bottom to top;
  • L1 MAC
  • RLC Radio Link Control
  • PDCP Packet Convergence Protocol Layer
  • the first radio access link processing module is configured to: perform the end-to-end radio access link access layer security process between a PDCP protocol layer of the UE and a PDCP protocol layer of the initial access node .
  • the UE of the embodiment of the present invention further includes: a first user plane key generation module and a first control plane key generation module; wherein
  • the first user plane key generation module is configured to: before the UE performs end-to-end wireless access link user plane encryption with the initial access node, access the layer security root key K eNB based on the radio access link Generating the radio access link user plane encryption key K UPenc ; or based on the radio access link access layer security root key K eNB , the EARFCN-DL of the cell of the initial access node, and PCI generation a new radio access link access stratum root key K eNB *, the encryption key K UPenc K eNB * generated based on the user plane;
  • the first control plane key generation module is configured to: generate, according to the radio access link access layer security root key K eNB , before performing end-to-end radio access link user plane encryption with the initial access node The radio access link control plane encryption key K RRCenc and the radio access link control plane integrity protection key K RRCint ; or based on the radio access link access layer security root key K eNB , The EARFCN-DL of the cell of the initial access node, and the PCI generate a new radio access link access layer root key K eNB* , and generate the control plane encryption key K RRCenc based on the K eNB* And the control plane integrity protection key K RRCint ;
  • the radio access link access layer security root key K eNB is generated after the AKA process and the NAS layer security process are performed between the UE and the core network.
  • FIG. 15 is a schematic structural diagram of a wireless access small node according to an embodiment of the present invention.
  • the wireless access small node and the UE are linked by using a wireless access air interface;
  • the wireless access small node includes at least a second processing module and a second wireless Access link processing module and first wireless backhaul link processing module; as shown in Figure 15:
  • the second processing module is configured to: implement an AKA process and a NAS layer security process with the core network;
  • a second radio access link processing module configured to: perform end-to-end wireless access link access layer security with the UE;
  • the first wireless backhaul link processing module is configured to: perform end-to-end wireless backhaul link access layer security with the gateway node.
  • the second radio access link processing module is configured to: perform an end-to-end wireless access link user plane encryption between the end-to-end radio access link security layer security procedure with the UE, and perform and End-to-end wireless access link control plane encryption and control plane integrity protection between UEs.
  • the wireless access air interface Uu interface side of the wireless access small node includes: L1, MAC, RLC, and PDCP protocol layers from top to bottom; the second wireless access link processing module is set to: in wireless access The end-to-end wireless access link control plane encryption and control plane integrity protection are performed between the PDCP layer of the small node and the PDCP layer of the UE.
  • the first wireless backhaul link processing module is configured to perform end-to-end wireless backhaul link user plane encryption and user plane integrity protection with the gateway node.
  • the wireless backhaul interface of the wireless access small node Ub interface side includes from the bottom to the top: the physical layer L1 using the long-term evolution LTE technology, the medium access control layer MAC, the radio link control layer RLC, and the packet convergence protocol slimming layer PDCP- t and packet convergence protocol security layer PDCP-s; or,
  • the wireless backhaul interface Ub interface side of the wireless access small node includes: an L1, a MAC, a logical link control layer LLC, and a PDCP-s protocol layer using a wireless local area network WLAN technology from bottom to top;
  • the first wireless backhaul link processing module is configured to perform end-to-end wireless backhaul link access layer security between the PDCP-s of the wireless access small node and the PDCP-s layer of the gateway node.
  • the wireless access small node further includes: a second user plane key generation module, configured to:
  • the second user plane key generation module is configured to:
  • the wireless backhaul link access layer security root key K eNB-FAN performs an authentication and key agreement (AKA) process and a NAS layer security process between the wireless access small node and the core network. After the build.
  • AKA authentication and key agreement
  • the wireless access small node further includes a third user plane key generation module and a second control plane key generation module, where
  • the third user plane key generation module is configured to: receive the wireless access link from the gateway node before the wireless access small node performs end-to-end wireless access link user plane encryption with the UE User plane encryption key K UPenc ; or, receiving a radio access link access layer root key K eNB* from the gateway node, and generating the user plane encryption key K UPenc based on the K eNB* ;
  • a second control plane key generating module configured to: receive the wireless access link from the gateway node before the wireless access small node performs end-to-end wireless access link user plane encryption with the UE a control plane encryption key K RRCenc and a control plane integrity protection key K RRCint ; or receiving a radio access link access layer root key K eNB* generated from the gateway node, and based on the K eNB* generation Said control plane encryption key K RRCenc and said control plane integrity protection key K RRCint ;
  • the radio access link access layer root key K eNB* is the EARFCN-DL of the gateway node based on the radio access link access layer security root key K eNB and the initial access node cell. And the PCI generated; the wireless access link access layer security root key K eNB is generated after the AKA process and the NAS layer security process are performed between the UE and the core network.
  • the wireless access small node shown in FIG. 15 can directly access the core network through a wired interface; wherein the initial access node is linked to the UE through a wireless access air interface;
  • the wireless access small node includes at least a second wireless backhaul link processing module configured to perform end-to-end wireless backhaul link access layer security with an initial access node of the UE.
  • the second wireless backhaul link processing module is configured to: perform end-to-end wireless backhaul link user plane encryption and user plane integrity protection with the initial access node.
  • the wireless backhaul interface Ub interface side of the wireless access small node includes, from bottom to top, a physical layer L1, a medium access control layer (MAC), a radio link control layer (RLC), and data using Long Term Evolution (LTE) technology.
  • MAC medium access control layer
  • RLC radio link control layer
  • LTE Long Term Evolution
  • PDCP-t Packet Convergence Protocol Slimming Layer
  • PDCP-s Packet Convergence Protocol Security Layer
  • the wireless backhaul interface Ub interface side of the wireless access small node includes, from bottom to top, an L1, a MAC, a logical link control layer (LLC), and a PDCP-s protocol layer using a wireless local area network (WLAN) technology;
  • L1 a MAC
  • LLC logical link control layer
  • WLAN wireless local area network
  • the second wireless backhaul link processing module is configured to perform an end-to-end wireless backhaul link access layer between the PDCP-s layer of the wireless access small node and the PDCP-s layer of the initial access node Safety.
  • the wireless access small node further includes a fourth user plane key generation module, configured to:
  • the fourth user plane key generation module is set to:
  • the wireless backhaul link access layer security root key K eNB-FAN is an authentication and key agreement (AKA) process and a NAS layer security process between the initial wireless access small node and the core network. Generated.
  • AKA authentication and key agreement
  • the fourth user plane key generation module is further configured to:
  • the embodiment of the present invention further provides a macro base station (MNB), which is equivalent to the gateway node in the embodiment of the present invention, and includes at least: a second wireless backhaul link processing module, configured to: perform and the initial access node End-to-end wireless backhaul link access layer security procedures.
  • MNB macro base station
  • the second wireless backhaul link processing module of the macro base station is configured to perform end-to-end wireless backhaul link user plane encryption and user plane integrity protection with the initial access node.
  • the second wireless backhaul link processing module is configured to perform end-to-end wireless backhaul link access layer security between the PDCP-s layer of the MNB and the PDCP-s layer of the initial access node.
  • an embodiment of the present invention further provides a UE, including a processor and a memory, where the processor stores instructions executable by the processor, and when the instructions are executed by the processor, performs the functions of the module shown in FIG. 14.
  • an embodiment of the present invention further provides a wireless access small node, including a processor and a memory, where the processor stores instructions executable by the processor, and when the instruction is executed by the processor, the method of FIG. 15 is performed. Show the function of the module.
  • an embodiment of the present invention further provides a computer readable storage medium storing computer executable instructions, which are implemented to implement the method for implementing access layer security when the computer executable instructions are executed.
  • each module/unit in the above embodiment may be implemented in the form of hardware, for example, by implementing an integrated circuit to implement its corresponding function, or may be implemented in the form of a software function module, for example, executing a program stored in the memory by a processor. / instruction to achieve its corresponding function.
  • This application is not limited to any specific combination of hardware and software.
  • the embodiment of the invention provides a method for implementing access layer security, a user equipment and a node, which can ensure the security of the user plane data in the wireless backhaul link, and avoids the passage of multiple air interfaces.
  • the security leakage caused by the intermediate routing nodes on the basis of ensuring the security of the wireless access link transmission, no modification to the UE using the LTE technology is required, and backward compatibility is ensured.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

Un procédé d'implémentation d'une sécurité de couche d'accès consiste à : exécuter une sécurité de couche d'accès d'une liaison d'accès radio de bout-à-bout entre un UE et un nœud d'accès initial ; et exécuter une sécurité de couche d'accès d'une liaison radio de secours de bout-à-bout entre le nœud d'accès initial et un nœud de passerelle. Un trajet de communication sur lequel l'UE communique avec un réseau central via au moins deux interfaces hertziennes comprend au moins l'UE, le nœud d'accès initial, et le nœud de passerelle. Comme le trajet de communication comprend deux interfaces hertziennes, l'UE communique avec le nœud d'accès initial via une liaison d'accès radio, et le nœud d'accès initial communique avec le nœud de passerelle via une liaison radio de secours. Le procédé garantit la sécurité de données de plan d'utilisateur lors de leur transmission sur la liaison radio de secours, supprime la nécessité de modifier l'UE au moyen de la technologie LTE sur la base de la sécurité garantie pour une transmission sur la liaison d'accès radio, et garantit la rétro-compatibilité.
PCT/CN2016/076290 2015-07-20 2016-03-14 Procédé, équipement d'utilisateur, et nœud pour l'implémentation d'une sécurité de couche d'accès WO2016177107A1 (fr)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510428467.0A CN106375992B (zh) 2015-07-20 2015-07-20 实现接入层安全的方法及用户设备和节点
CN201510428467.0 2015-07-20

Publications (1)

Publication Number Publication Date
WO2016177107A1 true WO2016177107A1 (fr) 2016-11-10

Family

ID=57218490

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/076290 WO2016177107A1 (fr) 2015-07-20 2016-03-14 Procédé, équipement d'utilisateur, et nœud pour l'implémentation d'une sécurité de couche d'accès

Country Status (2)

Country Link
CN (1) CN106375992B (fr)
WO (1) WO2016177107A1 (fr)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
RU2743578C1 (ru) * 2017-10-02 2021-02-20 Телефонактиеболагет Лм Эрикссон (Пабл) Безопасность на связанном с предоставлением доступа уровне в системе беспроводной связи

Families Citing this family (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115226099A (zh) * 2017-03-19 2022-10-21 上海朗帛通信技术有限公司 一种用于上行传输的方法和装置
WO2018170646A1 (fr) * 2017-03-19 2018-09-27 南通朗恒通信技术有限公司 Procédé et dispositif destinés à être utilisés lors d'une transmission de liaison descendante
CN110365470B (zh) * 2018-03-26 2023-10-10 华为技术有限公司 一种密钥生成方法和相关装置
EP3900421A4 (fr) * 2019-02-14 2022-02-23 JRD Communication (Shenzhen) Ltd Sécurité iab
CN111371798A (zh) * 2020-02-24 2020-07-03 迈普通信技术股份有限公司 数据安全传输方法、系统、装置及存储介质
CN115701161A (zh) * 2021-07-31 2023-02-07 华为技术有限公司 建立安全传输通道的方法、确定密钥的方法及通信装置

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102056157A (zh) * 2009-11-04 2011-05-11 大唐移动通信设备有限公司 一种确定密钥和密文的方法、系统及装置
US20130273890A1 (en) * 2010-11-11 2013-10-17 Nokia Siemens Networks Oy Method and Apparatus for Handling Closed Subscriber Groups in Relay-Enhanced System
WO2014109603A1 (fr) * 2013-01-11 2014-07-17 Lg Electronics Inc. Procédé et appareil pour transmettre une indication dans un système de communications sans fil
CN104349312A (zh) * 2013-08-02 2015-02-11 上海贝尔股份有限公司 用于支持双连接的安全处理的方法

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101931953B (zh) * 2010-09-20 2015-09-16 中兴通讯股份有限公司 生成与设备绑定的安全密钥的方法及系统
CN103929740B (zh) * 2013-01-15 2017-05-10 中兴通讯股份有限公司 数据安全传输方法及lte接入网系统
GB2509937A (en) * 2013-01-17 2014-07-23 Nec Corp Providing security information to a mobile device in which user plane data and control plane signalling are communicated via different base stations
CN104519486B (zh) * 2013-09-29 2018-05-04 中国电信股份有限公司 用于异构网中无线侧密钥更新的方法和系统

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102056157A (zh) * 2009-11-04 2011-05-11 大唐移动通信设备有限公司 一种确定密钥和密文的方法、系统及装置
US20130273890A1 (en) * 2010-11-11 2013-10-17 Nokia Siemens Networks Oy Method and Apparatus for Handling Closed Subscriber Groups in Relay-Enhanced System
WO2014109603A1 (fr) * 2013-01-11 2014-07-17 Lg Electronics Inc. Procédé et appareil pour transmettre une indication dans un système de communications sans fil
CN104349312A (zh) * 2013-08-02 2015-02-11 上海贝尔股份有限公司 用于支持双连接的安全处理的方法

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
RU2743578C1 (ru) * 2017-10-02 2021-02-20 Телефонактиеболагет Лм Эрикссон (Пабл) Безопасность на связанном с предоставлением доступа уровне в системе беспроводной связи

Also Published As

Publication number Publication date
CN106375992B (zh) 2019-08-06
CN106375992A (zh) 2017-02-01

Similar Documents

Publication Publication Date Title
WO2016177143A1 (fr) Procédé de mise en œuvre d'une sécurité de strate d'accès, équipement d'utilisateur, et nœud de réseau d'accès radio de petite taille
WO2016177107A1 (fr) Procédé, équipement d'utilisateur, et nœud pour l'implémentation d'une sécurité de couche d'accès
US9497673B2 (en) Method and apparatus to enable multiple wireless connections
US11026136B2 (en) Handovers with simplified network topology
KR20060126890A (ko) 무선망에서의 고속 로밍 서비스 방법
CN106465101B (zh) 无线网络接入保护和安全架构的系统和方法
JP6218166B2 (ja) 基地局間ハンドオーバ方法
KR20220019703A (ko) 릴레이 장치에서 인증을 위한 키를 동적으로 프로비저닝하는 방법
US20220174761A1 (en) Communications method and apparatus
US9049693B2 (en) Gateway, communication system, method of controlling gateway, and computer readable medium therefor
Saldana et al. Attention to Wi-Fi diversity: Resource management in WLANs with heterogeneous APs
JP6452800B2 (ja) ハイブリッドネットワーキングを実現する方法、システム、装置及びコンピュータ記憶媒体
CN107925874B (zh) 超密集网络安全架构和方法
Cao et al. Seamless and secure communications over heterogeneous wireless networks
Khan et al. Wireless ad hoc networks with 5G technology
EP3520316B1 (fr) Transferts avec topologie de réseau simplifiée
WO2022094976A1 (fr) Appareil et procédé de génération de clé
Chen et al. Usercentric ultra-dense networks for 5g
Ozhelvaci Secure and efficient authentication schemes for 5G heterogeneous networks
Sinha et al. A Device to Device Communication with Trusted Node Mapping in Cellular Network
Ramakrishna et al. A Study on Multi Wireless Technologies–Architectures and Security Mechanisms
Namal Enhanced communication security and mobility management in small-cell networks
Mulder LTE-WiFi Handover Strangelove
Zhang Jiannong Cao
KR20150061856A (ko) 호 설정을 위한 메시지 처리 방법 및 장치와 그를 위한 이동통신 시스템

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16789101

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 16789101

Country of ref document: EP

Kind code of ref document: A1