WO2016177143A1 - 实现接入层安全的方法及用户设备和无线接入小节点 - Google Patents

实现接入层安全的方法及用户设备和无线接入小节点 Download PDF

Info

Publication number
WO2016177143A1
WO2016177143A1 PCT/CN2016/076741 CN2016076741W WO2016177143A1 WO 2016177143 A1 WO2016177143 A1 WO 2016177143A1 CN 2016076741 W CN2016076741 W CN 2016076741W WO 2016177143 A1 WO2016177143 A1 WO 2016177143A1
Authority
WO
WIPO (PCT)
Prior art keywords
node
layer
access
control plane
key
Prior art date
Application number
PCT/CN2016/076741
Other languages
English (en)
French (fr)
Inventor
施小娟
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Priority to US15/744,733 priority Critical patent/US10136325B2/en
Publication of WO2016177143A1 publication Critical patent/WO2016177143A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/02—Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/03—Protecting confidentiality, e.g. by encryption
    • H04W12/033—Protecting confidentiality, e.g. by encryption of the user plane, e.g. user's traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/10—Integrity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W48/00—Access restriction; Network selection; Access point selection
    • H04W48/20—Selecting an access point
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W84/00—Network topologies
    • H04W84/02—Hierarchically pre-organised networks, e.g. paging networks, cellular networks, WLAN [Wireless Local Area Network] or WLL [Wireless Local Loop]
    • H04W84/04—Large scale networks; Deep hierarchical networks
    • H04W84/042—Public Land Mobile systems, e.g. cellular systems
    • H04W84/045—Public Land Mobile systems, e.g. cellular systems using private Base Stations, e.g. femto Base Stations, home Node B

Definitions

  • the present application relates to, but is not limited to, mobile communication technologies, and in particular, to a method for implementing access layer security, a user equipment, and a wireless access small node.
  • FIG 1 is a schematic diagram of the network topology of the traditional cellular wireless access network.
  • each macro base station MNB
  • the location of Macro(e)NB is determined by the operator's plan.
  • Each macro base station can reach wireless coverage of several hundred meters or even several kilometers, so that it can achieve near continuous seamless coverage in the operator's operating area.
  • a wireless access small node (SRAN-node, small radio node) may be born.
  • SRAN-node means that the transmit power is lower than that of the traditional MNB, and the coverage is also larger than the traditional macro.
  • the base station has a small coverage area of the radio access network node. Therefore, the SRAN-node may also be referred to as a low power node (LPN), such as a Pico Node or a home base station (Femto/Home (e). NB), wireless relay access equipment (Relay), and any other access network equipment that may occur that is much lower than the traditional macro base station that can access the network through a wireless communication link.
  • LPN low power node
  • NB home base station
  • Relay wireless relay access equipment
  • UDN Ultra Dense Network
  • UDN can increase network capacity. While increasing network capacity, future networks do not want to increase network capital expenditure (CAPEX, Capital Expenditure) and operating expenses (OPEX, Operating Expense), which means that UDN deployment needs to reduce man-made
  • the planning, optimization, and management can be flexibly and rapidly deployed in indoor and outdoor hotspots or large traffic areas according to network topology, network load, and service requirements, and achieve self-configuration, self-optimization, and self-healing.
  • the industry generally believes that only a small part or a small number of SRAN-nodes in the UDN can access the core network equipment through wired backhaul (such as fiber, cable, etc.); other SRAN-nodes need to support wireless backhaul.
  • wireless backhaul utilizing the characteristics of dense short-distance deployment between SRAN-nodes, realizes interworking between SRAN-nodes through wireless backhaul links between SRAN-nodes, and passes two SRANs through wireless backhaul links.
  • a wireless connection (one hop) between nodes or a wireless connection (multi-hop) between multiple SRAN-nodes in turn accesses a core network device.
  • the communication data of the user equipment UE, User Equipment
  • the two air interfaces include the SRAN-node accessed by the UE and the UE.
  • Air interface wireless backhaul link Between the SRAN-node-x), the Radio Access Link (RAL), and between the SRAN-node-x and the SRAN-node with the wired backhaul (named SRAN-node-z) Air interface wireless backhaul link.
  • RAL Radio Access Link
  • SRAN-node-x In the case of more than two air ports, take three air ports as an example, including RAL, SRAN-node-x and some The air interface wireless backhaul link between the intermediate nodes (designated as SRAN-node-y) and the air interface wireless backhaul link between SRAN-node-y and SRAN-node-z.
  • the embodiments of the present invention provide a method for implementing access layer security, a user equipment, and a wireless access small node, which can ensure the security of the communication data of the UE in two or more air interfaces, and improve the mobile performance of the UE. To ensure the continuity of data transmission of the UE user plane.
  • An embodiment of the present invention provides a method for implementing access layer security, including:
  • the micro communication path is a communication path in which the UE accesses the wireless access small node and finally accesses the core network through the wireless access link;
  • the macro communication path is that the UE accesses the macro base station through the wireless access link and finally accesses the core network. Communication path.
  • the UE communicates with the core network via at least two wireless air interfaces;
  • the micro communication path includes at least a UE, an initial access node, and a gateway node;
  • the micro communication path further includes at least one intermediate routing node.
  • the wireless access air interface Uu port is adopted between the UE and the initial access node;
  • a wireless backhaul interface Ub port is adopted between the initial access node and the gateway node.
  • a wireless backhaul interface Ub port is used between the intermediate routing node and the initial access node, and a wireless backhaul interface Ub port is used between the intermediate routing node and the gateway node;
  • a wireless backhaul interface Ub port is adopted between the intermediate routing nodes.
  • the initial access node is a wireless access small node that the UE accesses through a wireless access link
  • the gateway node is a wireless access small node capable of accessing the core network through a wired interface
  • the intermediate routing node provides communication between the initial access node and the gateway node, and finally implements communication between the UE accessing the initial access node and the core network to provide relay transmission. Enter the small node.
  • Performing end-to-end user plane access layer security between the UE and the gateway node includes: performing end-to-end user plane encryption and user plane integrity protection between the UE and the gateway node;
  • the end-to-end control plane access layer security between the performing UE and the initial access node or the macro base station includes: performing end-to-end control plane encryption and control between the UE and the initial access node or the macro base station Face integrity protection.
  • the end-to-end user plane access layer security between the performing UE and the gateway node comprises: a packet convergence protocol security (PDCP-s) layer of the UE and a PDCP-s layer of the gateway node.
  • PDCP-s packet convergence protocol security
  • the end-to-end user plane access layer security is performed between.
  • the UE and the wireless backhaul interface Ub interface side of the gateway node respectively include: a physical layer (L1), a medium access control layer (MAC), a radio link control layer (RLC), and data from bottom to top. a packet convergence protocol slimming layer (PDCP-t) and a packet convergence protocol security layer (PDCP-s); the initial access node and the intermediate routing node respectively include L1, MAC, and RLC from bottom to top, or respectively Including L1, MAC, RLC and PDCP-t;
  • L1 physical layer
  • MAC medium access control layer
  • RLC radio link control layer
  • PDCP-t packet convergence protocol slimming layer
  • PDCP-s packet convergence protocol security layer
  • the PDCP-s layer and the PDCP-t layer of the UE are merged into one protocol layer, it is a PDCP layer;
  • the gateway node If the PDCP-s layer and the PDCP-t layer of the gateway node are merged into one protocol layer, it is a PDCP layer.
  • the performing end-to-end user plane encryption and user plane integrity protection between the UE and the gateway node includes:
  • Encryption and integrity protection is performed at the PDCP-s layer of the UE before the upper layer user plane data of the UE is sent to the air interface, after the user plane data is sent to the gateway node, the gateway node is in the PDCP -s layer for decryption and integrity verification;
  • the gateway node acquires user plane data that needs to be sent to the UE from the core network, performs encryption and integrity protection on the PDCP-s layer of the gateway node before sending to the air interface, and sends data to the UE.
  • the UE then performs decryption and integrity verification at the PDCP-s layer.
  • the PDCP-s layer is used to implement: header compression and decompression, and security operations; wherein the security operations include: encryption, decryption, integrity protection, and integrity verification.
  • the performing the end-to-end control plane access layer security between the UE and the initial access node or the macro base station includes:
  • End-to-end control plane access layer security is performed between the Packet Convergence Protocol (PDCP) layer of the UE and the PDCP layer of the initial access node or macro base station.
  • PDCP Packet Convergence Protocol
  • the U1 interface side of the radio access air interface of the UE and the initial access node includes: an L1, a MAC, an RLC, and a PDCP layer, respectively, from bottom to top;
  • the initial access node, the intermediate routing node, and the gateway node respectively include L1, MAC, and RLC from bottom to top on the Ub interface side; or, include L1, MAC, RLC, and PDCP-t layers.
  • performing end-to-end control plane encryption and control plane integrity protection between the UE and the initial access node or the macro base station includes:
  • the uplink radio resource control (RRC) layer signaling of the UE performs encryption and integrity protection on the PDCP layer of the UE before being sent to the air interface, and the initial access node or the macro base station receives the RRC signaling. , performing decryption and integrity verification;
  • RRC radio resource control
  • the downlink RRC layer signaling sent by the initial access node or the macro base station to the UE performs encryption and integrity protection at its PDCP layer before being sent to the air interface, and the UE performs decryption and complete after receiving the RRC signaling. Sexual verification.
  • the method further includes: generating, between the UE and the gateway node, a user plane encryption key K UPenc required to perform end-to-end user plane encryption and user plane integrity protection between the UE and the gateway node And user face integrity protection key K UPint ,
  • a user required to perform end-to-end user plane encryption and user plane integrity protection between the UE and the gateway node is generated between the UE and the gateway node when the UE only has a micro communication path
  • the face encryption key K UPenc and the user face integrity protection key K UPint include:
  • the UE and the gateway node generate the user plane encryption key K UPenc and the user plane integrity protection key K UPint based on the access layer security root key K eNB ;
  • the K eNB of the UE is generated after performing an authentication and key agreement (AKA) process and a non-access stratum (NAS) security process between the UE and the core network;
  • AKA authentication and key agreement
  • NAS non-access stratum
  • the K eNB of the gateway node is sent by the core network to the gateway node after performing an AKA process and a NAS security process between the UE and the core network;
  • the face encryption key K UPenc and the user face integrity protection key K UPint include:
  • the macro base station in the macro communication path of the UE and the UE generates the user plane encryption key K UPenc and the user plane integrity protection key K UPint based on the K eNB ; the macro base station encrypts the generated user plane Key K UPenc and user plane integrity protection key K UPint are sent to the gateway node; or
  • the UE and the gateway node generate and execute the user plane encryption key K UPenc and the user plane integrity protection key K UPint based on the K eNB ; wherein the K eNB of the gateway node is sent by the macro base station to the Gateway node
  • the K eNB of the UE is generated after performing an AKA process and a NAS security process between the UE and the core network;
  • the K eNB of the macro base station is sent by the core network to the macro base station after performing an AKA process and a NAS security process between the UE and the core network.
  • the method further includes: when the UE only has a micro communication path, generating a control plane encryption key required to perform end-to-end control plane encryption and control plane integrity protection between the UE and the initial access node Key K RRCenc and control plane integrity protection key K RRCint ,
  • RRCint including:
  • the UE and the gateway node generate the control plane encryption key K RRCenc and the control plane integrity protection key K RRCint based on the access layer security root key K eNB ; the gateway node will generate the generated control plane
  • the encryption key K RRCenc and the control plane integrity protection key K RRCint are sent to the initial access node; or the UE and the gateway node are based on the K eNB and the downlink absolute load of the cell of the initial access node
  • the frequency number (EARFCN-DL) and the physical cell identity (PCI) generate an access layer control plane security root key K eNB* ; the gateway node sends the generated K eNB* to the initial access node, the UE And generating, by the initial access node, the control plane encryption key K RRCenc and the control plane integrity protection key K RRCint based on the K eNB* ;
  • the method further includes: when the UE has a micro communication path and a macro communication path, generating a control plane encryption key required to perform end-to-end control plane encryption and control plane integrity protection between the UE and the macro base station Key K RRCenc and control plane integrity protection key K RRCint ,
  • the generating a control plane encryption key K RRCenc and a control plane integrity protection key K RRCint required to perform end-to-end control plane encryption and control plane integrity protection between the UE and the macro base station include:
  • the UE and the macro base station generate the control plane encryption key K RRCenc and the control plane integrity protection key K RRCint based on the access layer security root key K eNB ;
  • the K eNB of the UE is generated after performing an AKA process and a NAS security process between the UE and the core network;
  • the K eNB of the gateway node or the macro base station is sent by the core network to the gateway node or the macro base station after the AKA process and the NAS security process are performed between the UE and the core network.
  • the key of the user plane and the key of the control plane are independently updated.
  • the embodiment of the present invention further provides a UE, including at least a first processing module, a first user plane processing module, and a first control plane processing module;
  • the first processing module is configured to: implement an AKA process and a NAS security process with the core network;
  • the first user plane processing module is configured to: perform end-to-end user plane access layer security with the gateway node;
  • the first control plane processing module is configured to perform end-to-end control plane access layer security between the UE and the initial access node when the UE only has a micro communication path; or, when the UE has a micro communication path and a macro communication path Performing end-to-end control plane access layer security between the UE and the macro base station in the macro communication path;
  • the micro communication path is a communication path in which the UE accesses the wireless access small node and finally accesses the core network through the wireless access link;
  • the macro communication path is that the UE accesses the macro base station through the wireless access link and finally accesses the core network. Communication path.
  • the first user plane processing module is configured to: perform end-to-end user plane encryption and user plane integrity protection with the gateway node;
  • the first control plane processing module is configured to perform end-to-end control plane encryption and control plane integrity protection with the initial access node or macro base station.
  • the UE communicates with the core network via at least two wireless air interfaces;
  • the micro communication path includes at least a UE, an initial access node, and a gateway node;
  • the micro communication path further includes at least one intermediate routing node.
  • the initial access node is a wireless access small node that the UE accesses through a wireless access link
  • the gateway node is a wireless access small node capable of accessing the core network through a wired interface
  • the intermediate routing node provides communication between the initial access node and the gateway node, and finally implements communication between the UE accessing the initial access node and the core network to provide relay transmission. Enter the small node.
  • the first user plane processing module is configured to: perform an end-to-end user plane access layer between the UE and the gateway node between a PDCP-s layer of the UE and a PDCP-s layer of the gateway node Safety;
  • the first control plane processing module is configured to: perform the UE and the initial access node or a macro base station between a PDCP protocol layer of the UE and a PDCP protocol layer of the initial access node or a macro base station
  • the end-to-end control plane is secure between access layers.
  • the first user processing module is configured to:
  • the node performs decryption and integrity verification at the PDCP-s layer
  • the first control plane processing module is configured to:
  • the UE After the UE receives the downlink RRC layer signaling sent by the initial access node or the macro base station through the air interface, performing decryption and integrity verification.
  • the embodiment of the present invention further provides a wireless access small node, which is a wireless access small node capable of accessing a core network through a wired interface;
  • the wireless access small node includes at least a second user plane processing module, configured to: perform end-to-end user plane access layer security with the UE; wherein the end-to-end user plane access layer security includes an end-to-end user Face encryption and user plane integrity protection.
  • the wireless access small node communicates with the initial access node through a wireless backhaul interface
  • the wireless access small node communicates with the intermediate routing node through a wireless backhaul interface, and the intermediate routing node and the initial access node pass the wireless backhaul interface.
  • Communication when the intermediate routing node is two or more, the intermediate routing nodes communicate through a wireless backhaul interface;
  • the initial access node is a wireless access small node that the UE accesses through a wireless access link
  • the intermediate routing node is configured to implement communication between the initial access node and the wireless access small node, and finally implement communication between the UE accessing the initial access node and the core network. Following the transmission of the wireless access small node.
  • the end-to-end user plane access layer security procedure is performed between a PDCP-s layer of the radio access small node itself and a PDCP-s layer of the UE.
  • the second user plane processing module is configured to:
  • User plane data that needs to be sent to the UE is obtained from the core network, and encryption and integrity protection is performed at the PDCP-s layer of the own before being sent to the air interface.
  • the wireless access small node further includes a user plane key generation module, and is configured to:
  • the user plane key generation module is configured to:
  • the K eNB is sent by the core network or the macro base station to the wireless access small node;
  • the macro base station is another base station that the UE accesses through a radio access link in addition to the initial access node.
  • the embodiment of the present invention further provides a wireless access small node, where the wireless access small node is a wireless access small node that the UE accesses through the wireless access link;
  • the wireless access small node includes at least a second control plane processing module, configured to: perform end-to-end control plane access layer security with the UE; wherein the end-to-end control plane access layer security includes end-to-end control Face encryption and control plane integrity protection.
  • the end-to-end control plane access layer security procedure is performed between a PDCP layer of the radio access small node itself and a PDCP layer of the UE.
  • the second control plane processing module is configured to:
  • the PDCP layer of the UE After the PDCP layer of the UE performs encryption and integrity protection on the downlink RRC layer signaling sent to the UE, it is sent to the air interface.
  • the wireless access small node further includes a control plane key generation module, and is configured to:
  • control plane key generation module is configured to:
  • the embodiment of the invention further provides a wireless access small node, including any combination of the two wireless access small nodes.
  • an embodiment of the present invention further provides a computer readable storage medium storing computer executable instructions, where the computer executable instructions are implemented to implement the foregoing method for implementing access layer security.
  • the technical solution of the present application includes: performing end-to-end user plane access layer security between the UE and the gateway node; and performing end-to-end control plane access between the UE and the initial access node when the UE only has a micro communication path Layer security; or, when the UE has a micro communication path and a macro communication path, perform end-to-end control plane access layer security between the UE and the macro base station in the macro communication path; wherein the micro communication path is the UE through the wireless access chain
  • the access wireless access small node finally accesses the communication path of the core network;
  • the macro communication path is a communication path that the UE accesses the macro base station and finally accesses the core network through the wireless access link.
  • control plane security is only performed end-to-end between the UE and the initial access node, reducing the delay of the security operation of the control plane under the premise of ensuring the security of the control plane;
  • user plane security is only performed end-to-end between the UE and the gateway node, so that when the UE moves between different SRAN-node nodes, as long as the communication path of the UE is connected to the core network through the same node, The user plane security is unchanged, thereby improving the UE's mobile performance.
  • user plane security is only performed end-to-end between the UE and the gateway node, and also causes no change in the user plane security regardless of how the intermediate node in the communication path of the UE changes, thereby ensuring UE user plane data transmission. Continuity.
  • FIG. 1 is a schematic diagram of a network topology of a conventional cellular radio access network
  • FIG. 2 is a schematic diagram of deploying a UDN in a specific area of a conventional cellular radio access network
  • Figure 3 is a schematic diagram of ultra-dense network deployment in a certain area in the future
  • FIG. 4 is a schematic diagram of a security level of an LTE system in the related art
  • FIG. 5 is a schematic diagram of an implementation of a security hierarchy diagram shown in FIG. 4 corresponding to an LTE system protocol stack;
  • FIG. 6 is a flowchart of a method for implementing access layer security according to an embodiment of the present invention.
  • FIG. 7 is a schematic diagram of an application scenario for implementing access layer security according to an embodiment of the present invention.
  • FIG. 8 is a schematic diagram of another application scenario for implementing access layer security according to an embodiment of the present invention.
  • FIG. 9 is a schematic diagram of a user plane access layer security protocol based on the application scenario shown in FIG. 7 according to an embodiment of the present invention.
  • FIG. 10 is a flowchart of implementing a key generation implementation for implementing user plane access layer security according to the application scenario shown in FIG. 7 according to an embodiment of the present invention
  • 11 is a control plane access layer security protocol architecture based on the application scenario shown in FIG. 7 according to an embodiment of the present invention.
  • FIG. 12 is a flowchart of a first implementation of key generation for implementing control plane access layer security based on the application scenario shown in FIG. 7 according to an embodiment of the present invention
  • FIG. 13 is a flowchart of a second implementation of key generation for implementing control plane access layer security based on the application scenario shown in FIG. 7 according to an embodiment of the present invention
  • FIG. 14 is a schematic diagram of a user plane access layer security protocol frame based on the application scenario shown in FIG. 8 according to an embodiment of the present invention.
  • FIG. 15 is a schematic diagram of a control plane access layer security protocol based on the application scenario shown in FIG. 8 according to an embodiment of the present invention.
  • FIG. 16 is a flowchart of a key generation implementation for implementing user plane access layer security and control plane access layer security according to the application scenario shown in FIG. 8 according to an embodiment of the present invention
  • FIG. 17 is a flowchart of implementing step-by-step node security verification according to an embodiment of the present invention.
  • FIG. 18 is a schematic structural diagram of a user equipment according to an embodiment of the present invention.
  • FIG. 19 is a schematic structural diagram of a structure of a wireless access small node according to an embodiment of the present invention.
  • FIG 3 is a schematic diagram of ultra-dense network deployment in a certain area in the future, taking into account the infrastructure limitations of the actual deployment network, such as the limited number of wired network ports in the indicated area, and the CAPEX and OPEX that do not increase the deployment and operation network.
  • the network flexibly and quickly, as shown in Figure 3, among the seven SRAN-nodes, only the small node 303 and the small node 309 are deployed with wired network ports, which can be shown by the thick black solid line in Figure 3.
  • the wired backhaul is connected to the core network device, Operation Administration and Maintenance (OAM) device, etc.
  • OAM Operation Administration and Maintenance
  • the small node 303 can be connected to the device 302, and the small node 309 can be connected to the device 301.
  • the other five small nodes are deployed without wired network ports. Therefore, these small nodes can only pass the wireless backhaul link between themselves and other small nodes around them (as shown by the dotted line in Figure 3). ), connected to the small node 303 or the small node 309 via a one-hop wireless backhaul link or a multi-hop wireless backhaul link, and finally connected to the core network device, the OAM device, etc. through the wired port of the small node 303 or the small node 309.
  • the communication data of many UEs must be transmitted through two or more air interfaces.
  • the UE 310 in FIG. 3 is taken as an example, and between the UE 310 and the device 301.
  • Communication data needs to go through two The transmission of the segment air interface, that is, through the wireless access link with the small node 306 (shown by the lightning line in FIG. 3), and the wireless backhaul link between the small node 306 and the small node 309 to implement the device Communication between 301.
  • the wireless backhaul link and the wireless backhaul link between the small node 306 and the small node 309 enable communication with the device 301.
  • FIG. 4 is a schematic diagram of a security hierarchy of a Long Term Evolution (LTE) system in the related art
  • FIG. 5 is a schematic diagram of a security hierarchy diagram shown in FIG. 4 corresponding to an implementation profile in an LTE system protocol stack
  • FIG. 5 is a diagonal line.
  • the shaded portion represents the control surface and the gray shaded portion represents the user plane. As shown in FIG.
  • the user plane protocol stack and the control plane protocol stack are simultaneously shown, and for core network devices such as a mobility management entity/service gateway/data gateway (MME/S-GW/P-GW), these devices Physically, they can be located on the same physical device, but logically implement different logical functions, such as the rightmost core network device protocol stack architecture in Figure 5, the control plane protocol stack non-access stratum (NAS) and inter-network protocol.
  • /Flow Control Transmission Protocol IP/SCTP
  • IP/SCTP is implemented on the MME
  • APP User Plane Protocol Stack Application Layer Protocol
  • IP/UDP/GTP-U Inter-Network Protocol/User Datagram Protocol/User Plane Tunneling Protocol
  • IP/UDP/GTP-U Inter-Network Protocol/User Datagram Protocol/User Plane Tunneling Protocol
  • the LTE system performs three security operations, namely, authentication and key agreement (AKA), and non-access layer security key negotiation (NAS SMC). , Non-Access Stratum Security Mode Command), Access Stratum Security Mode Command (AS SMC).
  • AKA authentication and key agreement
  • NAS SMC non-access layer security key negotiation
  • AS SMC Access Stratum Security Mode Command
  • a secure root key K is stored in the Universal Subscriber Identity Module (USIM) of the UE on the UE side, and is located in an Authentication Center (AuC) device on the network side.
  • the same security root key K is also saved, so that in the AKA process, first, the UE and the home subscriber server (HSS, Home Subscriber server) on the network side calculate according to the saved secure root key K, respectively.
  • ASME is the root key for subsequent NAS layer security and AS layer security.
  • the UE and the HSS also complete mutual identity authentication to ensure the legitimacy of the other device.
  • the NAS SMC process can be performed between the UE and the mobility management entity (MME, Mobility Management Entity) located on the network side.
  • MME mobility management entity
  • the UE and the MME derive a NAS layer integrity key K NAS int and a NAS layer security key K NAS enc according to the security management key K ASME generated in the AKA process.
  • the NAS layer security is implemented end-to-end between the NAS protocol layer on the UE side and the NAS protocol layer on the MME side.
  • Integrity protection and encryption are performed with the NAS layer integrity key K NAS int and the NAS layer security key K NAS enc to ensure the security of the NAS signaling.
  • Root key K eNB during the NAS SMC the MME is also based on the uplink NAS count value (uplink NAS COUNT) security management key K ASME and the NAS layer, calculates and generates a root key K eNB layer AS, and the AS layer
  • uplink NAS COUNT uplink NAS count value
  • K ASME uplink NAS COUNT
  • ASME uplink NAS COUNT
  • the base station (eNB) to which the UE is connected is notified, and then the AS SMC process can be performed between the eNB and the UE to ensure the security of the air access air interface (Uu port) between the UE and the eNB.
  • Uu port air access air interface
  • the UE and the eNB derive the integrity key K RRC int of the Uu interface control plane and the security key K RRC enc of the Uu interface control plane according to the K eNB , and derive the security key K UP enc of the Uu interface user plane.
  • the communication parties are relays and eNBs (for the sake of convenience, the interface between the relay and the eNB is called the Un interface), and the user plane integrity of the air interface Un interface can also be derived.
  • Key K UP int Corresponding to the LTE system protocol stack of FIG.
  • the AS layer security is implemented end-to-end between the Packet Data Convergence Protocol (PDCP) layer on the UE side and the PDCP protocol layer on the eNB side as shown in FIG.
  • the radio resource control (RRC) layer signaling of the UE and the eNB uses the Uu interface control plane integrity key K RRC int and the Uu interface control plane security key at the PDCP layer before transmitting to the peer end.
  • K RRC enc performs integrity protection and encryption; the upper layer data of the UE and the upper layer NAS layer signaling are transmitted to the eNB before the eNB transmits the data and signaling from the S1 interface to the UE before the PDCP layer.
  • the security key K UP enc of the user interface of the Uu interface is encrypted.
  • the data and signaling are also integrity protected at the PDCP layer by using the user plane integrity key K UP int of the Un interface.
  • Security through the AS layer ensures the security of information transmission over the wireless air interface.
  • FIG. 6 is a flowchart of a method for implementing access layer security according to an embodiment of the present invention. As shown in FIG. 6, the method includes the following steps:
  • Step 600 Implement an AKA process and a NAS layer security process between the UE and the core network.
  • the specific implementation of this step is well-known to those skilled in the art, and the specific implementation is not limited to the scope of protection of the present application, and details are not described herein again.
  • Step 601 Perform end-to-end user plane access layer security between the UE and the gateway node; and perform an end-to-end control plane access layer security between the UE and the initial access node when the UE only has a micro communication path; Or, when the UE has a micro communication path and a macro communication path, perform end-to-end control plane access layer security between the UE and the macro base station in the macro communication path;
  • the micro communication path is a communication path in which the UE accesses the wireless access small node and finally accesses the core network through the wireless access link;
  • the macro communication path is that the UE accesses the macro base station through the wireless access link and finally accesses the core network. Communication path.
  • Performing the end-to-end user plane access layer security process between the UE and the gateway node includes: performing end-to-end user plane encryption and user plane integrity protection between the UE and the gateway node;
  • Performing an end-to-end control plane access layer security procedure between the UE and the initial access node or the macro base station includes performing end-to-end control plane encryption and control plane integrity protection between the UE and the initial access node or the macro base station.
  • the UE communicates with the core network via at least two wireless air interfaces;
  • the micro communication path includes at least a UE, an initial access node, and a gateway node;
  • the micro communication path further includes at least one intermediate routing node.
  • the initial access node is a wireless access small node that the UE accesses through the wireless access link;
  • the gateway node is a wireless access small node capable of accessing the core network through a wired interface
  • the intermediate routing node is a wireless access small node that implements communication between the initial access node and the gateway node, and finally implements communication between the UE accessing the initial access node and the core network to provide relay transmission.
  • FIG. 7 is a schematic diagram of an application scenario for implementing access layer security according to an embodiment of the present invention.
  • the communication data between the UE and the core network needs to be transmitted through two or more air interfaces.
  • the UE accesses the wireless access small node 1 (SRAN-node1) through the wireless access link, and refers to SRAN-node1 as the initial access node.
  • the interface between the UE and the SRAN-node 1 is a wireless access air interface, that is, a Uu interface.
  • SRAN-node1 cannot directly access the core network through a wired interface (or no wired interface), and SRAN-node1 communicates with the wireless access small node 2 (SRAN-node2) through a wireless backhaul link, and the SRAN-node 2 is called
  • the wireless backhaul interface the interface between SRAN-node1 and SRAN-node2 is called the wireless backhaul interface, that is, the Ub interface.
  • SRAN-node2 cannot directly access the core network through the wired interface.
  • SRAN-node2 communicates with the wireless access small node 3 (SRAN-node3) through the wireless backhaul link, and the SRAN-node3 can directly access the core network through the wired interface.
  • SRAN-node3 is called a gateway node, and the interface between SRAN-node2 and SRAN-node3 is also called a Ub interface.
  • the SRAN-node 3 and the Evolved Packet Core (EPC) are directly connected through a wired interface.
  • the logical interface between the SRAN-node 3 and the EPC carried on the wired interface is the S1 interface in the LTE related technology.
  • the intermediate routing node provides relay transmission for realizing communication between the initial access node and the gateway node to finally implement communication between the UE accessing the initial access node and the core network device.
  • the UE communicates with the core network through three air interfaces (a Uu interface and two Ub interfaces). In the future network, the UE may also pass through two air interfaces (a Uu interface and a Ub). The interface communicates with the core network, or the UE may communicate with the core network via more than three air interfaces (a segment of Uu interface and an n-segment Ub interface (n>2)).
  • the UE communicates with the core network through at least two wireless air interfaces
  • the communication path of the UE communicating with the core network through at least two wireless air interfaces includes at least a UE, an initial access node, and a gateway node
  • the wireless air interface includes a radio access air interface (Uu port) between the UE and the initial access node and a wireless backhaul interface (Ub port) between the initial access node and the gateway node.
  • the communication path further includes at least one intermediate routing node.
  • the two-segment wireless air interface includes: a Uu interface between the UE and the initial access node, and an initial The Ub port between the access node and the intermediate routing node, the intermediate routing node, and the Ub interface between the gateway nodes; optionally, if there are more than two intermediate routing nodes, the Ub interface between the intermediate routing nodes is also included.
  • the end-to-end control plane access layer security performed in step 601 is performed between the UE and the initial access node.
  • FIG. 8 is a schematic diagram of another application scenario for implementing access layer security according to an embodiment of the present invention.
  • small nodes such as SRAN-node1 and SRAN-node3 are densely deployed in the coverage of the macro base station (MNB) (only two small nodes are shown in Figure 8 for clarity of illustration), where SRAN- Node3 can be connected to the core network (CN) device via a wired backhaul link, while SRAN-node1 can only connect to SRAN-node3 via a wireless backhaul link and to the CN device via SRAN-node3.
  • MNB macro base station
  • the UE accesses the MNB through a radio access link with the MNB, and on the other hand, the UE accesses the SRAN-node 1 through a radio access link with the SRAN-node1.
  • a reasonable allocation of services between the two can be implemented as needed, for example, a large traffic service is transmitted between the UE and the SRAN-node1, and a small traffic service is in the UE and Transmission between MNBs; for example, high-reliability services are transmitted between the UE and the MNB, and services with less stringent reliability are transmitted between the UE and the SRAN-node1; and the UE and the MNB and the SRAN-
  • the dual connection between node1 implements separation of control plane signaling and user plane data. For example, control plane management signaling is transmitted between the UE and the MNB, and user plane data is transmitted between the UE and the SRAN-node1.
  • the UE is connected to the macro base station (MNB) through the wireless access link (the UE accesses the MNB through the wireless access link and finally accesses the communication of the core network).
  • MNB macro base station
  • the path is called a macro communication path.
  • the UE connects to the SRAN-node through the wireless access link.
  • micro communication. Path The communication path that connects the UE to the SRAN-node through the wireless access link and finally accesses the core network is called micro communication. Path); wherein, in the micro communication path of the UE, the UE communicates with the core network through at least two wireless air interfaces.
  • the micro communication path includes at least a UE, an initial access node, and a gateway node, and the two wireless air interfaces include a radio access air interface (Uu port) between the UE and the initial access node, and an initial access node and a gateway.
  • Wireless backhaul interface (Ub port) between nodes.
  • the micro communication path further includes at least one intermediate routing node, and the two wireless wireless interfaces include the Uu interface and the initial access node between the UE and the initial access node.
  • the Ub port between the Ub port, the intermediate routing node, and the gateway node between the intermediate routing node; optionally, if there are more than two intermediate routing nodes, Including the Ub port between the intermediate routing nodes.
  • the end-to-end control plane access layer security performed in step 601 is performed between the UE and the macro base station.
  • E2E UP security is a user plane access layer security protocol architecture based on the application scenario shown in FIG. 7 according to an embodiment of the present invention, and performing end-to-end user plane access layer security (E2E UP security, between a UE and a gateway node (such as SRAN-node3).
  • the end-to-end UP security procedure performs an end-to-end user plane access layer security procedure between the PDCP-s (PDCP security) protocol layer of the UE and the PDCP-s protocol layer of the SRAN-node 3.
  • the UE and the SRAN-node3 are at both ends of the E2E UP security, and include a physical layer (L1), a medium access control layer (MAC, Media Access Control), and a radio link control layer (from the bottom to the top).
  • L1 physical layer
  • MAC medium access control layer
  • MAC Media Access Control
  • RLC Radio Link Control
  • PDCP-t Packet Data Convergence Protocol thined
  • PDCP-s Packet Data Convergence Protocol security
  • the PDCP-s layer performs the following functions: header compression and decompression, and security operations; among them, security operations, including encryption, decryption, integrity protection, and integrity verification;
  • the PDCP-t layer performs other functions of the PDCP sublayer in addition to the PDCP-s layer function in the related LTE technology, such as: data transmission; PDCP packet sequence number maintenance; data packet is transmitted to the upper layer in sequence during RLC layer reconstruction; RLC layer reconstruction At the time, repeated packet detection and discarding of RLC acknowledge mode packets; time-based packet discarding; repeated packet discarding, and the like.
  • the PDCP-s and PDCP-t layers can also be combined into one protocol layer implementation, which is the PDCP sublayer in the related LTE technology.
  • the gateway node such as SRAN-node3
  • other access network nodes in the UE communication path including the initial access node and the middle
  • the routing node does not participate in the access layer security operation, therefore, as shown in Figure 9, on other access network nodes of the UE communication path, that is, at the initial access node SRAN-node1, on the intermediate routing node such as SRAN-node2, does not need to implement the PDCP-s protocol layer.
  • SRAN-node1 and SRAN-node2 respectively include protocol layers such as L1, MAC, RLC, etc. from bottom to top on each wireless air interface of the communication.
  • the PDCP-t protocol layer may also be included. Specifically:
  • SRAN-node1 is configured to implement a Uu interface communication with the UE, and includes a protocol layer such as L1, MAC, and RLC from bottom to top on the Uu interface side, and optionally, a PDCP-t protocol layer.
  • a protocol layer such as L1, MAC, and RLC from bottom to top on the Uu interface side, and optionally, a PDCP-t protocol layer.
  • the SRAN-node1 is configured to implement the Ub1 interface communication with the intermediate routing node SRAN-node2, and includes a protocol layer such as L1, MAC, and RLC from the bottom to the top on the Ub1 interface side, and optionally, a PDCP-t protocol layer.
  • a protocol layer such as L1, MAC, and RLC from the bottom to the top on the Ub1 interface side, and optionally, a PDCP-t protocol layer.
  • the SRAN-node 2 is configured to implement the Ub1 interface communication with the initial access node SRAN-node1, and includes a protocol layer such as L1, MAC, and RLC from bottom to top on the Ub1 interface side, and optionally, a PDCP-t protocol layer. ;
  • the SRAN-node 2 is configured to implement the Ub2 interface communication with the gateway node SRAN-node3, and includes a protocol layer such as L1, MAC, and RLC from the bottom to the top on the Ub2 interface side, and optionally, a PDCP-t protocol layer.
  • a protocol layer such as L1, MAC, and RLC from the bottom to the top on the Ub2 interface side, and optionally, a PDCP-t protocol layer.
  • the end-to-end user plane access layer security process between the UE and the gateway node includes: performing an end-to-end user plane between the UE and the SRAN-node3.
  • Encryption and user plane integrity protection With reference to FIG. 9, the upper layer user plane data of the UE, the upper layer user plane data of the specific UE refers to the data of the protocol layer from the PDCP-s layer of the UE, such as the application layer (APP) data of the UE in FIG. 9, and then the UE.
  • the NAS layer signaling and the like need to perform encryption and integrity protection at the PDCP-s layer before being sent to the air interface (Uu port).
  • the SRAN-node3 After the data is sent to the SRAN-node3, the SRAN-node3 decrypts at the PDCP-s layer and Integrity verification; likewise, the gateway node (such as SRAN-node3) obtains the user plane data that needs to be sent to the UE from the S-GW/P-GW of the core network, and before the SRAN-node3 is sent to the air interface (Ub port), Encryption and integrity protection needs to be performed at the PDCP-s layer. After the data is sent to the UE, the UE performs decryption and integrity verification at the PDCP-s layer. That is to say, all user plane data performs end-to-end user plane encryption and user plane integrity protection before the first time entering the air interface transmission, thereby ensuring communication of user plane data in two or more air interfaces. Security when transmitting in a path.
  • the gateway node such as SRAN-node3
  • FIG. 10 is a flowchart of a key generation implementation for implementing user plane access layer security based on the application scenario shown in FIG. 7 according to an embodiment of the present invention.
  • the security key generation method shown in FIG. 10 may be used to generate an implementation in the embodiment of the present invention.
  • Step 1000 Perform an AKA process between the UE and the core network.
  • the security management key K ASME is calculated respectively on the UE and the core network device (such as the HSS).
  • Step 1001 Perform a NAS layer security procedure (NAS SMC) between the UE and the core network device (such as the MME).
  • NAS SMC NAS layer security procedure
  • the NAS layer and the MME respectively generate a NAS layer security key, that is, a NAS layer integrity key.
  • K NAS int and NAS layer security key K NAS enc are NAS layer security keys.
  • the MME calculates the root key K eNB of the AS layer based on the KASME generated by the AKA and the uplink NAS COUNT generated in the NAS SMC.
  • Step 1002 The MME sends the security information of the UE to the gateway node in the UE communication path, such as SRAN-node3 in FIG.
  • the security information of the UE that is sent by the MME to the SRAN-node 3 includes the root key K eNB of the AS layer and the UE security capability of the UE; wherein the UE security capability includes an integrity protection algorithm supported by the UE and The encryption algorithm supported by the UE.
  • Step 1003 SRAN-node3 selects a security algorithm to generate an end-to-end user plane security key, that is, a user plane integrity key K UPint and a user plane security key K UPenc .
  • the SRAN-node3 selects an integrity protection algorithm and an encryption algorithm supported by the UE and the UE from the UE security capability, and derives the user plane integrity key K UPint and the user plane from the root key K eNB of the AS layer. Security key K UPenc .
  • the specific key derivation algorithm is completely consistent with the method in the LTE related art, and is a well-known technology of the person skilled in the art, and is not intended to limit the scope of protection of the present application, and details are not described herein again.
  • Step 1104 The SRAN-node3 initiates an E2E access layer security mode command to the UE, and the E2E access layer security mode command carries the SRAN-node3 locally derived user plane integrity key K UPint and the user plane security key K.
  • the access layer user plane integrity protection algorithm and the access layer user plane encryption algorithm used in UPenc are used in UPenc .
  • the E2E access layer security mode command sent by the SRAN-node3 to the UE is sent to the UE through the SRAN-node2 and the SRAN-node1.
  • Step 1005 UE generates the security key end user plane security key K UPenc i.e., the integrity key K UPint user plane and a user plane.
  • the UE In this step, the UE generates the root key K eNB of the AS layer by using the security management key K ASME generated by the AKA process and the uplink NAS COUNT generated by the NAS layer security process, according to the E2E access layer security mode from the SRAN-node3.
  • the access layer user plane integrity protection algorithm and the access layer user plane encryption algorithm carried in the command derive the user plane integrity key K UPint and the user plane security key K UPenc .
  • Step 1006 The UE sends an E2E access layer security mode complete message to the SRAN-node 3 via the SRAN-node1 and the SRAN-node2.
  • the end-to-end user plane access layer security key is generated between the UE and the gateway node, namely the user plane integrity key K UPint and the user plane security key K UPenc , and the UE and the gateway node can execute the end The end user plane access layer security operation.
  • 11 is a control plane access layer security protocol architecture based on the application scenario shown in FIG. 7 according to an embodiment of the present invention, and performing end-to-end control plane access layer security between an UE and an initial access node (such as SRAN-node1) (E2E CP)
  • E2E CP initial access node
  • the security process performs an end-to-end control plane access layer security procedure between the PDCP protocol layer of the UE and the PDCP protocol layer of the SRAN-node1.
  • the UE and the SRAN-node1 are at both ends of the E2E CP security, and include protocol layers such as L1, MAC, RLC, and PDCP from bottom to top.
  • protocol layers such as L1, MAC, RLC, and PDCP from bottom to top.
  • the gateway node when performing the end-to-end control plane access layer security process between the UE and the initial access node (such as SRAN-node1), other access network nodes in the UE communication path, including intermediate routing nodes and The gateway node does not participate in the security operation of the access layer control plane. Therefore, as shown in Figure 11, As shown, on other access network nodes of the UE communication path, that is, on intermediate routing nodes such as SRAN-node2, on the gateway nodes such as SRAN-node3, the security functions in the PDCP protocol layer need not be implemented.
  • SRAN-node1, SRAN-node2, and SRAN-node3 respectively include from bottom to top on each wireless backhaul link interface of the communication.
  • the protocol layer of L1, MAC, RLC, etc. optionally, may also include a PDCP-t protocol layer. Specifically:
  • the SRAN-node1 and the SRAN-node2 respectively include protocol layers such as L1, MAC, and RLC from bottom to top on the Ub1 interface side, and optionally, may also include PDCP-t protocol layer;
  • protocol layers such as L1, MAC, and RLC from bottom to top on the Ub1 interface side, and optionally, may also include PDCP-t protocol layer;
  • SRAN-node2 and SRAN-node3 respectively include protocol layers such as L1, MAC, RLC, etc. from bottom to top on the Ub2 interface side, and optionally, may also include PDCP-t protocol layer.
  • protocol layers such as L1, MAC, RLC, etc. from bottom to top on the Ub2 interface side, and optionally, may also include PDCP-t protocol layer.
  • the end-to-end control plane access layer security process between the UE and the initial access node includes: performing end-to-end between the UE and SRAN-node1.
  • Control plane encryption and control plane integrity protection As shown in FIG. 11, the uplink RRC layer signaling of the UE needs to perform encryption and integrity protection at the PDCP layer before being transmitted to the air interface (Uu interface), and the SRAN-node1 performs decryption and integrity after receiving the RRC signaling.
  • SRAN-node1 is the initial access node of the UE, and the downlink RRC layer signaling sent to the UE needs to perform encryption and integrity protection at the PDCP layer before being sent to the Uu interface.
  • the UE After receiving the RRC signaling, the UE receives the RRC signaling. The decryption and integrity verification are performed, and thus, the security of the RRC control signaling in the air interface transmission is ensured.
  • FIG. 12 is a first implementation flowchart of key generation for implementing control plane access layer security based on the application scenario shown in FIG. 7 according to the embodiment of the present invention
  • FIG. 12 is a schematic diagram of a UE and an initial access node according to an embodiment of the present invention.
  • the end-to-end control plane access layer security key generation method can generate the end-to-end control plane encryption between the execution UE and the initial access node in the embodiment of the present invention by using the security key generation method shown in FIG.
  • Control plane integrity key K RRCenc and control plane integrity protection key K RRCint required for control plane integrity protection.
  • the above process includes:
  • Step 1200 Perform an AKA process between the UE and the core network. After performing the AKA process, the security management key K ASME is calculated respectively on the UE and the core network device (such as the HSS).
  • Step 1201 Perform a NAS layer security procedure (NAS SMC) between the UE and the core network device (such as the MME).
  • NAS SMC NAS layer security procedure
  • the NAS layer and the MME respectively generate a NAS layer security key, that is, a NAS layer integrity key.
  • K NAS int and NAS layer security key K NAS enc are NAS layer security keys.
  • the MME calculates the root key K eNB of the AS layer based on the KASME generated by the AKA and the uplink NAS COUNT generated in the NAS SMC.
  • Step 1202 The MME sends the security information of the UE to the gateway node in the UE communication path, such as SRAN-node3 in FIG. 7.
  • the security information of the UE includes the security capabilities of the root key K eNB of the AS layer and the UE. The specific implementation of this step is completely consistent with the step 1002 in FIG. 10, and details are not described herein again.
  • the MME may further send the security capability information of the SRAN-node1 to the gateway node.
  • the SRAN-node security capability information includes an access layer control plane integrity protection algorithm supported by SRAN-node1 and an access layer control plane encryption algorithm.
  • Step 1203 The SRAN-node3 requests the initial access node (such as SRAN-node1 in Figure 7) that the UE accesses the security capability information supported by the SRAN-node1, including the access layer control plane integrity protection algorithm and access. Layer control plane encryption algorithm.
  • the initial access node such as SRAN-node1 in Figure 7
  • the UE accesses the security capability information supported by the SRAN-node1, including the access layer control plane integrity protection algorithm and access. Layer control plane encryption algorithm.
  • the SRAN-node 3 requests the SRAN-node 1 to control the message of the plane security algorithm, and the message that the SRAN-node 1 sends the control plane security algorithm to the SRAN-node 3 is sent to the other party via the SRAN-node 2.
  • the specific implementation of the message may be such that the existing message or the new message may be used.
  • the specific implementation is easy to implement by a person skilled in the art, and is not limited thereto, nor is it used to limit the scope of protection of the present application. Let me repeat.
  • this step may be omitted.
  • Step 1204 SRAN-node3 generates a control plane security key, that is, a security key K RRCenc of the control plane and an integrity key K RRCint of the control plane.
  • the SRAN-node3 selects the access plane control layer security algorithm supported by the two parties from the UE security capability and the SRAN-node1 security capability, that is, selects the control plane integrity protection algorithm and the control plane encryption algorithm jointly supported by the two parties, and then
  • the security key K RRCenc of the control plane and the integrity key K RRCint of the control plane are derived from the root key K eNB of the AS layer.
  • Step 1205 SRAN-node3 notifies the SRAN-node1 control plane security key, and the notification content includes: a security key K RRCenc of the control plane, an integrity key K RRCint of the control plane, an access layer control plane integrity protection algorithm, and Access layer control plane encryption algorithm.
  • the notification message is sent to SRAN-node1 via SRAN-node2.
  • Step 1206 SRAN-node1 sends an access layer security mode command to the UE, and carries the access layer control plane integrity used by the SRAN-node3 derived control plane key received by SRAN-node1 in the access layer security mode command. Protection algorithm and access layer control plane encryption algorithm.
  • Step 1207 The UE generates a control plane security key, that is, a security key K RRCenc of the control plane, and an integrity key K RRCint of the control plane.
  • the UE utilizes the security management key K ASME generated by the AKA process, and the root key K eNB of the AS layer generated by the uplink NAS COUNT generated by the NAS layer security process, and the received access layer control plane security algorithm ( That is, the access layer control plane integrity protection algorithm and the access layer control plane encryption algorithm derive the security key K RRCenc of the control plane and the integrity key K RRCint of the control plane.
  • Step 1208 The UE sends an access layer security mode complete message to the SRAN-node1.
  • the end-to-end control plane access layer security key is generated between the UE and the initial access node, ie the control plane security key K RRCenc , the control plane integrity key K RRCint , the UE and the initial access node End-to-end control plane access layer security operations can be performed.
  • FIG. 13 is a flowchart of a second implementation of key generation for implementing control plane access layer security based on the application scenario shown in FIG. 7 according to the embodiment of the present invention.
  • the security key generation method shown in FIG. 13 can be used in the embodiment of the present invention.
  • the control plane encryption key K RRCenc and the control plane integrity protection key K RRCint required for end-to-end control plane encryption and control plane integrity protection between the UE and the initial access node are performed. As shown in FIG. 13, the above process includes:
  • Steps 1300 to 1302 are completely consistent with steps 1200 to 1202 in FIG. 12, where No longer.
  • Step 1303 After the SRAN-node3 receives the security information of the UE, the downlink absolute carrier frequency (EARFCN-DL, E-UTRA Absolute Radio Frequency Channel Number) and the physical cell identifier (PCI) of the SRAN-node1 cell accessed by the UE (Phisical Cell Identity) and the received root key K eNB of the AS layer, which derives the access layer control plane root key K eNB* .
  • EFCN-DL E-UTRA Absolute Radio Frequency Channel Number
  • PCI physical cell identifier
  • Step 1304 SRAN-node3 sends the derived control plane security root key K eNB* to SRAN-node1.
  • the SRAN-node3 also sends the UE security capability to the SRAN-node1.
  • Step 1305 SRAN-node1 selects an access layer control plane integrity protection algorithm, an access layer control plane encryption algorithm, and derives a control plane security key, ie, a control plane security key K RRCenc and a control plane, by K eNB* Integrity key K RRCint .
  • the related key derivation algorithm in this step is consistent with the control plane key derivation algorithm in the LTE related technology, and is not intended to limit the scope of protection of the present application, and details are not described herein again.
  • Step 1306 The SRAN-node1 sends an access layer security mode command to the UE, and the access layer control plane integrity protection algorithm selected when the SRAN-node1 derives the access layer control plane key in the access layer security mode command And access layer control plane encryption algorithm.
  • Step 1307 The UE generates a control plane security key, that is, a security key K RRCenc of the control plane, and an integrity key K RRCint of the control plane.
  • the UE uses the security management key K ASME generated by the AKA process and the root key K eNB of the AS layer generated by the uplink NAS COUNT generated by the NAS layer security process; then, the UE reuses the root key of the AS layer.
  • the K eNB the EARFCN-DL and the PCI of the SRAN-node1 cell accessed by the UE, derives the access layer control plane root key K eNB* ; finally, the UE uses the K eNB* to use the received in step 1306.
  • the intrusion control plane integrity protection algorithm and the access layer control plane encryption algorithm derive the control plane security key, that is, the control plane security key K RRCenc and the control plane integrity key K RRCint .
  • Step 1308 The UE sends an access layer security mode complete message to the SRAN-node1.
  • the end-to-end control plane access layer security key is generated between the UE and the initial access node, ie the control plane security key K RRCenc , the control plane integrity key K RRCint , the UE and the initial access node End-to-end controllable access layer security operations can be performed between.
  • the key generation process of FIG. 10, FIG. 12, and FIG. 13 and the corresponding description can be seen.
  • FIG. 7 in the key generation process of the embodiment of the present invention, after the AKA and NAS layer security processes are generated, The process of the user-side end-to-end access layer security key and the generation of the control plane end-to-end access layer security key can be performed independently. Therefore, in the embodiment of the present invention, when the user faces the end-to-end access layer security key When the end-to-end access layer security key needs to be updated, it can be updated independently.
  • the gateway node (such as SRAN-node3) can initiate an independent user plane to the end.
  • the end access layer security key update process keeps the end-to-end control plane access layer security key between the UE and the initial access node unchanged.
  • the behavior of the gateway node (such as SRAN-node3) initiating the end-to-end access layer security key update of the user plane may be that the gateway node (such as SRAN-node3) is based on the EARFCN of the K eNB and the cell on the gateway node.
  • PCI generates a new K eNB** , after which the gateway node (such as SRAN-node3) generates a new user plane access layer security secret according to the method of step 1003 to step 1006 in FIG. 10 based on the K eNB** .
  • the gateway node (such as SRAN-node3) will generate a new K eNB* in addition to notifying the selected access layer integrity protection algorithm and the access layer encryption algorithm to the UE.
  • the UE generates a new user plane access layer security key based on the received K eNB** , access layer integrity protection algorithm and access layer encryption algorithm.
  • the user plane performs the end-to-end access layer security between the gateway nodes in the communication path between the UE and the UE, and the control plane performs the UE and the The end-to-end access layer security between the initial access nodes accessed by the UE in the communication path of the UE.
  • the method for implementing access layer security based on the application scenario shown in FIG. 7 is performed by the embodiment of the present invention. On the one hand, no matter how many air interfaces pass through the communication path of the UE, that is, how many intermediate routes pass through the communication path of the UE.
  • user plane security is only performed end-to-end between the UE and the gateway node, which ensures the security of the user plane and avoids the security leakage caused by multiple intermediate air interfaces, that is, through multiple intermediate routing nodes; Face security is only performed end-to-end between the UE and the initial access node, which reduces the delay of the security operation of the control plane while ensuring the security of the control plane.
  • the user plane security is only between the UE and the gateway node. End-to-end execution, making When the UE moves between different SRAN-node nodes, as long as the communication path of the UE is connected to the core network through the same gateway node, the user plane security is unchanged, thereby improving the mobile performance of the UE.
  • user plane security is only performed end-to-end between the UE and the gateway node, and also causes no change in the user plane security regardless of how the intermediate node in the communication path of the UE changes, thereby ensuring UE user plane data transmission. Continuity.
  • FIG. 14 is a schematic diagram of a user plane access layer security protocol based on another application scenario shown in FIG. 8 according to an embodiment of the present invention.
  • the user plane performs end-to-end access layer security between the UE and the gateway node in the micro-communication path of the UE, that is, the PDCP-s protocol layer and the gateway node of the UE (as shown in FIG. 8).
  • the end-to-end user plane access layer security procedure is implemented between the PDCP-s protocol layers of SRAN-node3).
  • the UE and the SRAN-node3 are both ends of the E2E UP security, and include L1, MAC, RLC, PDCP-t, and PDCP-s from bottom to top.
  • Security operations include performing end-to-end user plane encryption and user plane integrity protection between the UE and the gateway node SRAN-node3.
  • FIG. 15 is a schematic diagram of a control plane access layer security protocol based on another application scenario shown in FIG. 8 according to an embodiment of the present invention.
  • the control plane performs end-to-end access layer security between the macro base station in the macro communication path between the UE and the UE, that is, performs end-to-end between the PDCP protocol layer of the UE and the PDCP protocol layer of the macro base station.
  • the end control plane access layer is secure.
  • the UE and the MNB are at the two ends of the E2E CP security, and include protocol layers such as L1, MAC, RLC, and PDCP from bottom to top.
  • Security operations include performing end-to-end control plane encryption and control plane integrity protection between the UE and the macro base station.
  • FIG. 16 is a flowchart of a key generation implementation for implementing user plane access layer security and control plane access layer security according to another application scenario shown in FIG. 8 according to an embodiment of the present invention.
  • a method for generating an access layer security security key that separates the control plane from the user plane in the dual connectivity scenario shown in FIG. 8 is shown.
  • the user plane encryption key K required for performing end-to-end access layer security between the gateway nodes in the micro communication path of the UE and the UE in the embodiment of the present invention can be generated.
  • the above process includes:
  • Steps 1600 to 1601 are completely consistent with steps 1000 to 1001, and are not described herein again.
  • Step 1602 The MME sends the security information of the UE to the MNB.
  • the MME calculates the root key K of the AS layer based on the KASME generated by the AKA and the uplink NAS COUNT generated in the NAS SMC. eNB .
  • the security information of the UE sent by the MME to the MNB includes the root key K eNB of the AS layer and the UE security capability of the UE; wherein the UE security capability includes the integrity protection algorithm supported by the UE and supported by the UE. Encryption algorithm.
  • Step 1603 The MNB selects a security algorithm, and the root key K eNB of the AS layer derives a control plane security key, that is, a security key K RRCenc of the control plane and an integrity key K RRCint of the control plane; or, the MNB selects a security algorithm. Deriving the control plane and user plane security key, ie the control plane security key K RRCenc and the control plane integrity key K RRCint , and the user plane integrity key K UPint and the root key K eNB of the AS layer User side security key K UPenc .
  • the MNB selects an integrity protection algorithm and an encryption algorithm supported by both the UE and the MNB from the UE security capability, and the access layer key is derived by the root key K eNB of the AS layer.
  • the specific key derivation algorithm is completely consistent with the method in the LTE related technology, and the specific implementation is not limited to the scope of protection of the present application, and details are not described herein again.
  • Step 1604 The MNB notifies the gateway node of the user plane security key to SRAN-node3 in FIG.
  • step 1603 If the MNB derives the user plane integrity key K UPint and the user plane security key K UPenc in step 1603, then in this step, the MNB will derive the user plane integrity key K UPint and the user plane security secret. Key K UPenc is sent to SRAN-node3.
  • step 1603 the user plane MNB not derived security key
  • the MNB layer AS root key K eNB, and the security algorithm selected in step 1603 is sent to SRAN-node3.
  • the embodiment of the present invention further includes a step 1604-1.
  • step 1604-1 the SRAN-node 3 derives the user plane security key by using the root key K eNB and the access layer security algorithm of the AS layer.
  • User face integrity key K UPint and user plane security key K UPenc is sent to SRAN-node3.
  • Step 1605 The MNB initiates an access layer security mode command to the UE, and is in the access layer security mode.
  • the access carries the access layer integrity protection algorithm and the access layer encryption algorithm selected by the MNB in step 1603.
  • Step 1606 The UE generates an end-to-end user plane security key, that is, a user plane integrity key K UPint and a user plane security key K UPenc , and an end-to-end control plane security key, that is, a control plane security key K RRCenc And control plane integrity key K RRCint .
  • the UE uses the security management key K ASME generated by the AKA process and the root key K eNB of the AS layer generated by the uplink NAS COUNT generated by the NAS layer security process, and the received security algorithm to derive the above security key.
  • the end-to-end user plane security key is the user plane integrity key K UPint and the user plane security key K UPenc
  • the end-to-end control plane security key ie the control plane security key K RRCenc and the control plane integrity Sex key K RRCint .
  • Step 1607 The UE sends an access layer security mode complete message to the MNB.
  • the end-to-end user plane access layer security key is generated between the UE and the gateway node, that is, the user plane integrity key K UPint and the user plane security key K UPenc , and the end point is generated between the UE and the MNB.
  • the security key of the access control layer security layer is the security key K RRCenc of the control plane and the integrity key K RRCint of the control plane.
  • the UE and the MNB can perform end-to-end user interface respectively between the UE and the MNB. Intrusion security operations and end-to-end control plane access layer security operations.
  • the user plane performs end-to-end access layer security between the gateway nodes in the micro-communication path of the UE and the UE, and the control plane performs the macro base station in the macro communication path between the UE and the UE.
  • End-to-end access layer security a flexible key update process in which the user plane and the control plane are independent of each other, for example, PDCP on a radio bearer (RB, Radio Bear) of the user plane in the micro-communication path
  • PDCP COUNT the count value
  • the MME generates two ASs.
  • the layer root keys are respectively the user plane security root key K eNB-U and the control plane security root key K eNB-C , and the generated user plane security root key K eNB-U and control are generated in step 1602
  • the face security root key K eNB-C is sent to the MNB. Thereafter, in steps 1603, 1604-1 and 1606 of FIG. 16, the MNB, the SRAN-node3, and the UE generate the user plane security key K based on the K eNB-U , respectively.
  • UPint, user plane integrity key K UPenc, based on K eNB-C generates a control plane security Key K RRCint, controlling the integrity key K RRCenc surface.
  • the specific update process may be, the gateway node (eg, SRAN-node3) generates a new K eNB-U** based on the EARFCN-DL and PCI of the K eNB-U and the cell on the gateway node, after which the gateway node (such as SRAN-node3) is based on the K eNB-U**
  • a new user plane access layer security key is generated by the method of step 1604-1 in FIG.
  • the gateway node after generating K eNB-U **, the K eNB-U ** notifies the MNB, the MNB received, in step 1605 the K eNB-U ** notifies the UE, UE A new user plane access layer security key is generated based on the K eNB-U** in step 1606.
  • the UE has both the macro communication path and the micro communication path in the dual connectivity scenario, and the user plane performs the end between the gateway node in the micro communication path between the UE and the UE.
  • the access layer is secure, and the control plane performs end-to-end access layer security between the macro base stations in the macro communication path between the UE and the UE.
  • the method for implementing access layer security based on the application scenario shown in FIG. 8 is performed by the embodiment of the present invention.
  • the user plane security is only performed end-to-end between the UE and the gateway node, which ensures the security of the user plane well, and avoids the security leakage risk caused by the multiple air interface, that is, the multiple intermediate routing nodes;
  • the control plane security is only performed end-to-end between the UE and the macro base station, which reduces the delay of the security operation of the control plane under the premise of ensuring the security of the control plane; on the other hand, the user plane security is only between the UE and the gateway node.
  • End-to-end execution so that when the UE moves between different SRAN-node nodes, as long as the communication path of the UE is connected to the core network through the same gateway node, the user plane security is unchanged, thereby improving the UE. Mobile performance.
  • user plane security is only performed end-to-end between the UE and the gateway node, and also causes no change in the user plane security regardless of how the intermediate node in the micro-communication path of the UE changes, thereby ensuring UE user plane data. The continuity of the transmission.
  • Each small node in the embodiment of the present invention has its own Universal Integrated Circuit Card (UICC), and a node is established between the small node and its UICC card.
  • UICC Universal Integrated Circuit Card
  • the secure channel of the UICC interface through which the two-party authentication is performed between the small node and the network, ensuring the legitimacy of the small node.
  • FIG. 17 illustrates the step-by-step node security verification process, still taking the small node in the communication path of the UE shown in FIG. 7 as an example, and the intermediate routing node such as SRAN-node2 is connected to the gateway node.
  • FIG. 17 is a flowchart of an embodiment of implementing step-by-step security verification according to an embodiment of the present invention. As shown in Figure 17, the above process includes:
  • Step 1700 Security verification of the gateway node such as SRAN-node3.
  • the security authentication of the gateway node can be verified by means of IP security through a wired interface.
  • the specific implementations are well known to those skilled in the art, and are not intended to limit the scope of protection of the present application, and are not described herein again.
  • Step 1701 Security verification of the intermediate routing node such as SRAN-node2.
  • the gateway node such as SRAN-node3 is equivalent to the base station (eNB) to which SRAN-node2 is connected, and for the gateway node, for example For SRAN-ndoe3, an intermediate routing node such as SRAN-node2 is equivalent to accessing one UE under it. Therefore, for the security verification of the intermediate routing node, the UE security verification method in the related LTE technology shown in FIG. 4 is performed, and the AKA process including step 1701-1, the NAS SMC of 1701-2, the AS SMC of 1701-3, and the like are performed. Three operations can be, specifically,
  • the intermediate routing node acts as a small node and has its UICC card.
  • the USIM on the UICC card stores a secure root key K.
  • the same security root key K is stored in the HSS on the network side.
  • the root key taking the method shown in Figure 4, can implement secure authentication between the MME and SRAN-node2, then perform the NAS SMC procedure between the MME and the SRAN-node2, and at the SRAN-node2 and the gateway node such as SRAN-
  • the AS SMC process is performed between node 3.
  • an Ub interface access layer control plane for protecting the information transmission security between the two nodes on the Ub2 interface may be generated.
  • Security key ie K-Ub2 RRC int , K-Ub2 RRC enc
  • user plane security key ie K-Ub2 UP int , K-Ub2 UP enc
  • Step 1702 Security verification of the initial access node.
  • step 1701 similar to the UE, in the communication path as shown in FIG. 7, for the initial access node such as SRAN-node1, the intermediate routing node such as SRAN-node2 is equivalent to the base station to which SRAN-node1 is connected ( eNB), and for an intermediate routing node such as SRAN-node2, the initial access node SRAN-node1 is equivalent to one UE under it. Therefore, for the security verification of the initial access node, the UE security verification method in the related LTE technology shown in FIG. 4 is also used, and the AKA process including step 1702-1, the NAS SMC of 1702-2, and the AS of 1702-3 are performed. SMC and other three operations can be, specifically,
  • the initial access node acts as a small node and has its UICC card.
  • the USIM on the UICC card stores a secure root key K.
  • the same secure root key K is stored in the HSS on the network side.
  • This root key taking the method shown in FIG. 4, can implement secure authentication between the MME and the SRAN-node 1, and then perform a NAS SMC procedure between the MME and the SRAN-node 1, as well as in the SRAN-node 1 and the intermediate routing node.
  • the AS SMC process is performed between SRAN-node2.
  • an Ub interface access layer control plane for protecting the information transmission security between the two nodes on the Ub1 interface may be generated.
  • Security key ie K-Ub1 RRC int , K-Ub1 RRC enc
  • user plane security key ie K-Ub1 UP int , K-Ub1 UP enc
  • the present invention is implemented, for example, as shown in FIG.
  • the E2E access layer security mode command of step 1004 and the E2E access layer security mode of step 1006 are completed, such as the message of step 1203, the message of step 1205, and the message of step 1304 as shown in FIG.
  • These access layer security related messages can be encrypted and integrity protected by using the security keys of the Ub port access layer control plane of the Ub2 port and the Ub1 port respectively when transmitting via SRAN-node2 or SRAN-node1.
  • FIG. 18 is a schematic structural diagram of a structure of a UE according to an embodiment of the present invention. As shown in FIG. 18, the method includes at least a first processing module, a first user plane processing module, and a first control plane processing module.
  • the first processing module is configured to: implement an AKA process and a NAS layer security process with the core network;
  • the first user plane processing module is configured to: perform an end-to-end user plane access layer security process with the gateway node;
  • the first control plane processing module is configured to perform end-to-end control plane access layer security between the UE and the initial access node when the UE only has a micro communication path; or, when the UE has a micro communication path and a macro communication path Performing end-to-end control plane access layer security between the UE and the macro base station in the macro communication path;
  • the micro communication path is a communication path in which the UE accesses the wireless access small node and finally accesses the core network through the wireless access link;
  • the macro communication path is that the UE accesses the macro base station through the wireless access link and finally accesses the core network. Communication path.
  • the first user plane processing module is configured to: perform end-to-end user plane encryption and user plane integrity protection with the gateway node;
  • the first control plane processing module is configured to perform end-to-end control plane encryption and control plane integrity protection with the initial access node or macro base station.
  • the UE communicates with the core network through at least two wireless air interfaces; wherein the micro-communication path includes at least a UE, an initial access node, and a gateway node;
  • the micro communication path further includes at least one intermediate routing node.
  • the initial access node is a wireless access small node that the UE accesses through the wireless access link;
  • the gateway node is a wireless access small node capable of accessing the core network through a wired interface
  • the intermediate routing node is a wireless access small node that implements communication between the initial access node and the gateway node, and finally implements communication between the UE accessing the initial access node and the core network to provide relay transmission.
  • the first user plane processing module is configured to perform an end-to-end user plane access layer security procedure between the PDCP-s layer of the UE and the PDCP-s layer of the gateway node.
  • encryption and integrity protection are performed at the PDCP-s layer of the UE, and after the user plane data is sent to the gateway node, the gateway node decrypts at the PDCP-s layer and Integrity verification; the gateway node obtains the user plane data that needs to be sent to the UE from the core network, performs encryption and integrity protection on the PDCP-s layer of the gateway node before sending to the air interface, and after the data is sent to the UE, the UE Decryption and integrity verification at the PDCP-s layer.
  • the first control plane processing module is configured to perform end-to-end control with the initial access node or the macro base station between the PDCP protocol layer of the UE and the PDCP protocol layer of the initial access node or the macro base station. Face access layer security process.
  • the uplink RRC layer signaling of the UE performs encryption and integrity protection at the PDCP layer of the UE before being sent to the air interface, and the initial access node or the macro base station performs decryption and integrity verification after receiving the RRC signaling.
  • the downlink RRC layer signaling sent by the initial access node or the macro base station to the UE performs encryption and integrity protection at its PDCP layer before being sent to the air interface, and after receiving the RRC signaling, the UE performs decryption and integrity verification.
  • FIG. 19 is a schematic structural diagram of a structure of a wireless access small node according to an embodiment of the present invention.
  • the wireless access small node is a wireless access small node capable of accessing the core network through a wired interface; as shown in FIG.
  • the wireless access small node includes at least a second user plane processing module, configured to: perform an end-to-end user plane access layer security process with the UE; wherein the end-to-end user plane access layer security process includes an end-to-end End user face encryption and user face integrity protection.
  • the wireless access small node communicates with the initial access node through a wireless backhaul interface
  • the wireless access small node communicates with the intermediate routing node through the wireless backhaul interface, and the intermediate routing node communicates with the initial access node through the wireless backhaul interface, when the intermediate routing node is two When two or more, the intermediate routing nodes communicate through the wireless backhaul interface;
  • the initial access node is a wireless access small node that the UE accesses through the wireless access link;
  • the intermediate routing node implements communication between the initial access node and the wireless access small node, and most The communication between the UE that accesses the initial access node and the core network finally provides a wireless access small node for relay transmission.
  • the end-to-end user plane access layer security process is performed between the PDCP-s layer of the radio access small node itself and the PDCP-s of the UE.
  • the second user plane processing module is set to:
  • the user plane data that needs to be sent to the UE is obtained from the core network, and encryption and integrity protection is performed at its PDCP-s layer before being sent to the air interface.
  • the wireless access small node further includes a user plane key generation module, and is configured to:
  • the user plane key generation module is set to:
  • the K eNB is sent by the core network or the macro base station to the wireless access small node;
  • the macro base station is another base station that the UE accesses through the radio access link in addition to the initial access node.
  • the wireless access small node is a wireless access small node that the UE accesses through the wireless access link; as shown in FIG.
  • the wireless access small node includes at least a second control plane processing module, configured to: perform an end-to-end control plane access layer security process with the UE; wherein the end-to-end control plane access layer security process includes end-to-end control Face encryption and control plane integrity protection.
  • the end-to-end control plane access layer security process is performed between the PDCP layer of the radio access small node itself and the PDCP layer of the UE.
  • the second control plane processing module is configured to: after receiving the RRC signaling, perform decryption and integrity verification; after performing encryption and integrity protection on the downlink RRC layer signaling sent by the PDCP layer to the UE Send to the air interface.
  • the wireless access small node further includes a control plane key generation module, and is configured to:
  • a control plane encryption key K required to perform end-to-end control plane encryption and control plane integrity protection is generated before the second control plane processing module performs end-to-end control plane encryption and control plane integrity protection with the UE RRCenc and Control Plane Integrity Protection Key K RRCint .
  • control plane key generation module is set to:
  • the wireless access small node of the embodiment of the present invention further includes a second processing module, configured to: perform stepwise node security verification; wherein the stepwise node security verification includes: the network performs wireless access to the small node. safety verification.
  • the second processing module is further configured to: perform encryption and integrity protection on the access layer security related message.
  • an embodiment of the present invention further provides a UE, including a processor and a memory, where the processor stores instructions executable by the processor, and when the instruction is executed by the processor, performs the function of the module shown in FIG. 18.
  • an embodiment of the present invention further provides a wireless access small node, including a processor and a memory, where the processor stores instructions executable by the processor, and when the instruction is executed by the processor, performs the function of the module shown in FIG.
  • an embodiment of the present invention further provides a computer readable storage medium storing computer executable instructions, where the computer executable instructions are implemented to implement the foregoing method for implementing access layer security.
  • the instructions are related to hardware (eg, a processor) that can be stored in a computer readable storage medium, such as a read only memory, a magnetic disk, or an optical disk.
  • a computer readable storage medium such as a read only memory, a magnetic disk, or an optical disk.
  • all or part of the steps of the above embodiments may also be implemented using one or more integrated circuits.
  • each module/unit in the above embodiment may be implemented in the form of hardware, for example, by implementing an integrated circuit to implement its corresponding function, or may be implemented in the form of a software function module, for example, executing a program stored in the memory by a processor. / instruction to achieve its corresponding function.
  • This application is not limited to any specific combination of hardware and software.
  • the embodiment of the invention provides a method for implementing access layer security, a user equipment, and a wireless access small node, which ensures the security of the user plane well, and avoids the result of multiple intermediate air routing interfaces, that is, multiple intermediate routing nodes.
  • the safety leakage is hidden; the delay of the safe operation of the control plane is reduced under the premise of ensuring the safety of the control plane; the mobile performance of the UE is improved; and the continuity of the data transmission of the UE user plane is guaranteed.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

一种实现接入层安全的方法，包括：执行UE与网关节点之间的端到端用户面接入层安全；以及，当UE仅存在微通信路径时，执行UE与初始接入节点之间的端到端控制面接入层安全；或者，当UE存在微通信路径和宏通信路径时，执行UE与宏通信路径中的宏基站之间的端到端控制面接入层安全；其中，微通信路径为UE通过无线接入链路接入无线接入小节点最终接入核心网的通信路径；宏通信路径为UE通过无线接入链路接入宏基站最终接入核心网的通信路径。上述方法很好地保证了用户面安全；在保证控制面安全的前提下减少了控制面安全操作的延时；同时，提高了UE的移动性能，保证了UE用户面数据传输的连续性。

Description

实现接入层安全的方法及用户设备和无线接入小节点 技术领域
本申请涉及但不限于移动通信技术，尤指一种实现接入层安全的方法及用户设备和无线接入小节点。
背景技术
蜂窝无线移动通信系统始于20世纪80年代，从一开始满足人类的语音通信需求发展到了后来在语音业务的基础上逐步满足人类的基础数据通信需求。传统蜂窝无线通信系统由无线网络运营商部署并运营，网络的建设经过运营商的缜密规划，图1为传统蜂窝无线接入网络的网络拓扑示意图，如图1所示，每个宏基站(MNB，Macro(e)NB)的选址由运营商规划确定，每个宏基站可以达到几百米甚至几千米的无线覆盖，从而可以实现运营商运营区域内的近乎连续无缝覆盖。
随着移动互联时代的到来，新的移动应用需求，尤其是那些要求高质量、高速率、低延时的移动应用需求出现了爆发式的增长。根据行业预测，一方面，在未来10年内，无线移动业务量将出现上千倍的增长，传统实现长距离宏覆盖的无线通信系统无法实现如此巨大的容量需求；另一方面，业界通过对用户通信行为和习惯的统计发现，大部分高数据流量的移动业务集中出现在室内环境和热点地区，比如商场、学校、用户家里、大型演出、集会场所等，而室内环境和热点地区具有区域分布广而散、单区域范围小、用户集中等特点，也就是说，传统蜂窝无线网络的广覆盖、均匀覆盖、固定覆盖特点使得其无法很好地适应这种小区域范围内业务集中出现的特性。此外，传统蜂窝无线网络由于各种各样的原因，比如建筑物的阻挡等会造成蜂窝无线信号在室内环境不如室外环境，这也使得传统蜂窝无线网络无法满足将来室内环境下的大数据容量需求。
为了解决上述问题，一种无线接入小节点(SRAN-node，Small Radio Access Network node，本文中可简称为小节点)应运而生。从概念上讲，SRAN-node是指发射功率比传统MNB的发射功率低、覆盖范围也比传统宏 基站的覆盖范围小的无线接入网节点，因此，SRAN-node也可以称为低功率节点(LPN，Lower Power Node)，比如可以是微基站(Pico Node)、家庭基站(Femto/Home(e)NB)、无线中继接入设备(Relay)，以及其他可能出现的任何发射功率远低于传统宏基站的可以通过无线通信链路接入网络的接入网设备。
而为了满足未来无线通信系统的巨大容量提升需求，尤其是为了适应特定区域内的集中式大数据量需求，业界预测可以在特定区域内增加SRAN-node的部署密度以实现网络容量的增长，满足用户需求。业界将这种在特定区域内密集部署的网络称之为超密集网络(UDN，Ultra Dense Network)。图2为在传统蜂窝无线接入网络的特定区域内部署UDN的示意图，如图2所示，在大厦200内、在体育场210内、在热点230区域均部署了大量SRAN-node。
UDN可以提高网络容量，在提高网络容量的同时，未来的网络也不希望增加网络的资本支出(CAPEX，Capital Expenditure)和运营支出(OPEX，Operating Expense)，这就意味着UDN的部署需要减少人为的计划、优化和管理，可以根据网络拓扑、网络负荷、业务需求等在室内、室外的热点区域或者大业务量区域完成灵活快速部署，并实现自配置、自优化和自治愈。为了实现所有这些目标，业界普遍认为UDN中仅有部分或者少量SRAN-node可以通过有线连接(wired backhaul)(如光纤、电缆等)接入核心网设备；而其他SRAN-node则需要支持无线回程(wireless backhaul)，利用SRAN-node之间密集短距离部署的特性，通过SRAN-node之间的无线回程链路实现SRAN-node之间的互联互通，以及通过无线回程链路经过两个SRAN-node之间的无线连接(一跳)或者依次经过多个SRAN-node之间的无线连接(多跳)接入核心网设备。如此，在UDN网络中，用户设备(UE，User Equipment)的通信数据很有可能需要经过两段甚至两段以上的空口传输，两段空口包括UE与UE所接入的SRAN-node(设记为SRAN-node-x)之间的空口无线接入链路(RAL，Radio Access Link)，以及SRAN-node-x与有有线回程的SRAN-node(设记为SRAN-node-z)之间的空口无线回程链路。超过两段空口的情况，以三段空口为例，包括RAL、SRAN-node-x与某 个中间节点(设记为SRAN-node-y)之间的空口无线回程链路，以及SRAN-node-y与SRAN-node-z之间的空口无线回程链路。
未来UDN中将密集部署大量SRAN-node，而其中只有少部分SRAN-node有有线回程，这使得UE的通信数据很有可能需要经过两段甚至两段以上的空口传输，如何保证这种移动通信系统中的安全性，以保证UE的通信数据在两段甚至两段以上空口传输时的安全性，是亟需解决的技术问题，目前没有具体的实现技术方案。
发明内容
以下是对本文详细描述的主题的概述。本概述并非是为了限制权利要求的保护范围。
本发明实施例提供一种实现接入层安全的方法及用户设备和无线接入小节点，能够保证UE的通信数据在两段甚至两段以上空口传输时的安全性，同时提高UE的移动性能，保证UE用户面数据传输的连续性。
本发明实施例提供了一种实现接入层安全的方法，包括：
执行UE与网关节点之间的端到端用户面接入层安全；以及，
当UE仅存在微通信路径时，执行UE与初始接入节点之间的端到端控制面接入层安全；或者，当UE存在微通信路径和宏通信路径时，执行UE与宏通信路径中的宏基站之间的端到端控制面接入层安全；
其中，微通信路径为UE通过无线接入链路接入无线接入小节点最终接入核心网的通信路径；宏通信路径为UE通过无线接入链路接入宏基站最终接入核心网的通信路径。
可选地，
在所述微通信路径中，所述UE经过至少两段无线空中接口与所述核心网通信；
所述微通信路径至少包括UE、初始接入节点、网关节点；
当所述UE经过大于两段无线空中接口与所述核心网通信时，所述微通信路径中还包括至少一个中间路由节点。
可选地，
所述UE与初始接入节点之间采用无线接入空中接口Uu口；
所述初始接入节点与网关节点之间采用无线回程接口Ub口。
可选地，
所述中间路由节点和所述初始接入节点之间采用无线回程接口Ub口，所述中间路由节点和所述网关节点之间采用无线回程接口Ub口；
当所述中间路由节点为两个或两个以上时，所述中间路由节点之间采用无线回程接口Ub口。
可选地，
所述初始接入节点为所述UE通过无线接入链路接入的无线接入小节点；
所述网关节点为能够通过有线接口接入所述核心网的无线接入小节点；
所述中间路由节点为实现所述初始接入节点和网关节点之间的通信，并最终实现接入所述初始接入节点的UE与所述核心网之间的通信提供中继传输的无线接入小节点。
可选地，
所述执行UE与网关节点之间的端到端用户面接入层安全包括：执行所述UE与所述网关节点之间的端到端用户面加密和用户面完整性保护；
所述执行UE与初始接入节点或者宏基站之间的端到端控制面接入层安全包括：执行所述UE与所述初始接入节点或者宏基站之间的端到端控制面加密和控制面完整性保护。
可选地，所述执行UE与网关节点之间的端到端用户面接入层安全包括：在所述UE的数据包汇聚协议安全(PDCP-s)层和所述网关节点的PDCP-s层之间执行所述端到端用户面接入层安全。
可选地，
所述UE和所述网关节点的无线回程接口Ub接口侧从下到上分别包括：物理层(L1)、媒体接入控制层(MAC)、无线链路控制层(RLC)、数据 包汇聚协议瘦身层(PDCP-t)和数据包汇聚协议安全层(PDCP-s)；所述初始接入节点和所述中间路由节点从下到上分别包括L1、MAC和RLC，或者，分别包括L1、MAC、RLC和PDCP-t；
如果所述UE的PDCP-s层和PDCP-t层合并到一个协议层则为PDCP层；
如果所述网关节点的PDCP-s层和PDCP-t层合并到一个协议层则为PDCP层。
可选地，所述执行所述UE与所述网关节点之间的端到端用户面加密和用户面完整性保护包括：
所述UE的上层用户面数据发到空中接口之前，在所述UE的PDCP-s层执行加密和完整性保护，所述用户面数据发送到所述网关节点之后，由所述网关节点在PDCP-s层进行解密和完整性验证；
所述网关节点从核心网获取到需要发送给所述UE的用户面数据，在发到空中接口之前，在所述网关节点的PDCP-s层执行加密和完整性保护，数据发送到所述UE后，由所述UE在PDCP-s层进行解密和完整性验证。
可选地，所述PDCP-s层用于实现：头压缩和解压缩，以及安全操作；其中，安全操作包括：加密、解密、完整性保护和完整性验证。
可选地，所述执行所述UE与所述初始接入节点或者宏基站之间的端到端控制面接入层安全包括：
在所述UE的数据包汇聚协议(PDCP)层和所述初始接入节点或者宏基站的PDCP层之间执行端到端控制面接入层安全。
可选地，
所述UE和所述初始接入节点的无线接入空中接口Uu接口侧从下到上分别包括：L1、MAC、RLC、PDCP层；
所述初始接入节点、所述中间路由节点和所述网关节点在Ub接口侧从下到上分别包括L1、MAC和RLC；或者，包括L1、MAC、RLC和PDCP-t层。
可选地，执行所述UE与所述初始接入节点或者宏基站之间的端到端控制面加密和控制面完整性保护包括：
所述UE的上行无线资源控制(RRC)层信令在发送到空中接口之前，在所述UE的PDCP层执行加密和完整性保护，所述初始接入节点或者宏基站接收到RRC信令后，执行解密和完整性验证；
所述初始接入节点或者宏基站发送给UE的下行RRC层信令在发送到空中接口之前，在其PDCP层执行加密和完整性保护，所述UE接收到RRC信令后，执行解密和完整性验证。
可选地，
该方法还包括：所述UE和所述网关节点之间生成执行所述UE与所述网关节点之间的端到端用户面加密和用户面完整性保护所需要的用户面加密密钥KUPenc和用户面完整性保护密钥KUPint，
当所述UE仅存在微通信路径时，所述UE和所述网关节点之间生成执行所述UE与所述网关节点之间的端到端用户面加密和用户面完整性保护所需要的用户面加密密钥KUPenc和用户面完整性保护密钥KUPint，包括：
所述UE和所述网关节点基于接入层安全根密钥KeNB生成所述用户面加密密钥KUPenc和用户面完整性保护密钥KUPint；
其中，所述UE的KeNB为所述UE与所述核心网之间执行鉴权和密钥协商(AKA)过程和非接入层(NAS)安全过程后生成的；
所述网关节点的KeNB为所述UE与所述核心网之间执行AKA过程和NAS安全过程后，由所述核心网发送给所述网关节点的；
当UE存在微通信路径和宏通信路径时，所述UE和所述网关节点之间生成执行所述UE与所述网关节点之间的端到端用户面加密和用户面完整性保护所需要的用户面加密密钥KUPenc和用户面完整性保护密钥KUPint，包括：
所述UE和所述UE的宏通信路径中的宏基站基于KeNB生成所述用户面加密密钥KUPenc和用户面完整性保护密钥KUPint；所述宏基站将生成的用户面加密密钥KUPenc和用户面完整性保护密钥KUPint发送给所述网关节点；或者，
所述UE和所述网关节点基于KeNB生成执行所述用户面加密密钥KUPenc和用户面完整性保护密钥KUPint；其中，所述网关节点的KeNB由所述宏基站发送给所述网关节点；
其中，所述UE的KeNB为所述UE与所述核心网之间执行AKA过程和NAS安全过程后生成的；
其中，所述宏基站的KeNB为所述UE与所述核心网之间执行AKA过程和NAS安全过程后，由所述核心网发送给所述宏基站的。
可选地，
该方法还包括：当所述UE仅存在微通信路径时，生成执行所述UE与所述初始接入节点之间的端到端控制面加密和控制面完整性保护所需要的控制面加密密钥KRRCenc和控制面完整性保护密钥KRRCint，
其中，所述生成执行所述UE与所述初始接入节点之间的端到端控制面加密和控制面完整性保护所需要的控制面加密密钥KRRCenc和控制面完整性保护密钥KRRCint，包括：
所述UE和所述网关节点基于接入层安全根密钥KeNB生成所述控制面加密密钥KRRCenc和控制面完整性保护密钥KRRCint；所述网关节点将所述生成的控制面加密密钥KRRCenc和控制面完整性保护密钥KRRCint发送给所述初始接入节点；或，所述UE和所述网关节点基于KeNB、所述初始接入节点的小区的下行绝对载频号(EARFCN-DL)和物理小区标识(PCI)生成接入层控制面安全根密钥KeNB*；所述网关节点将生成的KeNB*发送给所述初始接入节点，所述UE和所述初始接入节点基于所述KeNB*生成所述控制面加密密钥KRRCenc和控制面完整性保护密钥KRRCint；
或者，
该方法还包括：当所述UE存在微通信路径和宏通信路径时，生成执行所述UE与所述宏基站之间的端到端控制面加密和控制面完整性保护所需要的控制面加密密钥KRRCenc和控制面完整性保护密钥KRRCint，
其中，所述生成执行所述UE与所述宏基站之间的端到端控制面加密和控制面完整性保护所需要的控制面加密密钥KRRCenc和控制面完整性保护密钥KRRCint，包括：
所述UE和所述宏基站基于接入层安全根密钥KeNB生成所述控制面加密密钥KRRCenc和控制面完整性保护密钥KRRCint；
其中，
所述UE的KeNB为所述UE与所述核心网之间执行AKA过程和NAS安全过程后生成的；
所述网关节点或所述宏基站的KeNB为所述UE与所述核心网之间执行AKA过程和NAS安全过程后，由所述核心网发送给所述网关节点或宏基站的。
可选地，所述用户面的密钥和控制面的密钥分别独立更新。
本发明实施例还提供了一种UE，至少包括第一处理模块、第一用户面处理模块以及第一控制面处理模块；其中，
第一处理模块，设置为：与核心网之间实现AKA过程和NAS安全过程；
第一用户面处理模块，设置为：执行与网关节点之间的端到端用户面接入层安全；
第一控制面处理模块，设置为：当UE仅存在微通信路径时，执行UE与初始接入节点之间的端到端控制面接入层安全；或者，当UE存在微通信路径和宏通信路径时，执行UE与宏通信路径中的宏基站之间的端到端控制面接入层安全；
其中，微通信路径为UE通过无线接入链路接入无线接入小节点最终接入核心网的通信路径；宏通信路径为UE通过无线接入链路接入宏基站最终接入核心网的通信路径。
可选地，
所述第一用户面处理模块是设置为：执行与所述网关节点之间的端到端用户面加密和用户面完整性保护；
所述第一控制面处理模块是设置为：执行与所述初始接入节点或者宏基站之间的端到端控制面加密和控制面完整性保护。
可选地，
在所述UE的微通信路径中，所述UE经过至少两段无线空中接口与所述核心网通信；
所述微通信路径至少包括UE、初始接入节点、网关节点；
当所述UE经过大于两段无线空中接口与所述核心网通信时，所述微通信路径中还包括至少一个中间路由节点。
可选地，
所述初始接入节点为所述UE通过无线接入链路接入的无线接入小节点；
所述网关节点为能够通过有线接口接入所述核心网的无线接入小节点；
所述中间路由节点为实现所述初始接入节点和网关节点之间的通信，并最终实现接入所述初始接入节点的UE与所述核心网之间的通信提供中继传输的无线接入小节点。
可选地，
所述第一用户面处理模块是设置为：在所述UE的PDCP-s层和所述网关节点的PDCP-s层之间执行所述UE与网关节点之间的端到端用户面接入层安全；
所述第一控制面处理模块是设置为：在所述UE的PDCP协议层和所述初始接入节点或者宏基站的PDCP协议层之间执行所述UE与所述初始接入节点或者宏基站之间的端到端控制面接入层安全。
可选地，所述第一用户处理模块是设置为：
在所述UE的上层用户面数据发到空中接口之前，在所述UE的PDCP-s层执行加密和完整性保护，其中，所述用户面数据发送到所述网关节点之后，由所述网关节点在PDCP-s层进行解密和完整性验证；
在所述UE的PDCP-s层对通过空中接口接收到的来自所述网关节点的用户面数据进行解密和完整性验证。
可选地，所述第一控制面处理模块是设置为：
在所述UE的上行RRC层信令在发送到空中接口之前，在所述UE的PDCP层执行加密和完整性保护，其中，所述初始接入节点或者宏基站接收到RRC信令后，执行解密和完整性验证；
在所述UE接收到所述初始接入节点或者宏基站通过空中接口发送的下行RRC层信令后，执行解密和完整性验证。
本发明实施例又提供了一种无线接入小节点，该无线接入小节点为能够通过有线接口接入核心网的无线接入小节点；
该无线接入小节点至少包括第二用户面处理模块，设置为：执行与UE之间的端到端用户面接入层安全；其中，所述端到端用户面接入层安全包括端到端用户面加密和用户面完整性保护。
可选地，
当所述UE经过两段无线空中接口与所述核心网通信时，所述无线接入小节点与初始接入节点通过无线回程接口通信；
当所述UE经过大于两段无线空中接口与所述核心网通信时，所述无线接入小节点与中间路由节点通过无线回程接口通信，所述中间路由节点与初始接入节点通过无线回程接口通信，当所述中间路由节点为两个或两个以上时，所述中间路由节点之间通过无线回程接口通信；
其中，所述初始接入节点为所述UE通过无线接入链路接入的无线接入小节点；
所述中间路由节点为实现所述初始接入节点和所述无线接入小节点之间的通信，并最终实现接入所述初始接入节点的UE与所述核心网之间的通信提供中继传输的无线接入小节点。
可选地，在所述无线接入小节点自身的PDCP-s层和所述UE的PDCP-s层之间执行所述端到端用户面接入层安全过程。
可选地，所述第二用户面处理模块是设置为：
在所述自身的PDCP-s层对通过空中接口接收到的来自所述UE的用户面数据进行解密和完整性验证；
从核心网获取到需要发送给所述UE的用户面数据，在发到空中接口之前，在所述自身的PDCP-s层执行加密和完整性保护。
可选地，所述无线接入小节点还包括用户面密钥生成模块，设置为：
在所述第二用户面处理模块执行与所述UE之间的端到端用户面加密和用户面完整性保护之前，生成执行所述端到端用户面加密和用户面完整性保护所需要的用户面加密密钥KUPenc和用户面完整性保护密钥KUPint。
可选地，所述用户面密钥生成模块是设置为：
基于接入层安全根密钥KeNB生成所述用户面加密密钥KUPenc和用户面完整性保护密钥KUPint；或者，
接收来自所述宏基站的所述用户面加密密钥KUPenc和用户面完整性保护密钥KUPint；
其中，所述KeNB由所述核心网或者所述宏基站发送给所述无线接入小节点；
其中，所述宏基站为除所述初始接入节点之外，所述UE通过无线接入链路接入的另一个基站。
本发明实施例还提供了一种无线接入小节点，该无线接入小节点为UE通过无线接入链路接入的无线接入小节点；
该无线接入小节点至少包括第二控制面处理模块，设置为：执行与UE之间的端到端控制面接入层安全；其中，所述端到端控制面接入层安全包括端到端控制面加密和控制面完整性保护。
可选地，在所述无线接入小节点自身的PDCP层和所述UE的PDCP层之间执行所述端到端控制面接入层安全过程。
可选地，所述第二控制面处理模块是设置为：
接收到RRC信令后，执行解密和完整性验证；
在所述自身的PDCP层对发送给所述UE的下行RRC层信令执行加密和完整性保护后发送到空中接口。
可选地，所述无线接入小节点还包括控制面密钥生成模块，设置为：
在所述第二控制面处理模块执行与所述UE之间的端到端控制面加密和控制面完整性保护之前，生成执行所述端到端控制面加密和控制面完整性保护所需要的控制面加密密钥KRRCenc和控制面完整性保护密钥KRRCint。
可选地，所述控制面密钥生成模块是设置为：
接收来自网关节点的控制面加密密钥KRRCenc和控制面完整性保护密钥KRRCint，或基于来自网关节点的接入层控制面安全根密钥KeNB*生成所述控制面加密密钥KRRCenc和控制面完整性保护密钥KRRCint。
本发明实施例还提供了一种无线接入小节点，包括上述两种无线接入小节点的任意组合。
此外，本发明实施例还提供一种计算机可读存储介质，存储有计算机可执行指令，所述计算机可执行指令被执行时实现上述的实现接入层安全的方法。
本申请技术方案包括：执行UE与网关节点之间的端到端用户面接入层安全；以及，当UE仅存在微通信路径时，执行UE与初始接入节点之间的端到端控制面接入层安全；或者，当UE存在微通信路径和宏通信路径时，执行UE与宏通信路径中的宏基站之间的端到端控制面接入层安全；其中，微通信路径为UE通过无线接入链路接入无线接入小节点最终接入核心网的通信路径；宏通信路径为UE通过无线接入链路接入宏基站最终接入核心网的通信路径。一方面，无论UE的通信路径中经过多少个中间路由节点，用户面安全只在UE和网关节点之间端到端执行，很好地保证了用户面安全，避免了因为经过多段空中接口也即经过多个中间路由节点导致的安全泄露隐患；而控制面安全只在UE和初始接入节点之间端到端执行，在保证控制面安全的前提下减少了控制面安全操作的延时；另一方面，用户面安全只在UE和网关节点之间端到端执行，使得UE在不同的SRAN-node节点之间移动时，只要UE的通信路径最后都是通过同一个节点连接到核心网，则用户面安全是不变的，从而提高了UE的移动性能。此外，用户面安全只在UE和网关节点之间端到端执行，还使得不管UE的通信路径中的中间节点如何改变，都不会导致用户面安全发生改变，从而保证了UE用户面数据传输的连续性。
本申请的其它特征和优点将在随后的说明书中阐述，并且，部分地从说明书中变得显而易见，或者通过实施本申请而了解。本申请的目的和其他优点可通过在说明书、权利要求书以及附图中所特别指出的结构来实现和获 得。
在阅读并理解了附图和详细描述后，可以明白其他方面。
附图概述
此处所说明的附图用来提供对本申请的进一步理解，构成本申请的一部分，本申请的示意性实施例及其说明用于解释本申请，并不构成对本申请的不当限定。在附图中：
图1为传统蜂窝无线接入网络的网络拓扑示意图；
图2为在传统蜂窝无线接入网络的特定区域内部署UDN的示意图；
图3为未来一定区域内的超密集网络部署示意图；
图4为相关技术中LTE系统的安全层级示意图；
图5为图4所示的安全层级示意图对应在LTE系统协议栈中的实现分布图；
图6为本发明实施例的实现接入层安全的方法的流程图；
图7为本发明实施例的实现接入层安全的一个应用场景的示意图；
图8为本发明实施例的实现接入层安全的另一个应用场景的示意图；
图9为本发明实施例基于图7所示应用场景的用户面接入层安全协议架构；
图10为本发明实施例基于图7所示应用场景的实现用户面接入层安全的密钥生成实施流程图；
图11为本发明实施例基于图7所示应用场景的控制面接入层安全协议架构；
图12为本发明实施例基于图7所示应用场景的实现控制面接入层安全的密钥生成第一实施流程图；
图13为本发明实施例基于图7所示应用场景的实现控制面接入层安全的密钥生成第二实施流程图；
图14为本发明实施例基于图8所示应用场景的用户面接入层安全协议架 构；
图15为本发明实施例基于图8所示应用场景的控制面接入层安全协议架构；
图16为本发明实施例基于图8所示应用场景的实现用户面接入层安全和控制面接入层安全的密钥生成实施流程图；
图17为本发明实施例的实现逐级节点安全验证的流程图；
图18为本发明实施例的用户设备的组成结构示意图；
图19为本发明实施例的无线接入小节点的组成结构示意图。
本发明的实施方式
下文中将结合附图对本发明的实施例进行详细说明。需要说明的是，在不冲突的情况下，本申请中的实施例及实施例中的特征可以相互任意组合。
为了满足未来10年上千倍业务量增长的预期，UDN将被广泛部署以承担大量业务流量。UDN可以被部署在室内、室外热点区域或者任何有大业务量需求的区域。图3为未来中一定区域内的超密集网络部署示意图，考虑到实际部署网络的基础设施限制，比如在所示区域内有线网络端口数目有限，以及为不增加部署和运营网络的CAPEX和OPEX，实现灵活快捷部署该网络，如图3所示的7个SRAN-node中，只有小节点303和小节点309所部署的位置有有线网络端口，即可以通过图3中的粗黑实线所示的有线回程连接到核心网设备、运营管理维护(OAM，Operation Administration and Maintenance)设备等，如小节点303可以连接到设备302，而小节点309可以连接到设备301。图3中，其他的5个小节点所部署的位置均没有有线网络端口，因此，这些小节点只能通过自身与周围其他小节点之间的无线回程链路(如图3中的虚线所示)，经过一跳无线回程链路或者多跳无线回程链路连接到小节点303或小节点309，最终通过小节点303或小节点309的有线端口连接到核心网设备、OAM设备等。相应地，在图3所示的网络部署中，必然导致很多UE的通信数据需要经过两段甚至两段以上的空口传输，比如：以图3中的UE 310为例，UE310与设备301之间的通信数据需要经过两 段空口的传输，即经过与小节点306之间的无线接入链路(如图3中的闪电线所示)，以及小节点306与小节点309之间的无线回程链路来实现与设备301之间的通信。再如：图3中的UE 311与设备301之间的通信数据则需要经过三段空口传输，即经过与小节点307之间的无线接入链路，以及小节点307与小节点306之间的无线回程链路和小节点306与小节点309之间的无线回程链路来实现与设备301之间的通信。
图4为相关技术中长期演进(LTE，Long Term Evolution)系统的安全层级示意图，图5为图4所示的安全层级示意图对应在LTE系统协议栈中的实现分布图，图5中，斜线阴影部分表示控制面，灰阴影部分表示用户面。如图5所示，同时示出了用户面协议栈和控制面协议栈，对核心网设备如移动管理实体/服务网关/数据网关(MME/S-GW/P-GW)而言，这些设备在物理上可以位于同一个物理设备，但逻辑上实现不同的逻辑功能，如图5中最右侧的核心网设备协议栈架构中，控制面协议栈非接入层(NAS)和网络间协议/流控制传输协议(IP/SCTP)在MME上实现，而用户面协议栈应用层协议(APP)和网络间协议/用户数据报协议/用户面隧道协议(IP/UDP/GTP-U)在S-GW/P-GW上实现。根据图4所示，为了保证LTE系统的通信安全，LTE系统会执行三个安全操作，即鉴权和密钥协商(AKA，Authentication and Key Agreement)、非接入层安全密钥协商(NAS SMC，Non-Access Stratum Security Mode Command)、接入层安全密钥协商(AS SMC，Access Stratum Security Mode Command)。
如图4所示，位于UE侧的UE的全球用户身份模块(USIM，Universal Subscriber Identity Module)上会保存有一个安全根密钥K，位于网络侧的鉴权中心(AuC，Authentication Center)设备中也会保存有这个相同的安全根密钥K，这样，在AKA过程中，首先，UE和网络侧的用户归属服务器(HSS，Home Subscriber server)会分别根据上述保存的安全根密钥K，计算出加密密钥(CK，Cipher Key)和完整性密钥(IK，Integrity Key)；然后，UE和HSS再分别根据所生成的CK、IK计算得到安全管理密钥KASME，安全管理密钥KASME是后续NAS层安全和AS层安全的根密钥。在AKA过程中，除了上述生成安全管理密钥KASME，UE和HSS之间还完成相互之间的身份认证，以确 保对方设备的合法性。
完成了AKA过程后，UE和位于网络侧的移动管理实体(MME，Mobility Management Entity)之间就可以执行NAS SMC过程。具体包括：UE和MME根据AKA过程中生成的安全管理密钥KASME派生出NAS层完整性密钥KNAS  int和NAS层安全密钥KNAS enc。对应于图5的LTE系统协议栈，NAS层安全在UE侧的NAS协议层和MME侧的NAS协议层之间端到端实现，UE和MME的NAS层信令在传给对端之前，会用NAS层完整性密钥KNAS int、NAS层安全密钥KNAS enc进行完整性保护和加密，以保证NAS信令的安全性。
在NAS SMC过程中，MME还基于安全管理密钥KASME和NAS层的上行NAS计数值(uplink NAS COUNT)，计算生成AS层的根密钥KeNB，并将AS层的根密钥KeNB通知给UE所接入的基站(eNB)，此后在eNB和UE之间可以执行AS SMC过程，以保证UE和eNB之间的无线接入空中接口(Uu口)的安全性。具体包括：UE和eNB根据KeNB派生出Uu口控制面的完整性密钥KRRC int和Uu口控制面的安全密钥KRRC enc，派生出Uu口用户面的安全密钥KUP enc，对于通信双方为中继设备(relay)和eNB的情况(为了方便区分，相关技术中将relay和eNB之间的接口称为Un接口)，还可以派生出空中接口Un口的用户面完整性密钥KUP int。对应于图5的LTE系统协议栈，AS层安全在图5所示的UE侧的数据包汇聚协议(PDCP，Packet Data Convergence Protocol)层和eNB侧的PDCP协议层之间端到端实现。UE和eNB的无线资源控制(RRC，Radio Resource Control)层信令在传输给对端之前，会在PDCP层用Uu口控制面的完整性密钥KRRC int、Uu口控制面的安全密钥KRRC enc进行完整性保护和加密；UE的上层数据和上层NAS层信令等在传输给eNB之前，以及eNB在将来自S1接口的数据和信令等传输给UE之前，会在PDCP层用Uu口用户面的安全密钥KUP enc进行加密，对于Un口传输的情况，这些数据和信令还会在PDCP层用Un口的用户面完整性密钥KUP int进行完整性保护。通过AS层安全，保证了信息在无线空口传输的安全性。
图6为本发明实施例的实现接入层安全的方法的流程图，如图6所示，所述方法包括以下步骤：
步骤600：UE与核心网之间实现AKA过程和NAS层安全过程。本步骤的具体实现属于本领域技术人员的公知技术，具体实现并不用于限定本申请的保护范围，这里不再赘述。
步骤601：执行UE与网关节点之间的端到端用户面接入层安全；以及，当UE仅存在微通信路径时，执行UE与初始接入节点之间的端到端控制面接入层安全；或者，当UE存在微通信路径和宏通信路径时，执行UE与宏通信路径中的宏基站之间的端到端控制面接入层安全；
其中，微通信路径为UE通过无线接入链路接入无线接入小节点最终接入核心网的通信路径；宏通信路径为UE通过无线接入链路接入宏基站最终接入核心网的通信路径。
本步骤中，
执行UE与网关节点之间的端到端用户面接入层安全过程包括：执行UE与网关节点之间的端到端用户面加密和用户面完整性保护；
执行UE与初始接入节点或者宏基站之间的端到端控制面接入层安全过程包括：执行UE与初始接入节点或者宏基站之间的端到端控制面加密和控制面完整性保护。
可选地，
在微通信路径中，UE经过至少两段无线空中接口与所述核心网通信；
微通信路径至少包括UE、初始接入节点、网关节点；
当UE经过大于两段无线空中接口与核心网通信时，微通信路径中还包括至少一个中间路由节点。
其中，
初始接入节点为UE通过无线接入链路接入的无线接入小节点；
网关节点为能够通过有线接口接入核心网的无线接入小节点；
中间路由节点为实现初始接入节点和网关节点之间的通信，并最终实现接入初始接入节点的UE与核心网之间的通信提供中继传输的无线接入小节点。
图7为本发明实施例的实现接入层安全的一个应用场景的示意图。基于图3所示，在未来的网络中，UE与核心网之间的通信数据需要经过两段甚至两段以上的空口传输。如图7所示，假设一个UE经过三段空中接口与核心网通信，UE通过无线接入链路接入无线接入小节点1(SRAN-node1)，将SRAN-node1称为初始接入节点，UE和SRAN-node1之间的接口即为无线接入空中接口即Uu接口。图7中，SRAN-node1无法通过有线接口(或者没有有线接口)直接接入核心网，SRAN-node1通过无线回程链路与无线接入小节点2(SRAN-node2)通信，将SRAN-node2称为中间路由节点，SRAN-node1和SRAN-node2之间的接口称为无线回程接口即Ub接口。SRAN-node2也无法通过有线接口直接接入核心网，SRAN-node2通过无线回程链路与无线接入小节点3(SRAN-node3)通信，而SRAN-node3可以通过有线接口直接接入核心网，将SRAN-node3称为网关节点，SRAN-node2和SRAN-node3之间的接口同样称为Ub接口。SRAN-node3与核心网(EPC，Evolved Packet Core)之间通过有线接口直接连接，承载在该有线接口上的SRAN-node3和EPC之间的逻辑接口为LTE相关技术中的S1接口。中间路由节点为实现初始接入节点和网关节点之间的通信从而最终实现接入初始接入节点的UE与核心网设备之间的通信提供中继传输。
图7中仅以UE经过三段空中接口(一段Uu接口和两段Ub接口)与核心网通信为例进行说明，在未来网络中，UE也可能经过两段空中接口(一段Uu接口和一段Ub接口)与核心网通信，或者UE可能经过超过三段空中接口(一段Uu接口和n段Ub接口(n>2))与核心网通信。也就是说，UE经过至少两段无线空中接口与核心网通信，UE经过至少两段无线空中接口与核心网通信的通信路径中，至少包括UE、初始接入节点、网关节点；其中，两段无线空中接口包括：UE和初始接入节点之间的无线接入空中接口(Uu口)和初始接入节点与网关节点之间的无线回程接口(Ub口)。当UE经过大于两段无线空中接口与核心网通信时，通信路径中还包括至少一个中间路由节点，此时，大于两段无线空中接口包括：UE和初始接入节点之间的Uu口、初始接入节点和中间路由节点之间的Ub口、中间路由节点和网关节点之间的Ub口；可选地，如果有超过两个中间路由节点时，还包括中间路由节点之间的Ub口。
对于图7所示的本发明实施例的实现接入层安全的一个应用场景，步骤601中执行的端到端控制面接入层安全是在UE与初始接入节点之间执行。
图8为本发明实施例的实现接入层安全的另一个应用场景的示意图。在实际应用中，基于图2，未来的超密集网络还有一种场景是部署在有传统蜂窝覆盖的区域内。如8图所示，SRAN-node1、SRAN-node3等小节点密集部署在宏基站(MNB)的覆盖范围内(为了图示清晰，图8中只示意出两个小节点)，其中，SRAN-node3可以通过有线回程链路连接到核心网(CN)设备，而SRAN-node1只能通过无线回程链路连接到SRAN-node3并通过SRAN-node3连接到CN设备。在图8中，一方面，UE通过与MNB之间的无线接入链路接入MNB，另一方面，UE通过与SRAN-node1之间的无线接入链路接入SRAN-node1。通过UE与MNB和SRAN-node1之间的双连接，可以根据需要实现业务在两者之间的合理分配，比如：大流量业务在UE和SRAN-node1之间传输，而小流量业务在UE和MNB之间传输；再如：高可靠性业务在UE和MNB之间传输，而对可靠性要求不太严格的业务在UE和SRAN-node1之间传输等；还可以通过UE与MNB和SRAN-node1之间的双连接，实现控制面信令和用户面数据的分离，比如控制面管理信令在UE和MNB之间传输，而用户面数据在UE和SRAN-node1之间传输。
也就是说，对于图8所示的双连接场景，一方面，UE通过无线接入链路与宏基站(MNB)连接(将UE通过无线接入链路接入MNB最终接入核心网的通信路径称为宏通信路径)，另一方面，UE通过无线接入链路与SRAN-node连接(将UE通过无线接入链路接入SRAN-node最终接入核心网的通信路径称为微通信路径)；其中，UE的微通信路径中，UE经过至少两段无线空中接口与核心网通信。同样，在微通信路径中至少包括UE、初始接入节点、网关节点，两段无线空中接口包括UE和初始接入节点之间的无线接入空中接口(Uu口)和初始接入节点与网关节点之间的无线回程接口(Ub口)。当UE经过大于两段无线空中接口与核心网通信时，微通信路径中还包括至少一个中间路由节点，大于两段无线空中接口包括UE和初始接入节点之间的Uu口、初始接入节点和中间路由节点之间的Ub口、中间路由节点和网关节点之间的Ub口；可选地，如果有超过两个中间路由节点时，还包 括中间路由节点之间的Ub口。
对于图8所示的本发明实施例的实现接入层安全的另一个应用场景，步骤601中执行的端到端控制面接入层安全是在UE与宏基站之间执行。
下面针对本发明实施例的不同应用场景，详细描述本发明实施例的方法的具体实现。
图9为本发明实施例基于图7所示应用场景的用户面接入层安全协议架构，在UE和网关节点(如SRAN-node3)之间执行端到端的用户面接入层安全(E2E UP security，End-to-End UP security)过程，即在UE的PDCP安全(PDCP-s，PDCP security)协议层和SRAN-node3的PDCP-s协议层之间执行端到端用户面接入层安全过程。
如图9所示，UE和SRAN-node3在E2E UP security两端，从下到上分别包括：物理层(L1)、媒体接入控制层(MAC，Media Access Control)、无线链路控制层(RLC，Radio Link Control)、数据包汇聚协议瘦身层(PDCP-t，Packet Data Convergence Protocol thined)、数据包汇聚协议安全层(PDCP-s，Packet Data Convergence Protocol security)。
其中，
PDCP-s层完成以下功能：头压缩和解压缩、安全操作；其中，安全操作，包括加密、解密、完整性保护和完整性验证；
PDCP-t层完成相关LTE技术中PDCP子层除PDCP-s层功能之外的其他功能，比如：数据传输；PDCP包序列号维护；RLC层重建时向上层按序传递数据包；RLC层重建时，对RLC确认模式数据包的重复包检测和丢弃；基于时间的包丢弃；重复包丢弃等。
需要说明的是，PDCP-s和PDCP-t层也可以合并成一个协议层实现，合并在一起即为相关LTE技术中的PDCP子层。
本发明实施例中，在执行UE和网关节点(如SRAN-node3)之间的端到端用户面接入层安全过程时，UE通信路径中的其他接入网节点，包括初始接入节点和中间路由节点并不参与接入层安全操作，因此，如图9所示，在UE通信路径的其他接入网节点上，也就是说，在初始接入节点如 SRAN-node1，在中间路由节点如SRAN-node2上，不需要实现PDCP-s协议层。为了实现UE通信路径中每段无线空中接口上通信双方的通信，SRAN-node1和SRAN-node2在其通信的每个无线空中接口上从下到上分别包括L1、MAC、RLC等协议层，可选地，还可以包括PDCP-t协议层。具体来讲：
SRAN-node1为实现与UE的Uu口通信，在Uu接口侧从下到上分别包括L1、MAC、RLC等协议层，可选地，还可以包括PDCP-t协议层；
SRAN-node1为实现与中间路由节点SRAN-node2的Ub1口通信，在Ub1接口侧从下到上分别包括L1、MAC、RLC等协议层，可选地，还可以包括PDCP-t协议层；
SRAN-node2为实现与初始接入节点SRAN-node1的Ub1口通信，在该Ub1接口侧从下到上分别包括L1、MAC、RLC等协议层，可选地，还可以包括PDCP-t协议层；
SRAN-node2为实现与网关节点SRAN-node3的Ub2口通信，在该Ub2接口侧从下到上分别包括L1、MAC、RLC等协议层，可选地，还可以包括PDCP-t协议层。
以图7所示的应用场景为例，执行UE和网关节点(如SRAN-node3)之间的端到端用户面接入层安全过程包括：执行UE和SRAN-node3之间的端到端的用户面加密和用户面完整性保护。结合图9，UE的上层用户面数据，具体UE的上层用户面数据是指来自UE的PDCP-s层以上的协议层的数据，比如图9中UE的应用层(APP)数据，再如UE的NAS层信令等在发到空中接口(Uu口)之前，需要在PDCP-s层执行加密和完整性保护，数据发送到SRAN-node3之后，由SRAN-node3在PDCP-s层进行解密和完整性验证；同样，网关节点(如SRAN-node3)从核心网的S-GW/P-GW获取到需要发送给UE的用户面数据，SRAN-node3在发到空中接口(Ub口)之前，需要在PDCP-s层执行加密和完整性保护，数据发送到UE后，由UE在PDCP-s层进行解密和完整性验证。也就是说，所有用户面数据在第一次进入空中接口传输之前，执行端到端用户面加密和用户面完整性保护，从而确保了用户面数据在包括两段甚至两段以上空中接口的通信路径中传输时的安全性。
图10为本发明实施例的基于图7所示应用场景的实现用户面接入层安全的密钥生成实施流程图，通过图10所示的安全密钥生成方法，可以生成本发明实施例中执行UE和网关节点之间端到端用户面加密和用户面完整性保护所需要的用户面加密密钥KUPenc和用户面完整性保护密钥KUPint。如图10所示，上述过程包括：
步骤1000：UE和核心网之间执行AKA过程，执行完AKA过程后，在UE和核心网设备(如HSS)分别计算得到安全管理密钥KASME。
本步骤UE和核心网之间执行AKA过程的具体实现属于本领域技术人员的公知技术，并不用于限定本申请的保护范围，这里不再赘述。
步骤1001：UE和核心网设备(如MME)之间执行NAS层安全过程(NAS SMC)，在执行NAS层安全过程后，在UE和MME分别生成NAS层的安全密钥即NAS层完整性密钥KNAS int和NAS层安全密钥KNAS enc。
在NAS层安全过程中，MME除了生成NAS层的安全密钥之外，还基于AKA所生成的KASME和NAS SMC中所生成的uplink NAS COUNT，计算生成AS层的根密钥KeNB。
本步骤UE和MME之间执行NAS层安全过程的具体实现属于本领域技术人员的公知技术，并不用于限定本申请的保护范围，这里不再赘述。
步骤1002：MME将UE的安全信息发送给UE通信路径中的网关节点，如图7中的SRAN-node3。
本步骤中，MME发送给SRAN-node3的UE的安全信息包括AS层的根密钥KeNB和UE的安全能力(UE security capability)；其中，UE security capability包括UE所支持的完整性保护算法和UE所支持的加密算法。
步骤1003：SRAN-node3选择安全算法，生成端到端用户面安全密钥即用户面完整性密钥KUPint和用户面的安全密钥KUPenc。
本步骤中，SRAN-node3从UE security capability中选择UE和自身都支持的完整性保护算法和加密算法，由AS层的根密钥KeNB派生出用户面完整性密钥KUPint和用户面的安全密钥KUPenc。具体密钥派生算法与LTE相关技术中的方法完全一致，属于本领域技术人员的公知技术，并不用于限定本申请 的保护范围，这里不再赘述。
步骤1104：SRAN-node3向UE发起E2E接入层安全模式命令，在E2E接入层安全模式命令中携带有SRAN-node3本地派生出用户面完整性密钥KUPint和用户面的安全密钥KUPenc时用到的接入层用户面完整性保护算法和接入层用户面加密算法。
本步骤中，SRAN-node3发给UE的E2E接入层安全模式命令是经过SRAN-node2和SRAN-node1发送给UE的。
步骤1005：UE生成端到端用户面安全密钥即用户面完整性密钥KUPint和用户面的安全密钥KUPenc。
本步骤中，UE利用由AKA过程生成的安全管理密钥KASME，以及NAS层安全过程产生的uplink NAS COUNT生成AS层的根密钥KeNB，根据来自SRAN-node3的E2E接入层安全模式命令中携带的接入层用户面完整性保护算法和接入层用户面加密算法，派生出用户面完整性密钥KUPint和用户面的安全密钥KUPenc。
步骤1006：UE经由SRAN-node1和SRAN-node2，向SRAN-node3发送E2E接入层安全模式完成消息。
自此，UE和网关节点之间生成了端到端用户面接入层安全的密钥即用户面完整性密钥KUPint和用户面的安全密钥KUPenc，UE和网关节点之间可以执行端到端用户面接入层安全操作。
图11为本发明实施例基于图7所示应用场景的控制面接入层安全协议架构，在UE和初始接入节点(如SRAN-node1)之间执行端到端的控制面接入层安全(E2E CP security)过程，即在UE的PDCP协议层和SRAN-node1的PDCP协议层之间执行端到端控制面接入层安全过程。
如图11所示，UE和SRAN-node1在E2E CP security两端，从下到上分别包括L1、MAC、RLC、PDCP等协议层。
本发明实施例中，在执行UE和初始接入节点(如SRAN-node1)之间的端到端控制面接入层安全过程时，UE通信路径中的其他接入网节点，包括中间路由节点和网关节点并不参与接入层控制面安全操作，因此，如图11 所示，在UE通信路径的其他接入网节点上，也就是说，在中间路由节点如SRAN-node2，在网关节点如SRAN-node3上，不需要实现PDCP协议层中的安全功能。但是，为了实现UE通信路径中每段无线空中接口上通信双方的用户面通信，SRAN-node1、SRAN-node2、SRAN-node3在其通信的每个无线回程链路接口上从下到上分别包括L1、MAC、RLC等协议层，可选地，还可以包括PDCP-t协议层。具体来讲：
为了实现SRAN-node1与SRAN-node2之间的Ub1口通信，SRAN-node1和SRAN-node2在该Ub1接口侧从下到上分别包括L1、MAC、RLC等协议层，可选地，还可以包括PDCP-t协议层；
为了实现SRAN-node2与SRAN-node3之间的Ub2口通信，SRAN-node2和SRAN-node3在该Ub2接口侧从下到上分别包括L1、MAC、RLC等协议层，可选地，还可以包括PDCP-t协议层。
以图7所示的应用场景为例，执行UE和初始接入节点(如SRAN-node1)之间的端到端控制面接入层安全过程包括：执行UE和SRAN-node1之间的端到端控制面加密和控制面完整性保护。结合图11所示，UE的上行RRC层信令在发送到空中接口(Uu口)之前，需要在PDCP层执行加密和完整性保护，SRAN-node1接收到RRC信令后，执行解密和完整性验证；同样，SRAN-node1作为UE的初始接入节点，其发送给UE的下行RRC层信令在发送到Uu口之前，需要在PDCP层执行加密和完整性保护，UE接收到RRC信令后，执行解密和完整性验证，从这样，保证了RRC控制信令在空口传输的安全性。
图12为本发明实施例基于图7所示应用场景的实现控制面接入层安全的密钥生成第一实施流程图，图12给出了一种本发明实施例的UE和初始接入节点之间端到端控制面接入层安全密钥的生成方法，通过图12所示的安全密钥生成方法，可以生成本发明实施例中执行UE和初始接入节点之间端到端控制面加密和控制面完整性保护所需要的控制面加密密钥KRRCenc和控制面完整性保护密钥KRRCint。如图12所示，上述过程包括：
步骤1200：UE和核心网之间执行AKA过程，执行完AKA过程后，在UE和核心网设备(如HSS)分别计算得到安全管理密钥KASME。
本步骤UE和核心网之间执行AKA过程的具体实现属于本领域技术人员的公知技术，并不用于限定本申请的保护范围，这里不再赘述。
步骤1201：UE和核心网设备(如MME)之间执行NAS层安全过程(NAS SMC)，在执行NAS层安全过程后，在UE和MME分别生成NAS层的安全密钥即NAS层完整性密钥KNAS int和NAS层安全密钥KNAS enc。
在NAS层安全过程中，MME除了生成NAS层的安全密钥之外，还基于AKA所生成的KASME和NAS SMC中所生成的uplink NAS COUNT，计算生成AS层的根密钥KeNB。
本步骤UE和MME之间执行NAS层安全过程的具体实现属于本领域技术人员的公知技术，并不用于限定本申请的保护范围，这里不再赘述。
步骤1202：MME将UE的安全信息发送给UE通信路径中的网关节点如图7中的SRAN-node3。UE的安全信息包括AS层的根密钥KeNB和UE的安全能力。本步骤具体实现与图10中的步骤1002完全一致，这里不再赘述。
可选地，如果MME获得了UE的初始接入接入节点(如SRAN-node1)的安全能力信息，则MME还可以将SRAN-node1的安全能力信息发送给网关节点。SRAN-node的安全能力信息包括SRAN-node1所支持的接入层控制面完整性保护算法和接入层控制面加密算法。
步骤1203：SRAN-node3向UE所接入的初始接入节点(如图7中的SRAN-node1)索要SRAN-node1所支持的安全能力信息，包括接入层控制面完整性保护算法和接入层控制面加密算法。
这里，SRAN-node3向SRAN-node1索要控制面安全算法的消息，以及SRAN-node1向SRAN-node3发送控制面安全算法的消息均经由SRAN-node2发送给对方。消息的具体实现可以使采用现有消息，也可以采用新消息，具体实现对于本领域技术人员来讲是容易实现的，这里并不对其进行限定，也不用于限定本申请的保护范围，这里不再赘述。
如果步骤1202中SRAN-node3已经从MME处获得了SRAN-node1的安全能力信息，则本步骤可以省略。
步骤1204：SRAN-node3生成控制面安全密钥即控制面的安全密钥 KRRCenc和控制面的完整性密钥KRRCint。
本步骤中，SRAN-node3从UE security capability和SRAN-node1 security capability中选择双方共同支持的接入面控制层安全算法，即选择双方共同支持的控制面完整性保护算法和控制面加密算法，再由AS层的根密钥KeNB派生出控制面的安全密钥KRRCenc和控制面的完整性密钥KRRCint。
步骤1205：SRAN-node3通知SRAN-node1控制面安全密钥，通知的内容包括：控制面的安全密钥KRRCenc、控制面的完整性密钥KRRCint、接入层控制面完整性保护算法和接入层控制面加密算法。其中，通知消息经由SRAN-node2发送给SRAN-node1。
步骤1206：SRAN-node1向UE发送接入层安全模式命令，在接入层安全模式命令中携带SRAN-node1所接收到的SRAN-node3派生控制面密钥所使用的接入层控制面完整性保护算法和接入层控制面加密算法。
步骤1207：UE生成控制面安全密钥即控制面的安全密钥KRRCenc、控制面的完整性密钥KRRCint。
本步骤中，UE利用AKA过程生成的安全管理密钥KASME，以及NAS层安全过程产生的uplink NAS COUNT生成的AS层的根密钥KeNB，以及收到的接入层控制面安全算法(即接入层控制面完整性保护算法和接入层控制面加密算法)派生出控制面的安全密钥KRRCenc、控制面的完整性密钥KRRCint。
步骤1208：UE向SRAN-node1发送接入层安全模式完成消息。
自此，UE和初始接入节点之间生成了端到端控制面接入层安全的密钥即控制面的安全密钥KRRCenc、控制面的完整性密钥KRRCint，UE和初始接入节点之间可以执行端到端控制面接入层安全操作。
图13为本发明实施例基于图7所示应用场景的实现控制面接入层安全的密钥生成第二实施流程图，通过图13所示的安全密钥生成方法，可以生成本发明实施例中执行UE和初始接入节点之间端到端控制面加密和控制面完整性保护所需要的控制面加密密钥KRRCenc和控制面完整性保护密钥KRRCint。如图13所示，上述过程包括：
步骤1300～步骤1302与图12中的步骤1200～步骤1202完全一致，这里 不再赘述。
步骤1303：SRAN-node3接收到UE的安全信息后，由UE所接入的SRAN-node1小区的下行绝对载频号(EARFCN-DL，E-UTRA Absolute Radio Frequency Channel Number)、物理小区标识(PCI，Phisical Cell Identity)和所收到的AS层的根密钥KeNB，派生出接入层控制面根密钥KeNB*。
步骤1304：SRAN-node3将所派生出的控制面安全根密钥KeNB*发送给SRAN-node1。
可选地，如果SRAN-node1没有UE的UE security capability，步骤1302中，SRAN-node3还将UE security capability发送给SRAN-node1。
步骤1305：SRAN-node1选择接入层控制面完整性保护算法、接入层控制面加密算法，并由KeNB*派生出控制面安全密钥即控制面的安全密钥KRRCenc和控制面的完整性密钥KRRCint。
本步骤的相关密钥派生算法与LTE相关技术中的控制面密钥派生算法一致，并不用于限定本申请的保护范围，这里不再赘述。
步骤1306：SRAN-node1向UE发送接入层安全模式命令，在接入层安全模式命令中携带SRAN-node1派生接入层控制面密钥时所选择使用的接入层控制面完整性保护算法和接入层控制面加密算法。
步骤1307：UE生成控制面安全密钥即控制面的安全密钥KRRCenc、控制面的完整性密钥KRRCint。
本步骤中，首先，UE利用AKA过程生成的安全管理密钥KASME和NAS层安全过程产生的uplink NAS COUNT生成的AS层的根密钥KeNB；然后，UE再利用AS层的根密钥KeNB，UE所接入的SRAN-node1小区的EARFCN-DL、PCI，派生出接入层控制面根密钥KeNB*；最后，UE利用KeNB*，使用步骤1306中所接收到的接入层控制面完整性保护算法、接入层控制面加密算法，派生出控制面安全密钥即控制面的安全密钥KRRCenc、控制面的完整性密钥KRRCint。
步骤1308：UE向SRAN-node1发送接入层安全模式完成消息。
自此，UE和初始接入节点之间生成了端到端控制面接入层安全的密钥 即控制面的安全密钥KRRCenc、控制面的完整性密钥KRRCint，UE和初始接入节点之间可以执行端到端可控制面接入层安全操作。
由图10、图12、图13的密钥生成实施流程及相应描述可见，对于图7所示的场景中，本发明实施例的密钥生成流程中，在AKA和NAS层安全过程之后，生成用户面端到端接入层安全密钥和生成控制面端到端接入层安全密钥的过程可以独立执行，因此，本发明实施例中，当用户面端到端接入层安全密钥和控制面端到端接入层安全密钥需要更新时，可以分别独立更新。比如，当用户面的某个无线承载(RB，Radio Bear)上的PDCP计数值(PDCP COUNT)发生计数翻转需要重新开始计数时，网关节点(如SRAN-node3)可以发起独立的用户面端到端接入层安全密钥更新过程，而保持UE与初始接入节点之间的端到端控制面接入层安全密钥不变。具体而言，网关节点(如SRAN-node3)发起用户面端到端接入层安全密钥更新的行为可以是，网关节点(如SRAN-node3)基于KeNB和网关节点上的小区的EARFCN-DL、PCI生成一个新的KeNB**，之后，网关节点(如SRAN-node3)基于该KeNB**，采取如图10中步骤1003到步骤1006的方法生成新的用户面接入层安全密钥，这里，在步骤1004中，网关节点(如SRAN-node3)除将所选择的接入层完整性保护算法和接入层加密算法通知给UE之外，还将生成的新的KeNB**通知给UE，UE基于所接收到的KeNB**、接入层完整性保护算法和接入层加密算法生成新的用户面接入层安全密钥。
从上述结合图7所示的场景的描述可见，本发明实施例中，用户面执行UE与UE的所述通信路径中的网关节点之间的端到端接入层安全，控制面执行UE与UE的所述通信路径中UE所接入的初始接入节点之间的端到端接入层安全。通过本发明实施例基于图7所示的应用场景的实现接入层安全的方法，一方面，无论UE的通信路径中经过多少段空中接口，也即无论UE的通信路径中经过多少个中间路由节点，用户面安全只在UE和网关节点之间端到端执行，很好地保证了用户面安全，避免了因为经过多段空中接口也即经过多个中间路由节点导致的安全泄露隐患；而控制面安全只在UE和初始接入节点之间端到端执行，在保证控制面安全的前提下减少了控制面安全操作的延时；另一方面，用户面安全只在UE和网关节点之间端到端执行，使得 UE在不同的SRAN-node节点之间移动时，只要UE的通信路径最后都是通过同一个网关节点连接到核心网，则用户面安全是不变的，从而提高了UE的移动性能。此外，用户面安全只在UE和网关节点之间端到端执行，还使得不管UE的通信路径中的中间节点如何改变，都不会导致用户面安全发生改变，从而保证了UE用户面数据传输的连续性。
图14为本发明实施例基于图8所示另一应用场景的用户面接入层安全协议架构。如图14所示，用户面执行UE与UE的微通信路径中的网关节点之间的端到端接入层安全，即在UE的PDCP-s协议层和网关节点(如图8所示的SRAN-node3)的PDCP-s协议层之间执行端到端用户面接入层安全过程。UE和SRAN-node3在E2E UP security两端，从下到上分别包括L1、MAC、RLC、PDCP-t、PDCP-s。UE的微通信路径中的其他接入网节点，包括初始接入节点和中间路由节点均不参与接入层安全操作。安全操作包括执行UE和网关节点SRAN-node3之间的端到端用户面加密和用户面完整性保护。
图15为本发明实施例基于图8所示另一应用场景的控制面接入层安全协议架构。如图15所示，控制面执行UE与UE的宏通信路径中的宏基站之间的端到端接入层安全，即在UE的PDCP协议层和宏基站的PDCP协议层之间执行端到端控制面接入层安全。UE和MNB在E2E CP security两端，从下到上分别包括L1、MAC、RLC、PDCP等协议层。安全操作包括执行UE和宏基站之间的端到端控制面加密和控制面完整性保护。
图16为本发明实施例基于图8所示另一应用场景的实现用户面接入层安全和控制面接入层安全的密钥生成实施流程图。如图16所示，给出了图8所示的双连接场景下，执行控制面和用户面分离的接入层安全的安全密钥生成的方法。通过图16所示的安全密钥生成方法，可以生成执行本发明实施例中UE与UE的微通信路径中的网关节点之间的端到端接入层安全所需要的用户面加密密钥KUPenc和用户面完整性保护密钥KUPint，以及生成执行本发明实施例中UE与UE的宏通信路径中的宏基站之间的端到端接入层安全所需要的控制面加密密钥KRRCenc和控制面完整性保护密钥KRRCint。如图16所示，上述过程包括：
步骤1600～步骤1601与步骤1000～步骤1001完全一致，这里不再赘述。
步骤1602：MME将UE的安全信息发送给MNB。
在步骤1601的NAS层安全过程中，MME除了生成NAS层的安全密钥之外，还基于AKA所生成的KASME和NAS SMC中所生成的uplink NAS COUNT，计算生成AS层的根密钥KeNB。
本步骤中，MME发送给MNB的UE的安全信息包括AS层的根密钥KeNB和UE的安全能力(UE security capability)；其中UE security capability包括UE所支持的完整性保护算法和UE所支持的加密算法。
步骤1603：MNB选择安全算法，由AS层的根密钥KeNB派生出控制面安全密钥即控制面的安全密钥KRRCenc和控制面的完整性密钥KRRCint；或者，MNB选择安全算法，由AS层的根密钥KeNB派生出控制面和用户面安全密钥即控制面的安全密钥KRRCenc和控制面的完整性密钥KRRCint，以及用户面完整性密钥KUPint和用户面的安全密钥KUPenc。
本步骤中，MNB从UE security capability中选择UE和MNB都支持的完整性保护算法和加密算法，由AS层的根密钥KeNB派生上述接入层密钥。具体密钥派生算法与LTE相关技术中的方法完全一致，具体实现并不用于限定本申请的保护范围，这里不再赘述。
步骤1604：MNB将用户面安全密钥通知给网关节点如图8中的SRAN-node3。
如果步骤1603中MNB派生出用户面完整性密钥KUPint和用户面的安全密钥KUPenc，那么，本步骤中，MNB将派生出的用户面完整性密钥KUPint和用户面的安全密钥KUPenc发送给SRAN-node3。
如果步骤1603中MNB未派生出用户面安全密钥，那么，本步骤中，MNB将AS层的根密钥KeNB，以及步骤1603中所选择出的安全算法(包括接入层完整性保护算法和接入层加密算法)发送给SRAN-node3。此时，本发明实施例还包括步骤1604-1，在步骤1604-1中，SRAN-node3利用接收到AS层的根密钥KeNB和接入层安全算法，派生出用户面安全密钥即用户面完整性密钥KUPint和用户面的安全密钥KUPenc。
步骤1605：MNB向UE发起接入层安全模式命令，在接入层安全模式命 令中携带有步骤1603中MNB所选择出的接入层完整性保护算法和接入层加密算法。
步骤1606：UE生成端到端用户面安全密钥即用户面完整性密钥KUPint和用户面的安全密钥KUPenc，以及端到端控制面安全密钥即控制面的安全密钥KRRCenc和控制面的完整性密钥KRRCint。
本步骤中，UE利用AKA过程生成的安全管理密钥KASME和NAS层安全过程产生的uplink NAS COUNT生成的AS层的根密钥KeNB，以及收到的安全算法派生出上述安全密钥即端到端用户面安全密钥即用户面完整性密钥KUPint和用户面的安全密钥KUPenc，以及端到端控制面安全密钥即控制面的安全密钥KRRCenc和控制面的完整性密钥KRRCint。
步骤1607：UE向MNB发送接入层安全模式完成消息。
自此，UE和网关节点之间生成了端到端用户面接入层安全的密钥即用户面完整性密钥KUPint和用户面的安全密钥KUPenc，UE和MNB之间生成了端到端控制面接入层安全的安全密钥即控制面的安全密钥KRRCenc和控制面的完整性密钥KRRCint，UE和网关节点之间，UE和MNB之间可以分别执行端到端用户面接入层安全操作和端到端控制面接入层安全操作。
对于图8所示的双连接场景中，用户面执行UE与UE的微通信路径中的网关节点之间的端到端接入层安全，控制面执行UE与UE的宏通信路径中的宏基站之间的端到端接入层安全，实现用户面和控制面相互独立的灵活的密钥更新过程，比如，当微通信路径中用户面的某个无线承载(RB，Radio Bear)上的PDCP计数值(PDCP COUNT)发生计数翻转需要重新开始计数时，实现用户面密钥的更新而保持控制面密钥不变，结合图16，在步骤1601的NAS层安全过程中，MME生成两个AS层个根密钥，分别为用户面安全根密钥KeNB-U和控制面安全根密钥KeNB-C，并在步骤1602中将生成的用户面安全根密钥KeNB-U和控制面安全根密钥KeNB-C发送给MNB，此后，图16的步骤1603、1604-1和步骤1606中，MNB、SRAN-node3和UE会分别基于KeNB-U生成用户面安全密钥KUPint，用户面完整性密钥KUPenc，基于KeNB-C生成控制面安全密钥KRRCint，控制面完整性密钥KRRCenc。基于此，当网关节点(如SRAN-node3)需要发起独立的用户面接入层安全密钥更新时，对于图 16的方法中有步骤1604-1的实现，具体更新过程可以是，网关节点(如SRAN-node3)基于KeNB-U和网关节点上的小区的EARFCN-DL、PCI生成一个新的KeNB-U**，之后，网关节点(如SRAN-node3)基于该KeNB-U**，采取如图16中步骤1604-1的方法生成新的用户面接入层安全密钥。与此同时，网关节点在生成KeNB-U**之后，将该KeNB-U**通知给MNB，MNB收到后，在步骤1605中将该KeNB-U**通知给UE，UE在步骤1606中基于该KeNB-U**生成新的用户面接入层安全密钥。
从上述结合图8所示的场景的描述可见，双连接场景下UE同时具有宏通信路径和微通信路径两个连接，用户面执行UE与UE的微通信路径中的网关节点之间的端到端接入层安全，控制面执行UE与UE的宏通信路径中的宏基站之间的端到端接入层安全。通过本发明实施例基于图8所示的应用场景的实现接入层安全的方法，一方面，无论UE的微通信路径中经过多少段空中接口，也即无论UE的微通信路径中经过多少个中间路由节点，用户面安全只在UE和网关节点之间端到端执行，很好地保证了用户面安全，避免了因为经过多段空中接口也即经过多个中间路由节点导致的安全泄露隐患；而控制面安全只在UE和宏基站之间端到端执行，在保证控制面安全的前提下减少了控制面安全操作的延时；另一方面，用户面安全只在UE和网关节点之间端到端执行，使得UE在不同的SRAN-node节点之间移动时，只要UE的通信路径最后都是通过同一个网关节点连接到核心网，则用户面安全是不变的，从而提高了UE的移动性能。此外，用户面安全只在UE和网关节点之间端到端执行，还使得不管UE的微通信路径中的中间节点如何改变，都不会导致用户面安全发生改变，从而保证了UE用户面数据传输的连续性。
可选地，以图3所示的未来超密集网络中，只有少部分小节点能通过有线网络端口连接到核心网，而更多的小节点则只能通过一跳甚至多跳无线回程链路连接到这些有有线网络端口的小节点之后才能接入核心网，如何保证这些小节点的合法性以及这些小节点接入网络的安全性，也是未来超密集网络中需要考虑的问题。
本发明实施例中的每个小节点均具有自己的通用集成电路卡(UICC，Universal Integrated Circuit Card)，且小节点与其UICC卡之间建立了节点与 UICC接口的安全通道，通过这个安全通道，小节点与网络之间执行双向认证，保证了小节点的合法性。为了保证小节点接入网络的安全性，图17示意了逐级节点安全验证过程，仍以图7所示UE的通信路径中的小节点为例，中间路由节点如SRAN-node2连接至网关节点如SRAN-node3，而初始接入节点如SRAN-node1连接至SRAN-node2，逐级节点安全验证是指，网络逐级对网关节点、中间路由节点和初始接入节点进行安全验证。图17为本发明实施例的实现逐级安全验证的实施例的流程图。如图17所示，上述过程包括：
步骤1700：网关节点如SRAN-node3的安全验证。
由于网关节点与核心网之间存在有线连接，因此对网关节点的安全认证，可以通过有线接口采用IP安全等方式进行验证。具体实现属于本领域技术人员熟知的，并不用于限定本申请的保护范围，这里不再赘述。
步骤1701：中间路由节点如SRAN-node2的安全验证。
类似UE，在如图7所示的通信路径中，对中间路由节点如SRAN-node2而言，网关节点如SRAN-node3相当于SRAN-node2所接入的基站(eNB)，而对于网关节点如SRAN-ndoe3而言，中间路由节点如SRAN-node2相当于接入其下的一个UE。因此，对中间路由节点的安全验证，采用图4所示的相关LTE技术中的UE安全验证方法，执行包括步骤1701-1的AKA过程、1701-2的NAS SMC、1701-3的AS SMC等三个操作即可，具体而言，
中间路由节点作为小节点，有其UICC卡，UICC卡的USIM上会保存一个安全根密钥K，而同时，网络侧的HSS中会相应的保存有这个相同的安全根密钥K，利用这个根密钥，采取图4所示的方法，可以实现MME与SRAN-node2之间的安全认证，然后在MME和SRAN-node2之间执行NAS SMC过程，以及在SRAN-node2和网关节点如SRAN-node3之间执行AS SMC过程。
经过步骤1701的以上操作，在SRAN-node2和SRAN-node3之间的Ub2接口上，可以生成用于保护这两个节点之间在Ub2接口上信息传输安全性的Ub口接入层控制面的安全密钥(即K-Ub2RRC int、K-Ub2RRC enc)和用户面安全密钥(即K-Ub2UP int、K-Ub2UP enc)。
步骤1702：初始接入节点的安全验证。
与步骤1701一样，类似于UE，在如图7所示的通信路径中，对初始接入节点如SRAN-node1而言，中间路由节点如SRAN-node2相当于SRAN-node1所接入的基站(eNB)，而对于中间路由节点如SRAN-node2而言，初始接入节点SRAN-node1相当于接入其下的一个UE。因此，对初始接入节点的安全验证，同样采用图4所示的相关LTE技术中的UE安全验证方法，执行包括步骤1702-1的AKA过程、1702-2的NAS SMC、1702-3的AS SMC等三个操作即可，具体而言，
初始接入节点作为小节点，有其UICC卡，UICC卡的USIM上会保存一个安全根密钥K，而同时，网络侧的HSS中会相应的保存有这个相同的安全根密钥K，利用这个根密钥，采取图4所示的方法，可以实现MME与SRAN-node1之间的安全认证，然后在MME和SRAN-node1之间执行NAS SMC过程，以及在SRAN-node1和中间路由节点如SRAN-node2之间执行AS SMC过程。
经过步骤1702的以上操作，在SRAN-node1和SRAN-node2之间的Ub1接口上，可以生成用于保护这两个节点之间在Ub1接口上信息传输安全性的Ub口接入层控制面的安全密钥(即K-Ub1RRC int、K-Ub1RRC enc)和用户面安全密钥(即K-Ub1UP int、K-Ub1UP enc)。
在图17所示的逐级节点安全验证的基础上，为进一步提高本发明实施例的UE的接入层控制面和接入层用户面的安全性，本发明实施例如图10中所示的步骤1004的E2E接入层安全模式命令和步骤1006的E2E接入层安全模式完成，如图12所示的步骤1203的消息、步骤1205的消息，以及如图13所示的步骤1304的消息等这些接入层安全相关消息，在经由SRAN-node2或SRAN-node1发送时，可以分别使用Ub2口和Ub1口的Ub口接入层控制面的安全密钥进行加密和完整性保护。
图18为本发明实施例的UE的组成结构示意图，如图18所示，至少包括第一处理模块、第一用户面处理模块以及第一控制面处理模块；其中，
第一处理模块，设置为：与核心网之间实现AKA过程和NAS层安全过程；
第一用户面处理模块，设置为：执行与网关节点之间的端到端用户面接入层安全过程；
第一控制面处理模块，设置为：当UE仅存在微通信路径时，执行UE与初始接入节点之间的端到端控制面接入层安全；或者，当UE存在微通信路径和宏通信路径时，执行UE与宏通信路径中的宏基站之间的端到端控制面接入层安全；
其中，微通信路径为UE通过无线接入链路接入无线接入小节点最终接入核心网的通信路径；宏通信路径为UE通过无线接入链路接入宏基站最终接入核心网的通信路径。
其中，
第一用户面处理模块是设置为：执行与网关节点之间的端到端用户面加密和用户面完整性保护；
第一控制面处理模块是设置为：执行与初始接入节点或者宏基站之间的端到端控制面加密和控制面完整性保护。
其中，
在UE的微通信路径中，UE经过至少两段无线空中接口与核心网通信；其中，微通信路径至少包括UE、初始接入节点、网关节点；
当UE经过大于两段无线空中接口与所述核心网通信时，微通信路径中还包括至少一个中间路由节点。
其中，
初始接入节点为UE通过无线接入链路接入的无线接入小节点；
网关节点为能够通过有线接口接入核心网的无线接入小节点；
中间路由节点为实现初始接入节点和网关节点之间的通信，并最终实现接入初始接入节点的UE与核心网之间的通信提供中继传输的无线接入小节点。
其中，第一用户面处理模块是设置为：在UE的PDCP-s层和网关节点的PDCP-s层之间执行与网关节点之间的端到端用户面接入层安全过程。
具体而言，UE的上层用户面数据发到空中接口之前，在UE的PDCP-s层执行加密和完整性保护，用户面数据发送到网关节点之后，由网关节点在PDCP-s层进行解密和完整性验证；网关节点从核心网获取到需要发送给UE的用户面数据，在发到空中接口之前，在网关节点的PDCP-s层执行加密和完整性保护，数据发送到UE后，由UE在PDCP-s层进行解密和完整性验证。
其中，第一控制面处理模块是设置为：在UE的PDCP协议层和所述初始接入节点或宏基站的PDCP协议层之间执行与初始接入节点或者宏基站之间的端到端控制面接入层安全过程。
具体而言，UE的上行RRC层信令在发送到空中接口之前，在UE的PDCP层执行加密和完整性保护，初始接入节点或者宏基站接收到RRC信令后，执行解密和完整性验证；初始接入节点或者宏基站发送给UE的下行RRC层信令在发送到空中接口之前，在其PDCP层执行加密和完整性保护，UE接收到RRC信令后，执行解密和完整性验证。
图19为本发明实施例的无线接入小节点的组成结构示意图。该无线接入小节点为能够通过有线接口接入核心网的无线接入小节点；如图19所示，
该无线接入小节点至少包括第二用户面处理模块，设置为：执行与UE之间的端到端用户面接入层安全过程；其中，所述端到端用户面接入层安全过程包括端到端用户面加密和用户面完整性保护。
当UE经过两段无线空中接口与所述核心网通信时，无线接入小节点与初始接入节点通过无线回程接口通信；
当UE经过大于两段无线空中接口与核心网通信时，无线接入小节点与中间路由节点通过无线回程接口通信，中间路由节点与初始接入节点通过无线回程接口通信，当中间路由节点为两个或两个以上时，中间路由节点之间通过无线回程接口通信；
其中，
初始接入节点为UE通过无线接入链路接入的无线接入小节点；
中间路由节点为实现初始接入节点和无线接入小节点之间的通信，并最 终实现接入初始接入节点的UE与核心网之间的通信提供中继传输的无线接入小节点。
其中，在无线接入小节点自身的PDCP-s层和UE的PDCP-s之间执行端到端用户面接入层安全过程。
其中，第二用户面处理模块是设置为：
在自身的PDCP-s层对通过空中接口接收到的来自UE的用户面数据进行解密和完整性验证；
从核心网获取到需要发送给UE的用户面数据，在发到空中接口之前，在自身的PDCP-s层执行加密和完整性保护。
该无线接入小节点还包括用户面密钥生成模块，设置为：
在第二用户面处理模块执行与UE之间的端到端用户面加密和用户面完整性保护之前，生成执行端到端用户面加密和用户面完整性保护所需要的用户面加密密钥KUPenc和用户面完整性保护密钥KUPint。
其中，用户面密钥生成模块是设置为：
基于接入层安全根密钥KeNB生成用户面加密密钥KUPenc和用户面完整性保护密钥KUPint；或者，
接收来自宏基站的用户面加密密钥KUPenc和用户面完整性保护密钥KUPint；
其中，KeNB由所述核心网或者宏基站发送给所述无线接入小节点；
其中，宏基站为除所述初始接入节点之外，所述UE通过无线接入链路接入的另一个基站。
和/或，
该无线接入小节点为UE通过无无线接入链路接入的无线接入小节点；如图19所示，
该无线接入小节点至少包括第二控制面处理模块，设置为：执行与UE之间的端到端控制面接入层安全过程；其中，端到端控制面接入层安全过程包括端到端控制面加密和控制面完整性保护。
其中，在无线接入小节点自身的PDCP层和UE的PDCP层之间执行端到端控制面接入层安全过程。
其中，第二控制面处理模块是设置为：接收到RRC信令后，执行解密和完整性验证；在自身的PDCP层对发送给所述UE的下行RRC层信令执行加密和完整性保护后发送到空中接口。
该无线接入小节点还包括控制面密钥生成模块，设置为：
在第二控制面处理模块执行与UE之间的端到端控制面加密和控制面完整性保护之前，生成执行端到端控制面加密和控制面完整性保护所需要的控制面加密密钥KRRCenc和控制面完整性保护密钥KRRCint。
其中，控制面密钥生成模块是设置为：
接收来自网关节点的控制面加密密钥KRRCenc和控制面完整性保护密钥KRRCint，或基于来自网关节点的接入层控制面安全根密钥KeNB*生成控制面加密密钥KRRCenc和控制面完整性保护密钥KRRCint。
如图19所示，本发明实施例的无线接入小节点还包括第二处理模块，设置为：执行逐级节点安全验证；其中，逐级节点安全验证包括：网络对无线接入小节点进行安全验证。
可选地，第二处理模块还设置为：对接入层安全相关消息进行加密和完整性保护。
此外，本发明实施例还提供一种UE，包括处理器和存储器，存储器中存储有处理器可执行的指令，当指令被处理器执行时，执行图18所示模块的功能。
此外，本发明实施例还提供一种无线接入小节点，包括处理器和存储器，存储器中存储有处理器可执行的指令，当指令被处理器执行时，执行图19所示模块的功能。
此外，本发明实施例还提供一种计算机可读存储介质，存储有计算机可执行指令，所述计算机可执行指令被执行时实现上述的实现接入层安全的方法。
本领域普通技术人员可以理解上述方法中的全部或部分步骤可通过程序 来指令相关硬件(例如处理器)完成，所述程序可以存储于计算机可读存储介质中，如只读存储器、磁盘或光盘等。可选地，上述实施例的全部或部分步骤也可以使用一个或多个集成电路来实现。相应地，上述实施例中的各模块/单元可以采用硬件的形式实现，例如通过集成电路来实现其相应功能，也可以采用软件功能模块的形式实现，例如通过处理器执行存储于存储器中的程序/指令来实现其相应功能。本申请不限制于任何特定形式的硬件和软件的结合。
以上所述，仅为本申请的较佳实例而已，并非用于限定本申请的保护范围。凡在本申请的精神和原则之内，所做的任何修改、等同替换、改进等，均应包含在本申请的保护范围之内。
工业实用性
本发明实施例提供一种实现接入层安全的方法、用户设备及无线接入小节点，很好地保证了用户面安全，避免了因为经过多段空中接口也即经过多个中间路由节点导致的安全泄露隐患；在保证控制面安全的前提下减少了控制面安全操作的延时；提高了UE的移动性能；保证了UE用户面数据传输的连续性。

Claims (36)

  1. 一种实现接入层安全的方法，包括：
    执行用户设备UE与网关节点之间的端到端用户面接入层安全；以及，
    当UE仅存在微通信路径时，执行UE与初始接入节点之间的端到端控制面接入层安全；或者，当UE存在微通信路径和宏通信路径时，执行UE与宏通信路径中的宏基站之间的端到端控制面接入层安全；
    其中，微通信路径为UE通过无线接入链路接入无线接入小节点最终接入核心网的通信路径；宏通信路径为UE通过无线接入链路接入宏基站最终接入核心网的通信路径。
  2. 根据权利要求1所述的方法，其中，
    在所述微通信路径中，所述UE经过至少两段无线空中接口与所述核心网通信；
    所述微通信路径至少包括UE、初始接入节点、网关节点；
    当所述UE经过大于两段无线空中接口与所述核心网通信时，所述微通信路径中还包括至少一个中间路由节点。
  3. 根据权利要求2所述的方法，其中，
    所述UE与初始接入节点之间采用无线接入空中接口Uu口；
    所述初始接入节点与网关节点之间采用无线回程接口Ub口。
  4. 根据权利要求2所述的方法，其中，
    所述中间路由节点和所述初始接入节点之间采用无线回程接口Ub口，所述中间路由节点和所述网关节点之间采用无线回程接口Ub口；
    当所述中间路由节点为两个或两个以上时，所述中间路由节点之间采用无线回程接口Ub口。
  5. 根据权利要求2所述的方法，其中，
    所述初始接入节点为所述UE通过无线接入链路接入的无线接入小节点；
    所述网关节点为能够通过有线接口接入所述核心网的无线接入小节点；
    所述中间路由节点为实现所述初始接入节点和网关节点之间的通信，并最终实现接入所述初始接入节点的UE与所述核心网之间的通信提供中继传输的无线接入小节点。
  6. 根据权利要求1或2所述的方法，其中，
    所述执行UE与网关节点之间的端到端用户面接入层安全包括：执行所述UE与所述网关节点之间的端到端用户面加密和用户面完整性保护；
    所述执行UE与初始接入节点或者宏基站之间的端到端控制面接入层安全包括：执行所述UE与所述初始接入节点或者宏基站之间的端到端控制面加密和控制面完整性保护。
  7. 根据权利要求6所述的方法，其中，所述执行UE与网关节点之间的端到端用户面接入层安全包括：
    在所述UE的数据包汇聚协议安全PDCP-s层和所述网关节点的PDCP-s层之间执行所述端到端用户面接入层安全。
  8. 根据权利要求7所述的方法，其中，
    所述UE和所述网关节点的无线回程接口Ub接口侧从下到上分别包括：物理层L1、媒体接入控制层MAC、无线链路控制层RLC、数据包汇聚协议瘦身层PDCP-t和数据包汇聚协议安全层PDCP-s；所述初始接入节点和所述中间路由节点从下到上分别包括L1、MAC和RLC，或者，分别包括L1、MAC、RLC和PDCP-t；
    如果所述UE的PDCP-s层和PDCP-t层合并到一个协议层则为PDCP层；
    如果所述网关节点的PDCP-s层和PDCP-t层合并到一个协议层则为PDCP层。
  9. 根据权利要求7所述的方法，其中，所述执行所述UE与所述网关节点之间的端到端用户面加密和用户面完整性保护包括：
    所述UE的上层用户面数据发到空中接口之前，在所述UE的PDCP-s层执行加密和完整性保护，所述用户面数据发送到所述网关节点之后，由所述网关节点在PDCP-s层进行解密和完整性验证；
    所述网关节点从核心网获取到需要发送给所述UE的用户面数据，在发 到空中接口之前，在所述网关节点的PDCP-s层执行加密和完整性保护，数据发送到所述UE后，由所述UE在PDCP-s层进行解密和完整性验证。
  10. 根据权利要求7所述的方法，其中，所述PDCP-s层用于实现：头压缩和解压缩，以及安全操作；其中，安全操作包括：加密、解密、完整性保护和完整性验证。
  11. 根据权利要求6所述的方法，其中，所述执行所述UE与所述初始接入节点或者宏基站之间的端到端控制面接入层安全包括：
    在所述UE的数据包汇聚协议PDCP层和所述初始接入节点或者宏基站的PDCP层之间执行端到端控制面接入层安全。
  12. 根据权利要求11所述的方法，其中，
    所述UE和所述初始接入节点的无线接入空中接口Uu接口侧从下到上分别包括：物理层L1、媒体接入控制层MAC、无线链路控制层RLC、数据包汇聚协议PDCP层；
    所述初始接入节点、所述中间路由节点和所述网关节点在Ub接口侧从下到上分别包括L1、MAC和RLC，或者，包括L1、MAC、RLC和数据包汇聚协议瘦身PDCP-t层。
  13. 根据权利要求11所述的方法，其中，所述执行所述UE与所述初始接入节点或者宏基站之间的端到端控制面加密和控制面完整性保护包括：
    所述UE的上行无线资源控制RRC层信令在发送到空中接口之前，在所述UE的PDCP层执行加密和完整性保护，所述初始接入节点或者宏基站接收到RRC信令后，执行解密和完整性验证；
    所述初始接入节点或者宏基站发送给UE的下行RRC层信令在发送到空中接口之前，在其PDCP层执行加密和完整性保护，所述UE接收到RRC信令后，执行解密和完整性验证。
  14. 根据权利要求6所述的方法，该方法还包括：所述UE和所述网关节点之间生成执行所述UE与所述网关节点之间的端到端用户面加密和用户面完整性保护所需要的用户面加密密钥KUPenc和用户面完整性保护密钥KUPint，
    当所述UE仅存在微通信路径时，所述UE和所述网关节点之间生成执行所述UE与所述网关节点之间的端到端用户面加密和用户面完整性保护所需要的用户面加密密钥KUPenc和用户面完整性保护密钥KUPint，包括：
    所述UE和所述网关节点基于接入层安全根密钥KeNB生成所述用户面加密密钥KUPenc和用户面完整性保护密钥KUPint；
    其中，所述UE的KeNB为所述UE与所述核心网之间执行鉴权和密钥协商AKA过程和非接入层NAS安全过程后生成的；所述网关节点的KeNB为所述UE与所述核心网之间执行AKA过程和NAS安全过程后，由所述核心网发送给所述网关节点的；
    当UE存在微通信路径和宏通信路径时，所述UE和所述网关节点之间生成执行所述UE与所述网关节点之间的端到端用户面加密和用户面完整性保护所需要的用户面加密密钥KUPenc和用户面完整性保护密钥KUPint，包括：
    所述UE和所述UE的宏通信路径中的宏基站基于KeNB生成所述用户面加密密钥KUPenc和用户面完整性保护密钥KUPint；所述宏基站将生成的用户面加密密钥KUPenc和用户面完整性保护密钥KUPint发送给所述网关节点；或者，
    所述UE和所述网关节点基于KeNB生成执行所述用户面加密密钥KUPenc和用户面完整性保护密钥KUPint；其中，所述网关节点的KeNB由所述宏基站发送给所述网关节点；
    其中，所述UE的KeNB为所述UE与所述核心网之间执行鉴权和密钥协商AKA过程和非接入层NAS安全过程后生成的；所述宏基站的KeNB为所述UE与所述核心网之间执行AKA过程和NAS安全过程后，由所述核心网发送给所述宏基站的。
  15. 根据权利要求6所述的方法，该方法还包括：当所述UE仅存在微通信路径时，生成执行所述UE与所述初始接入节点之间的端到端控制面加密和控制面完整性保护所需要的控制面加密密钥KRRCenc和控制面完整性保护密钥KRRCint，
    其中，所述生成执行所述UE与所述初始接入节点之间的端到端控制面加密和控制面完整性保护所需要的控制面加密密钥KRRCenc和控制面完整性保 护密钥KRRCint，包括：
    所述UE和所述网关节点基于接入层安全根密钥KeNB生成所述控制面加密密钥KRRCenc和控制面完整性保护密钥KRRCint；所述网关节点将所述生成的控制面加密密钥KRRCenc和控制面完整性保护密钥KRRCint发送给所述初始接入节点；或，所述UE和所述网关节点基于KeNB、所述初始接入节点的小区的下行绝对载频号EARFCN-DL和物理小区标识PCI生成接入层控制面安全根密钥KeNB*；所述网关节点将生成的KeNB*发送给所述初始接入节点，所述UE和所述初始接入节点基于所述KeNB*生成所述控制面加密密钥KRRCenc和控制面完整性保护密钥KRRCint；
    或者，
    该方法还包括：当所述UE存在微通信路径和宏通信路径时，生成执行所述UE与所述宏基站之间的端到端控制面加密和控制面完整性保护所需要的控制面加密密钥KRRCenc和控制面完整性保护密钥KRRCint，
    其中，所述生成执行所述UE与所述宏基站之间的端到端控制面加密和控制面完整性保护所需要的控制面加密密钥KRRCenc和控制面完整性保护密钥KRRCint，包括：
    所述UE和所述宏基站基于接入层安全根密钥KeNB生成所述控制面加密密钥KRRCenc和控制面完整性保护密钥KRRCint；
    其中，所述UE的KeNB为所述UE与所述核心网之间执行鉴权和密钥协商AKA过程和非接入层NAS安全过程后生成的；所述网关节点或所述宏基站的KeNB为所述UE与所述核心网之间执行AKA过程和NAS安全过程后，由所述核心网发送给所述网关节点或宏基站的。
  16. 根据权利要求6、14或15所述的方法，其中，所述用户面的密钥和控制面的密钥分别独立更新。
  17. 一种用户设备UE，包括第一处理模块、第一用户面处理模块以及第一控制面处理模块；其中，
    第一处理模块，设置为：与核心网之间实现鉴权和密钥协商AKA过程和非接入层NAS安全过程；
    第一用户面处理模块，设置为：执行与网关节点之间的端到端用户面接入层安全；
    第一控制面处理模块，设置为：当UE仅存在微通信路径时，执行UE与初始接入节点之间的端到端控制面接入层安全；或者，当UE存在微通信路径和宏通信路径时，执行UE与宏通信路径中的宏基站之间的端到端控制面接入层安全；
    其中，微通信路径为UE通过无线接入链路接入无线接入小节点最终接入核心网的通信路径；宏通信路径为UE通过无线接入链路接入宏基站最终接入核心网的通信路径。
  18. 根据权利要求17所述的UE，其中，
    所述第一用户面处理模块是设置为：执行与所述网关节点之间的端到端用户面加密和用户面完整性保护；
    所述第一控制面处理模块是设置为：执行与所述初始接入节点或者宏基站之间的端到端控制面加密和控制面完整性保护。
  19. 根据权利要求17所述的UE，其中，
    在所述UE的微通信路径中，所述UE经过至少两段无线空中接口与所述核心网通信；
    所述微通信路径至少包括UE、初始接入节点、网关节点；
    当所述UE经过大于两段无线空中接口与所述核心网通信时，所述微通信路径中还包括至少一个中间路由节点。
  20. 根据权利要求19所述的UE，其中，
    所述初始接入节点为所述UE通过无线接入链路接入的无线接入小节点；
    所述网关节点为能够通过有线接口接入所述核心网的无线接入小节点；
    所述中间路由节点为实现所述初始接入节点和网关节点之间的通信，并最终实现接入所述初始接入节点的UE与所述核心网之间的通信提供中继传输的无线接入小节点。
  21. 根据权利要求18所述的UE，其中，
    所述第一用户面处理模块是设置为：在所述UE的数据包汇聚协议安全PDCP-s层和所述网关节点的PDCP-s层之间执行所述UE与网关节点之间的端到端用户面接入层安全；
    所述第一控制面处理模块是设置为：在所述UE的数据包汇聚协议PDCP层和所述初始接入节点或者宏基站的PDCP层之间执行所述UE与所述初始接入节点或者宏基站之间的端到端控制面接入层安全。
  22. 根据权利要求18所述的UE，其中，所述第一用户处理模块是设置为：
    在所述UE的上层用户面数据发到空中接口之前，在所述UE的数据包汇聚协议安全PDCP-s层执行加密和完整性保护，其中，所述用户面数据发送到所述网关节点之后，由所述网关节点在PDCP-s层进行解密和完整性验证；
    在所述UE的PDCP-s层对通过空中接口接收到的来自所述网关节点的用户面数据进行解密和完整性验证。
  23. 根据权利要求18所述的UE，其中，所述第一控制面处理模块是设置为：
    所述UE的上行无线资源控制RRC层信令在发送到空中接口之前，在所述UE的数据包协议汇聚协议PDCP层执行加密和完整性保护，其中，所述初始接入节点或者宏基站接收到RRC信令后，执行解密和完整性验证；
    在所述UE接收到所述初始接入节点或者宏基站通过空中接口发送的下行RRC层信令后，执行解密和完整性验证。
  24. 一种无线接入小节点，该无线接入小节点为能够通过有线接口接入核心网的无线接入小节点；
    该无线接入小节点至少包括第二用户面处理模块，设置为：执行与UE之间的端到端用户面接入层安全；其中，所述端到端用户面接入层安全包括端到端用户面加密和用户面完整性保护。
  25. 根据权利要求24所述的无线接入小节点，其中，
    当所述UE经过两段无线空中接口与所述核心网通信时，所述无线接入小节点与初始接入节点通过无线回程接口通信；
    当所述UE经过大于两段无线空中接口与所述核心网通信时，所述无线接入小节点与中间路由节点通过无线回程接口通信，所述中间路由节点与初始接入节点通过无线回程接口通信，当所述中间路由节点为两个或两个以上时，所述中间路由节点之间通过无线回程接口通信；
    其中，
    所述初始接入节点为所述UE通过无线接入链路接入的无线接入小节点；
    所述中间路由节点为实现所述初始接入节点和所述无线接入小节点之间的通信，并最终实现接入所述初始接入节点的UE与所述核心网之间的通信提供中继传输的无线接入小节点。
  26. 根据权利要求24所述的无线接入小节点，其中，在所述无线接入小节点自身的数据包汇聚协议安全PDCP-s层和所述UE的PDCP-s层之间执行所述端到端用户面接入层安全过程。
  27. 根据权利要求26所述的无线接入小节点，其中，所述第二用户面处理模块是设置为：
    在所述自身的PDCP-s层对通过空中接口接收到的来自所述UE的用户面数据进行解密和完整性验证；
    从核心网获取到需要发送给所述UE的用户面数据，在发到空中接口之前，在所述自身的PDCP-s层执行加密和完整性保护。
  28. 根据权利要求24或25所述的无线接入小节点，所述无线接入小节点还包括用户面密钥生成模块，设置为：
    在所述第二用户面处理模块执行与所述UE之间的端到端用户面加密和用户面完整性保护之前，生成执行所述端到端用户面加密和用户面完整性保护所需要的用户面加密密钥KUPenc和用户面完整性保护密钥KUPint。
  29. 根据权利要求28所述的无线接入小节点，其中，所述用户面密钥生成模块是设置为：
    基于接入层安全根密钥KeNB生成所述用户面加密密钥KUPenc和用户面完整性保护密钥KUPint；或者，
    接收来自所述宏基站的所述用户面加密密钥KUPenc和用户面完整性保护 密钥KUPint；
    其中，所述KeNB由所述核心网或者所述宏基站发送给所述无线接入小节点；
    其中，所述宏基站为除所述初始接入节点之外，所述UE通过无线接入链路接入的另一个基站。
  30. 一种无线接入小节点，该无线接入小节点为用户设备UE通过无线接入链路接入的无线接入小节点；
    该无线接入小节点至少包括第二控制面处理模块，设置为：执行与UE之间的端到端控制面接入层安全；其中，所述端到端控制面接入层安全包括端到端控制面加密和控制面完整性保护。
  31. 根据权利要求30所述的无线接入小节点，其中，在所述无线接入小节点自身的数据包汇聚协议PDCP层和所述UE的PDCP层之间执行所述端到端控制面接入层安全过程。
  32. 根据权利要求31所述的无线接入小节点，其中，所述第二控制面处理模块是设置为：
    接收到无线资源控制RRC信令后，执行解密和完整性验证；
    在所述自身的PDCP层对发送给所述UE的下行RRC层信令执行加密和完整性保护后发送到空中接口。
  33. 根据权利要求30所述的无线接入小节点，所述无线接入小节点还包括控制面密钥生成模块，设置为：
    在所述第二控制面处理模块执行与所述UE之间的端到端控制面加密和控制面完整性保护之前，生成执行所述端到端控制面加密和控制面完整性保护所需要的控制面加密密钥KRRCenc和控制面完整性保护密钥KRRCint。
  34. 根据权利要求33所述的无线接入小节点，其中，所述控制面密钥生成模块是设置为：
    接收来自网关节点的控制面加密密钥KRRCenc和控制面完整性保护密钥KRRCint，或基于来自网关节点的接入层控制面安全根密钥KeNB*生成所述控制面加密密钥KRRCenc和控制面完整性保护密钥KRRCint。
  35. 一种无线接入小节点，包括权利要求24～权利要求29任意组合，和权利要求30～权利要求34任意组合的无线接入小节点。
  36. 一种计算机可读存储介质，存储有计算机可执行指令，所述计算机可执行指令被执行时实现权利要求1至16任一项所述的方法。
PCT/CN2016/076741 2015-07-20 2016-03-18 实现接入层安全的方法及用户设备和无线接入小节点 WO2016177143A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US15/744,733 US10136325B2 (en) 2015-07-20 2016-03-18 Method for implementing access stratum security, user equipment, and small radio access network node

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510429851.2 2015-07-20
CN201510429851.2A CN106375989B (zh) 2015-07-20 2015-07-20 实现接入层安全的方法及用户设备和无线接入小节点

Publications (1)

Publication Number Publication Date
WO2016177143A1 true WO2016177143A1 (zh) 2016-11-10

Family

ID=57217471

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/076741 WO2016177143A1 (zh) 2015-07-20 2016-03-18 实现接入层安全的方法及用户设备和无线接入小节点

Country Status (3)

Country Link
US (1) US10136325B2 (zh)
CN (1) CN106375989B (zh)
WO (1) WO2016177143A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP3541105A4 (en) * 2017-05-05 2019-11-20 Huawei Technologies Co., Ltd. COMMUNICATION METHOD AND ASSOCIATED DEVICE

Families Citing this family (12)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP3567802A4 (en) * 2017-01-26 2019-12-25 Huawei Technologies Co., Ltd. METHOD, DEVICE AND SYSTEM FOR PROTECTING DATA
CN108513325B (zh) * 2017-02-28 2022-04-12 中兴通讯股份有限公司 一种无线接入网络系统及集中单元
CN108810899A (zh) * 2017-04-28 2018-11-13 维沃移动通信有限公司 完整性检测方法、终端及网络侧设备
CN107396366B (zh) * 2017-07-24 2020-07-03 北京小米移动软件有限公司 协商加密方式的方法、装置及系统
CN110035431A (zh) * 2018-01-12 2019-07-19 中国移动通信有限公司研究院 信息处理方法及装置、网络实体及存储介质
CN110121168B (zh) * 2018-02-06 2021-09-21 华为技术有限公司 安全协商方法及装置
CN110365470B (zh) * 2018-03-26 2023-10-10 华为技术有限公司 一种密钥生成方法和相关装置
CN112806041B (zh) 2018-10-30 2022-12-13 华为技术有限公司 一种密钥生成方法、设备及系统
EP3751817A1 (en) 2019-06-14 2020-12-16 Samsung Electronics Co., Ltd. Method of dynamically provisioning a key for authentication in relay device
CN112533198A (zh) * 2019-09-02 2021-03-19 中兴通讯股份有限公司 一种密钥生成方法及装置和mme
US20210297853A1 (en) * 2020-03-17 2021-09-23 Qualcomm Incorporated Secure communication of broadcast information related to cell access
CN115843030B (zh) * 2023-01-05 2023-05-05 中国电子科技集团公司第三十研究所 信令防护装置和接入控制方法

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103929740A (zh) * 2013-01-15 2014-07-16 中兴通讯股份有限公司 数据安全传输方法及lte接入网系统
WO2014112262A1 (en) * 2013-01-17 2014-07-24 Nec Corporation Secure communications in a cellular system with split user and control planes
WO2015036047A1 (en) * 2013-09-13 2015-03-19 Nokia Solutions And Networks Oy Uplink inter-site carrier aggregation based on ue transmission power and secondary cell load
WO2015097980A1 (en) * 2013-12-24 2015-07-02 Nec Corporation Apparatus, system and method for sce

Family Cites Families (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
TWI430674B (zh) * 2009-08-14 2014-03-11 Ind Tech Res Inst 用於具有中繼節點之無線通訊系統的安全性方法
CN101945387B (zh) * 2010-09-17 2015-10-21 中兴通讯股份有限公司 一种接入层密钥与设备的绑定方法和系统
US9226206B2 (en) * 2011-09-12 2015-12-29 Ntt Docomo, Inc. Method and apparatus at the physical and link layer for mobile communications
CN103002501A (zh) * 2011-09-19 2013-03-27 北京三星通信技术研究有限公司 一种移动中继的实现方法及系统
KR102078866B1 (ko) * 2013-08-09 2020-02-19 삼성전자주식회사 듀얼 커넥티비티 지원을 위한 pdcp 분산 구조의 보안 키 생성 및 관리 방안
CN104519486B (zh) * 2013-09-29 2018-05-04 中国电信股份有限公司 用于异构网中无线侧密钥更新的方法和系统
GB2519975A (en) * 2013-11-01 2015-05-13 Nec Corp Communication system

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103929740A (zh) * 2013-01-15 2014-07-16 中兴通讯股份有限公司 数据安全传输方法及lte接入网系统
WO2014112262A1 (en) * 2013-01-17 2014-07-24 Nec Corporation Secure communications in a cellular system with split user and control planes
WO2015036047A1 (en) * 2013-09-13 2015-03-19 Nokia Solutions And Networks Oy Uplink inter-site carrier aggregation based on ue transmission power and secondary cell load
WO2015097980A1 (en) * 2013-12-24 2015-07-02 Nec Corporation Apparatus, system and method for sce

Non-Patent Citations (2)

* Cited by examiner, † Cited by third party
Title
HUAWEI ET AL.: "History Discussion on Mobility Anchor", 3GPP TSG-RAN3 MEETING # 87BIS R3-150577, 24 April 2015 (2015-04-24), XP050937195 *
ZTE.: "Deployment Scenarios and Mobility for Small Cell Enhancement", 3GPP TSG-RAN WG3 MEETING #87 R3-150234, 13 February 2015 (2015-02-13), XP050936987 *

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP3541105A4 (en) * 2017-05-05 2019-11-20 Huawei Technologies Co., Ltd. COMMUNICATION METHOD AND ASSOCIATED DEVICE
US10798579B2 (en) 2017-05-05 2020-10-06 Huawei Technologies Co., Ltd Communication method and related apparatus
US10798578B2 (en) 2017-05-05 2020-10-06 Huawei Technologies Co., Ltd. Communication method and related apparatus
US11272360B2 (en) 2017-05-05 2022-03-08 Huawei Technologies Co., Ltd. Communication method and related apparatus

Also Published As

Publication number Publication date
US10136325B2 (en) 2018-11-20
US20180213403A1 (en) 2018-07-26
CN106375989B (zh) 2019-03-12
CN106375989A (zh) 2017-02-01

Similar Documents

Publication Publication Date Title
WO2016177143A1 (zh) 实现接入层安全的方法及用户设备和无线接入小节点
US10477441B2 (en) Method and apparatus to enable multiple wireless connections
JP6786701B2 (ja) ワイヤレスネットワークにおけるカバレージ及びリソース制限デバイスをサポートするためのレイヤ２リレー
WO2016177107A1 (zh) 实现接入层安全的方法及用户设备和节点
US9049594B2 (en) Method and device for key generation
US8605908B2 (en) Method and device for obtaining security key in relay system
WO2019096075A1 (zh) 一种消息保护的方法及装置
KR20220019703A (ko) 릴레이 장치에서 인증을 위한 키를 동적으로 프로비저닝하는 방법
US20220303763A1 (en) Communication method, apparatus, and system
CN113841366B (zh) 通信方法及装置
WO2014190828A1 (zh) 一种安全密钥管理方法、装置和系统
EP2853134A1 (en) Gateway, communication system, method of controlling gateway, and computer readable medium therefor
US10412056B2 (en) Ultra dense network security architecture method
Othman User Ultra-Dense Networks for 5G in urban Areas
Rajhi Security Procedures for User-Centric Ultra-Dense 5G Networks
Chen et al. Usercentric ultra-dense networks for 5g
Ozhelvaci Secure and efficient authentication schemes for 5G heterogeneous networks
Ramakrishna et al. A Study on Multi Wireless Technologies–Architectures and Security Mechanisms
KR20150061856A (ko) 호 설정을 위한 메시지 처리 방법 및 장치와 그를 위한 이동통신 시스템

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16789137

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 15744733

Country of ref document: US

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 16789137

Country of ref document: EP

Kind code of ref document: A1