WO2017012425A1 - 宽带集群系统的共享信道管理方法、系统、终端和基站 - Google Patents

宽带集群系统的共享信道管理方法、系统、终端和基站 Download PDF

Info

Publication number
WO2017012425A1
WO2017012425A1 PCT/CN2016/084579 CN2016084579W WO2017012425A1 WO 2017012425 A1 WO2017012425 A1 WO 2017012425A1 CN 2016084579 W CN2016084579 W CN 2016084579W WO 2017012425 A1 WO2017012425 A1 WO 2017012425A1
Authority
WO
WIPO (PCT)
Prior art keywords
group
group call
temporary identifier
call
terminal
Prior art date
Application number
PCT/CN2016/084579
Other languages
English (en)
French (fr)
Inventor
王心燕
吴涛
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2017012425A1 publication Critical patent/WO2017012425A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/03—Protecting confidentiality, e.g. by encryption
    • H04W12/037—Protecting confidentiality, e.g. by encryption of the control plane, e.g. signalling traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
    • H04W4/06—Selective distribution of broadcast services, e.g. multimedia broadcast multicast service [MBMS]; Services to user groups; One-way selective calling services
    • H04W4/08—User group management
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/02—Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W84/00—Network topologies
    • H04W84/02—Hierarchically pre-organised networks, e.g. paging networks, cellular networks, WLAN [Wireless Local Area Network] or WLL [Wireless Local Loop]
    • H04W84/04—Large scale networks; Deep hierarchical networks
    • H04W84/08—Trunked mobile radio systems

Definitions

  • This document relates to but not limited to the technical field of broadband trunking communication systems, and in particular, to a shared channel management method, system, terminal and base station of a broadband cluster system.
  • the cluster system is developed to meet the needs of industry users' command and dispatch, and is a dedicated wireless communication system for specific industry applications.
  • the cluster system is an efficient wireless communication system that supports a large number of wireless users for group communication with a small number of wireless channels by sharing a wireless channel.
  • the cluster system is mainly composed of an analog cluster system and a narrowband digital communication system, and the basic services that can be provided are concentrated on voice and low-speed data services.
  • the broadband cluster system is based on the evolution of LTE (Long Term Evolution) technology.
  • LTE is a 3GPP (3rd Generation Partnership Project) long-term evolution project.
  • the LTE network adopts a flattened architecture, and the eNB (evolved Node B) is deployed in a decentralized manner. control.
  • eNB evolved Node B
  • LTE has developed security management related protocols to effectively protect the security of signaling flows and media stream data between different network elements.
  • the broadband cluster system inherits the basic architecture of LTE.
  • LTE When the broadband trunking system provides the group call service, because multiple listening users adopt the shared downlink channel, LTE does not have a security management related protocol for this shared channel. A certain security risk.
  • the embodiments of the present invention provide a shared channel management method, system, terminal, and base station of a broadband cluster system, which can implement encryption of a shared channel and improve security of the broadband cluster system.
  • the embodiment of the invention provides a shared channel management method for a broadband cluster system, the method comprising:
  • the core network When the group is created, the core network generates a group root key for the group, and sends the group root key to the terminal in the group;
  • the base station When the group call is established, the base station receives the group root key sent by the core network, and the base station generates a group call parameter and allocates a group call wireless network temporary identifier for the group call sharing channel;
  • the base station encrypts the temporary identity of the group call radio network according to the group root key and the group call parameter, and generates an encrypted group call radio network temporary identifier
  • the encrypted group call radio network temporary identifier is decrypted.
  • the step of the base station assigning a group call radio network temporary identifier to the group call sharing channel includes:
  • the base station acquires group feature information corresponding to the terminal that initiates the group call;
  • the base station allocates a group call wireless network temporary identifier to the group call sharing channel according to the group feature information.
  • the group feature information includes group identification information
  • the step of the base station for assigning a group call wireless network temporary identifier to the group call sharing channel according to the group feature information includes:
  • the base station acquires the temporary call identifier of the group call wireless network corresponding to the group identifier information corresponding to the terminal device according to the mapping relationship between the preset group identifier information and the temporary identifier of the group call radio network, and uses the obtained group call radio network temporary identifier as The group call wireless network temporary identifier of the group call sharing channel.
  • the method further includes:
  • the core network updates the group root key of the group, and delivers the updated group root key to the terminal in the group.
  • the embodiment of the invention further provides a shared channel management method for a broadband cluster system, including:
  • the core network When the group is created, the core network generates a group root key for the group, and sends the group root key to the terminal in the group;
  • the core network When the group call is established, the core network generates a group root key to the base station.
  • the method further includes:
  • the core network updates the group root key of the group, and delivers the updated group root key to the terminal in the group.
  • the embodiment of the invention further provides a shared channel management method for a broadband cluster system, including:
  • the base station When the group call is established, the base station receives the group root key sent by the core network, and the base station generates a group call parameter and allocates a group call wireless network temporary identifier for the group call sharing channel;
  • the base station encrypts the temporary identity of the group call radio network according to the group root key and the group call parameter, and generates an encrypted group call radio network temporary identifier
  • the encrypted group call radio network temporary identifier is decrypted.
  • the step of the base station assigning a group call radio network temporary identifier to the group call sharing channel includes:
  • the base station acquires group feature information corresponding to the terminal that initiates the group call;
  • the base station allocates a group call wireless network temporary identifier to the group call sharing channel according to the group feature information.
  • the group feature information includes group identification information.
  • the step of the base station for assigning a group call wireless network temporary identifier to the group call sharing channel according to the group feature information includes:
  • the base station acquires the temporary call identifier of the group call wireless network corresponding to the group identifier information corresponding to the terminal according to the mapping relationship between the preset group identifier information and the temporary identifier of the group call radio network, and obtains the temporary identifier of the group call radio network as the location The group call wireless network temporary identifier of the group call sharing channel.
  • the embodiment of the invention further provides a shared channel management system for a broadband cluster system, the system Including the core network and base stations, where:
  • the core network is configured to generate a group root key for the group when the group is created, and send the group root key to the terminal in the group; when the group call is established, go to the base station The generated group root key;
  • the base station is configured to receive a group root key sent by the core network when the group call is established, generate a group call parameter, and allocate a group call wireless network temporary identifier for the group call sharing channel; and use the group root according to the group root
  • the key, the group call parameter encrypts the temporary call identifier of the group call radio network, and generates an encrypted temporary call identifier of the group call radio network; and is configured to send the encrypted group call radio network temporary identifier and the group call parameter
  • the terminal in the group is configured to decrypt, by the terminal, the encrypted group call radio network temporary identifier according to the group root key and the group call parameter.
  • the base station is configured to allocate a group call wireless network temporary identifier for the group call sharing channel in the following manner:
  • the group feature information includes group identification information
  • the base station is configured to allocate, according to the group feature information, a group call wireless network temporary identifier according to the group feature information:
  • the core network is further configured to: when the update trigger condition is met, update the group root key of the group, and deliver the updated group root key to the terminal in the group.
  • the embodiment of the invention further provides a terminal, where the terminal includes:
  • the interaction module is configured to receive, when the group is created, the group root key of the group to which the terminal belongs, and the group call parameter and the encrypted group sent by the base station when the group call is established. Calling the wireless network temporary identifier, the encrypted group call wireless network temporary identifier is generated by the base station to encrypt the group call wireless network temporary identifier generated by the base station according to the group root key and the group call parameter;
  • Decrypting module configured to decrypt the received encrypted group call wireless network temporary identifier according to the group root key and the group call parameter;
  • the descrambling module is configured to descramble the shared channel according to the decrypted group call radio network temporary identifier, so that the terminal communicates through the shared channel.
  • An embodiment of the present invention further provides a base station, where the base station includes:
  • the receiving module is configured to receive the group root key delivered by the core network when the group call is established;
  • Generating a module configured to generate a group call parameter and allocate a group call wireless network temporary identifier for the group call shared channel when the group call is established;
  • the encryption module is configured to encrypt the temporary identifier of the group call wireless network according to the group root key and the group call parameter, and generate an encrypted temporary call identifier of the group call wireless network;
  • a sending module configured to send the encrypted group call radio network temporary identifier and the group call parameter to the terminal in the group, where the terminal encrypts the receiving according to the group root key and the group call parameter The subsequent group calls the wireless network temporary identifier for decryption.
  • the shared channel management method, the system, the terminal, and the base station of the broadband cluster system in the embodiment of the present invention when the group is created, the core network generates a group root key for the group, and the group root key is sent to the a terminal in the group; when the group call is established, the base station receives a group root key sent by the core network, and the base station generates a group call parameter and allocates a group call wireless network temporary identifier for the group call shared channel; The base station encrypts the temporary identity of the group call radio network according to the group root key and the group call parameter, and generates an encrypted group call radio network temporary identifier; the base station temporarily suspends the encrypted group call radio network The identifier and the group call parameter are sent to the terminal in the group, and the terminal decrypts the received encrypted group call wireless network temporary identifier according to the group root key and the group call parameter; The key is sent to the terminal by the network side, and the temporary call identifier of the group call radio network of the shared channel is encrypted only at the physical
  • FIG. 1 is a schematic flow chart of an alternative embodiment of a shared channel management method for a broadband trunking system according to the present invention
  • FIG. 2 is a schematic flowchart of a method for allocating a group call wireless network temporary identifier for a group call sharing channel when a group call is established in a shared channel management method of a broadband cluster system according to an embodiment of the present invention
  • FIG. 3 is a flowchart of a shared channel management method of another broadband cluster system according to an embodiment of the present invention.
  • FIG. 4 is a flowchart of a shared channel management method of another broadband cluster system according to an embodiment of the present invention.
  • FIG. 5 is a schematic structural diagram of an optional embodiment of a shared channel management system of a broadband cluster system according to the present invention.
  • FIG. 6 is a schematic structural diagram of an optional embodiment of a terminal according to the present invention.
  • FIG. 7 is a schematic structural diagram of an alternative embodiment of a base station according to the present invention.
  • FIG. 1 is a schematic flowchart of an alternative embodiment of a method for managing a shared channel of a broadband cluster system according to the present invention.
  • the method includes:
  • the core network When the group is created, the core network generates a group root key for the group, and sends the group root key to the terminal in the group.
  • the core network When the group is created, the core network generates a group root key Kg for the group, and the group root key Kg of each group can be mutually exclusive to ensure the privacy and security of the group communication.
  • the terminal in the group establishes a point-to-point secure connection with the core network.
  • the terminal uses the key K stored on the terminal to establish a NAS ((Non Access Stratum) and AS (Access Stratum) with the core network.
  • the core network sends the group root key Kg of the group to which the terminal belongs to the corresponding terminal through a secure channel.
  • the delivery process may be performed multiple times. For example, when the terminal belongs to the group 1 and the group 2, the sending process includes: the first sending process is to send the group root key corresponding to the group 1 to the terminal, and the second sending process is performed.
  • the group root key corresponding to the group 2 is delivered to the terminal.
  • the group root key can be a value, such as 12345; the group root key can also be a string, such as Abc_de 134; the group root key can also be an array, such as A[8,9,0,1]
  • the group root key may also be a vector with multiple meanings, such as a vector carrying a key value, a fixed encrypted identity (ID), or multiple optional encryption method IDs, check codes, and the like.
  • the root key can be generated directly by using a random number generator, or can be generated by using a group identification GID (Group Identification) and a random number using function (such as using a KDF (key derivation function)). Can be generated manually, and so on.
  • the root key of the group remains unchanged.
  • the core network can regenerate the new one.
  • the root key of the group is sent, and the newly generated group root key is sent to the terminal.
  • the terminal When the terminal is initially attached to the core network, the terminal establishes a point-to-point connection with the core network, and applies a single-call key architecture. After the terminal passes the authentication and authentication of the core network and successfully activates the security mode, the terminal and the core network The point-to-point NAS and AS secure channels are successfully established, and the data transmitted between the core network and the terminal can be encrypted and integrity protected.
  • the core network encrypts and sends the group root key Kg of the group to which the terminal belongs to the terminal in the group information update message. The terminal saves the received Kg for the specific security management process when the subsequent group call is established.
  • the group information update message further includes a group identifier GID.
  • the base station receives the group root key sent by the core network, and the base station generates a group call parameter and allocates a group call wireless network temporary identifier for the group call shared channel.
  • the group call parameter Group Call Rand is similar to the group root key.
  • the group call parameter can be a value, such as 567235.
  • the group call parameter can also be a string, such as shgie_125?
  • the group call parameter can also be an array such as A[8,9,0,1]; the group call parameter can also be a vector with multiple meanings, such as carrying random values, encryption method IDs, check codes, etc. vector.
  • the group call parameter can be generated directly by the random number generator, or can be generated by using the group identifier GID and the random number using function, or can be generated by manual setting, and the like.
  • the group call parameters are randomly generated or artificially generated each time a group call is established.
  • the base station receives the group root key delivered by the core network, and the base station allocates a Group Radio Network Temporary Identifier (G-RNTI) for the group call sharing channel, and different group call sharing channels.
  • G-RNTI Group Radio Network Temporary Identifier
  • the group call wireless network temporary identifiers are different from each other.
  • the group call The wireless network temporary identifier is used for physical layer scrambling on the network side and physical layer descrambling on the terminal side.
  • the base station encrypts the temporary call identifier of the group call according to the group root key and the group call parameter, and generates an encrypted group call radio network temporary identifier.
  • the base key and the group may be set by using a preset encryption algorithm, such as by using a KDF function.
  • the call parameter and the group call wireless network temporary identifier derive the encrypted group call wireless network temporary identifier, and can also be implemented by other existing encryption algorithms.
  • the base station sends the encrypted group call radio network temporary identifier and the group call parameter to the terminal in the group, where the terminal encrypts the received group according to the group root key and the group call parameter. Call the wireless network temporary identifier for decryption.
  • the base station sends the encrypted group call radio network temporary identifier and the group call parameter to the terminal through the air interface paging message, and the terminal encrypts the received according to the received group root key and the group call parameter.
  • the group call wireless network temporary identifier is decrypted, and the encrypted group call wireless network temporary identifier is decrypted according to the reverse process of encrypting the group call wireless network temporary identifier, and the decrypted group call wireless network temporary identifier is obtained.
  • the decrypted group call radio network temporary identifier is the same as the group call radio network temporary identifier generated by the network side; the terminal descrambles the shared channel according to the decrypted group call radio network temporary identifier, so that the terminal passes the sharing The channel communicates.
  • the method further includes: when the update trigger condition is met, the core network updates the group root key of the group, and sends the updated group root key to the terminal in the group.
  • the trigger condition may be that the member in the group changes or the security period is reached.
  • the security period may be set according to requirements. For example, if the security period is set to 10 days, the group root key corresponding to the group is updated every 10 days. By updating the group root key of the group through this step, the problem of security risks caused by the leakage of the group root key can be avoided.
  • a group root key is generated for the group, and the group root key is sent to the terminal in the group;
  • the base station when the group call is established, the base station generates a group call parameter and Assigning a group call wireless network temporary identifier to the group call shared channel;
  • the base station encrypts the group call wireless network temporary identifier according to the group root key and the group call parameter, and generates an encrypted group call wireless network temporary identifier;
  • the base station encrypts the group call
  • the subsequent group call radio network temporary identifier and group call parameters are sent to the terminals in the group,
  • the terminal decrypts the received encrypted group call radio network temporary identifier according to the group root key and the group call parameter;
  • the group root key is sent by the network side to the terminal, and only at the physical layer to the shared channel
  • the group calls the temporary identification of the wireless network to encrypt and protect the shared channel.
  • the configuration of the related LTE security protocol is relatively small. The modification on the terminal side does not involve the software
  • FIG. 2 is a schematic flowchart of a detailed process of assigning a group call radio network temporary identifier to a group call sharing channel in a shared channel management method of a broadband cluster system according to an embodiment of the present invention, as follows:
  • the base station acquires group feature information corresponding to the terminal that initiates the group call.
  • the base station can directly receive the group feature information corresponding to the terminal that initiates the group call that is sent by the terminal that initiates the group call, and the base station can also send the group feature information to the terminal that initiates the group call. And requesting, by the terminal that receives the group call, the group feature information corresponding to the terminal that initiated the group call returned according to the group feature information acquisition request.
  • the group characteristic information includes group identification information, and the group identification information is group identification information of a group to which the terminal belongs.
  • the group feature information corresponding to the terminal device may be extracted from the radio resource control RRC signaling by receiving radio resource control RRC (Radio Resource Control) signaling from the terminal.
  • RRC Radio Resource Control
  • the base station allocates a group call radio network temporary identifier to the group call sharing channel according to the group feature information.
  • the base station allocates a group call radio network temporary identifier to the group call sharing channel according to the group feature information, for example, the group call wireless network corresponding to the group call sharing channel can be generated by the random number generator according to the group feature information.
  • Temporary identification The group call wireless network temporary identifiers of different group call sharing channels are different from each other.
  • the step of the base station assigning the group call wireless network temporary identifier to the group call sharing channel according to the group feature information includes: the base station temporarily and the group call wireless network according to the preset group identification information.
  • the mapping relationship of the identifiers is obtained, and the group identification information corresponding to the terminal is obtained.
  • the group call for the wireless network temporary identifier, and the obtained group call wireless network temporary identifier is used as the group call wireless network temporary identifier of the group call shared channel.
  • the mapping relationship between the group identification information and the group call wireless network temporary identifier may be preset by the administrator, and the mapping relationship between the group identification information and the group call wireless network temporary identifier may be updated in time.
  • the base station searches for the acquired group identification information in the mapping relationship between the group identification information and the group call radio network temporary identifier, and the acquisition exists in the mapping relationship between the group identifier information and the group call radio network temporary identifier.
  • the group call radio network temporary identifier corresponding to the acquired group identifier information is read out as a group call radio network temporary identifier of the group call sharing channel; when the group identification information and the group call radio network temporary identifier are used
  • the obtained group identification information does not exist in the mapping relationship, a new group call wireless network temporary identifier is generated for the acquired group identification information, as a group call wireless network temporary identifier of the group call sharing channel, and the The obtained group identification information and the newly generated group call wireless network temporary identifier are recorded in the mapping relationship between the group identification information and the group call wireless network temporary identifier.
  • an embodiment of the present invention further provides a shared channel management method for a broadband cluster system, including:
  • Step 300 When the group is created, the core network generates a group root key for the group, and sends the group root key to the terminal in the group.
  • the core network When the group is created, the core network generates a group root key Kg for the group, and the group root key Kg of each group can be mutually exclusive to ensure the privacy and security of the group communication.
  • the terminal in the group establishes a point-to-point secure connection with the core network.
  • the terminal uses the key K stored on the terminal to establish a NAS ((Non Access Stratum) and AS (Access Stratum) with the core network.
  • the core network sends the group root key Kg of the group to which the terminal belongs to the corresponding terminal through a secure channel.
  • the delivery process may be performed multiple times. For example, when the terminal belongs to the group 1 and the group 2, the sending process includes: the first sending process is to send the group root key corresponding to the group 1 to the terminal, and the second sending process is performed.
  • the group root key corresponding to the group 2 is delivered to the terminal.
  • the group root key can be a value, such as 12345; the group root key can also be a string, such as Abc_de 134; the group root key can also be an array, such as A[8,9,0,1]
  • the group root key can also be a vector with multiple meanings, such as carrying a key value, a fixed encrypted identity (ID, Identification) or a plurality of optional encryption method IDs, check codes, etc. vectors.
  • the root key can be generated directly by using a random number generator, or can be generated by using a group identification GID (Group Identification) and a random number using function (such as using a KDF (key derivation function)). Can be generated manually, and so on.
  • the root key of the group remains unchanged.
  • the core network can regenerate the new one.
  • the root key of the group is sent, and the newly generated group root key is sent to the terminal.
  • the terminal When the terminal is initially attached to the core network, the terminal establishes a point-to-point connection with the core network, and applies a single-call key architecture. After the terminal passes the authentication and authentication of the core network and successfully activates the security mode, the terminal and the core network The point-to-point NAS and AS secure channels are successfully established, and the data transmitted between the core network and the terminal can be encrypted and integrity protected.
  • the core network encrypts and sends the group root key Kg of the group to which the terminal belongs to the terminal in the group information update message. The terminal saves the received Kg for the specific security management process when the subsequent group call is established.
  • the group information update message further includes a GID.
  • Step 301 When the group call is established, the core network generates a group root key to the base station.
  • the method further includes: when the update trigger condition is met, the core network updates the group root key of the group, and sends the updated group root key to the terminal in the group.
  • the trigger condition may be that the member in the group changes or the security period is reached.
  • the security period may be set according to requirements. For example, if the security period is set to 10 days, the group root key corresponding to the group is updated every 10 days. By updating the group root key of the group through this step, the problem of security risks caused by the leakage of the group root key can be avoided.
  • an embodiment of the present invention further provides a shared channel management method for a broadband cluster system, including:
  • Step 400 When the group call is established, the base station receives the group root key sent by the core network, and the base station generates a group call parameter and allocates a group call wireless network temporary identifier for the group call shared channel.
  • the group call parameter Group Call Rand is similar to the group root key.
  • the group call parameter can be a value, such as 567235.
  • the group call parameter can also be a string, such as shgie_125?
  • the group call parameter can also be an array such as A[8,9,0,1]; the group call parameter can also be a vector with multiple meanings, such as carrying A vector of random values, encryption method IDs, check codes, and the like.
  • the group call parameter can be generated directly by the random number generator, or can be generated by using the group identifier GID and the random number using function, or can be generated by manual setting, and the like.
  • the group call parameters are randomly generated or artificially generated each time a group call is established.
  • the base station receives the group root key delivered by the core network, and the base station allocates a Group Radio Network Temporary Identifier (G-RNTI) for the group call sharing channel, and different group call sharing channels.
  • G-RNTI Group Radio Network Temporary Identifier
  • the group call wireless network temporary identifiers are different from each other.
  • the group call radio network temporary identifier is used for physical layer scrambling on the network side and physical layer descrambling on the terminal side.
  • the base station allocates a group call wireless network temporary identifier for the group call shared channel, including:
  • the base station acquires group feature information corresponding to the terminal that initiates the group call; the base station allocates a group call wireless network temporary identifier to the group call sharing channel according to the group feature information.
  • the base station can directly receive the group feature information corresponding to the terminal that initiates the group call that is sent by the terminal that initiates the group call, and the base station can also send the group feature information to the terminal that initiates the group call. And requesting, by the terminal that receives the group call, the group feature information corresponding to the terminal that initiated the group call returned according to the group feature information acquisition request.
  • the group characteristic information includes group identification information, and the group identification information is group identification information of a group to which the terminal belongs.
  • the group feature information corresponding to the terminal device may be extracted from the radio resource control RRC signaling by receiving radio resource control RRC (Radio Resource Control) signaling from the terminal.
  • RRC Radio Resource Control
  • the base station allocates a group call radio network temporary identifier to the group call sharing channel according to the group characteristic information, and the group call radio network temporary identifier corresponding to the group call sharing channel may be generated by the random number generator according to the group characteristic information.
  • the group call wireless network temporary identifiers of different group call sharing channels are different from each other.
  • the step of the base station assigning the group call wireless network temporary identifier to the group call sharing channel according to the group feature information includes: the base station temporarily and the group call wireless network according to the preset group identification information. And the group call radio network temporary identifier corresponding to the group identifier information corresponding to the terminal, and the obtained group call radio network temporary identifier is used as the group call radio network temporary identifier of the group call sharing channel.
  • the mapping relationship between the group identification information and the group call wireless network temporary identifier may be preset by the administrator, and the mapping relationship between the group identification information and the group call wireless network temporary identifier may be updated in time.
  • the base station searches for the acquired group identification information in the mapping relationship between the group identification information and the group call radio network temporary identifier, and the acquisition exists in the mapping relationship between the group identifier information and the group call radio network temporary identifier.
  • the group call radio network temporary identifier corresponding to the acquired group identifier information is read out as a group call radio network temporary identifier of the group call sharing channel; when the group identification information and the group call radio network temporary identifier are used
  • the obtained group identification information does not exist in the mapping relationship, a new group call wireless network temporary identifier is generated for the acquired group identification information, as a group call wireless network temporary identifier of the group call sharing channel, and the The obtained group identification information and the newly generated group call wireless network temporary identifier are recorded in the mapping relationship between the group identification information and the group call wireless network temporary identifier.
  • Step 401 The base station encrypts the temporary call identifier of the group call according to the group root key and the group call parameter, and generates an encrypted group call radio network temporary identifier.
  • the base key and the group may be set by using a preset encryption algorithm, such as by using a KDF function.
  • the call parameter and the group call wireless network temporary identifier derive the encrypted group call wireless network temporary identifier, and can also be implemented by other existing encryption algorithms.
  • Step 402 The base station sends the encrypted group call radio network temporary identifier and the group call parameter to the terminal in the group, where the terminal encrypts the received according to the group root key and the group call parameter.
  • the group calls the wireless network temporary identifier for decryption.
  • the base station sends the encrypted group call radio network temporary identifier and the group call parameter to the terminal through the air interface paging message, and the terminal encrypts the received according to the received group root key and the group call parameter.
  • the group call wireless network temporary identifier is decrypted, and the encrypted group call wireless network temporary identifier is decrypted according to the reverse process of encrypting the group call wireless network temporary identifier, and the decrypted group call wireless network temporary identifier is obtained.
  • the decrypted group call radio network temporary identifier is the same as the group call radio network temporary identifier generated by the network side; the terminal descrambles the shared channel according to the decrypted group call radio network temporary identifier, so that the terminal passes the sharing The channel communicates.
  • Embodiments of the present invention also provide a computer readable storage medium storing computer executable instructions for performing any of the methods described above.
  • FIG. 5 is a schematic structural diagram of an optional embodiment of a shared channel management system of a broadband cluster system according to the present invention.
  • the system includes a core network 10 and a base station 20, where:
  • the core network 10 is configured to generate a group root key for the group when the group is created, and send the group root key to the terminal in the group; when the group call is established, the group base 20 is generated.
  • Group root key for the group when the group is created, and send the group root key to the terminal in the group; when the group call is established, the group base 20 is generated.
  • the base station 20 is configured to receive a group root key sent by the core network when the group call is established, generate a group call parameter, and allocate a group call wireless network temporary identifier for the group call sharing channel; and set the root density according to the group
  • the key and the group call parameter are used to encrypt the temporary call identifier of the group call wireless network, and generate the encrypted temporary call identifier of the group call wireless network; and set the encrypted group call radio network temporary identifier and the group call parameter to the group.
  • the terminal in the group for the terminal to decrypt the received group call wireless network temporary identifier according to the group root key and the group call parameter.
  • the core network 10 When the group is created, the core network 10 generates a group root key Kg for the group, and the group root key Kg of each group may not overlap each other to ensure the privacy and security of the group communication.
  • the terminal in the group establishes a point-to-point secure connection with the core network 10, and the terminal establishes a NAS ((Non Access Stratum) and AS (Access Stratum) with the core network 10 using the key K stored on the terminal. a security channel of the access layer.
  • the core network 10 sends the group root key Kg of the group to which the terminal belongs to the corresponding terminal through a secure channel; when a terminal belongs to multiple groups, the delivery process may be performed. Multiple times, such as when the terminal belongs to the group 1 and the group 2, the delivery process includes: the first delivery process is to send the group root key corresponding to the group 1 to the terminal, and the second The sending process is to send the group root key corresponding to the group 2 to the terminal.
  • the group root key can be a value, such as 12345; the group root key can also be a string, such as Abc_de 134; the group root key can also be an array, such as A[8,9,0,1]
  • the group root key may also be a vector with multiple meanings, such as a vector carrying a key value, a fixed encryption ID, or multiple optional encryption method IDs, check codes, and the like.
  • the group root key can be generated directly by using a random number generator, or can use a group identifier GID (Group Identification, GID, group identity,) and a random number usage function (such as using a KDF function, (key derivation function, key derivation function) )) generated, can also be generated by manual setting, and so on.
  • GID Group Identification, GID, group identity,
  • a random number usage function such as using a KDF function, (key derivation function, key derivation function)
  • the root key of the group is always kept unchanged.
  • the core network 10 may be regenerated. A new group root key is sent to the terminal.
  • the terminal When the terminal is initially attached to the core network 10, the terminal establishes a point-to-point connection with the core network 10, and applies a single-call key architecture. After the terminal passes the authentication and authentication of the core network 10 and successfully activates the security mode, the terminal and the terminal The point-to-point NAS and AS secure channels are successfully established between the core networks 10, and the data transmitted between the core network 10 and the terminals can be encrypted and integrity protected.
  • the core network 10 encrypts and transmits the group root key Kg of the group to which the terminal belongs to the terminal in the group information update message. The terminal saves the received Kg for the specific security management process when the subsequent group call is established.
  • the group call parameter Group Call Rand is similar to the group root key.
  • the group call parameter can be a value, such as 567235.
  • the group call parameter can also be a string, such as shgie_125?
  • the group call parameter can also be an array such as A[8,9,0,1]; the group call parameter can also be a vector with multiple meanings, such as carrying random values, encryption method IDs, check codes, etc. vector.
  • the group call parameter can be generated directly by the random number generator, or can be generated by using the group identifier GID and the random number using function, or can be generated by manual setting, and the like.
  • the group call parameters are randomly generated or artificially generated each time a group call is established.
  • the base station 20 receives the group root key delivered by the core network when the group call is established, and allocates the group call radio network temporary identifier G-RNTI for the group call sharing channel, and the group call radio network temporary identifier of the different group call sharing channel. Different from each other.
  • the group call radio network temporary identifier is used for physical layer scrambling on the system side and physical layer descrambling on the terminal side.
  • the base station 20 When the base station 20 encrypts the temporary identifier of the group call radio network according to the group root key and the group call parameter, the base group key and the group call parameter may be determined by a preset encryption algorithm, such as by using a KDF function.
  • the group call wireless network temporary identifier derives the encrypted group call wireless network temporary identifier, and can also pass other existing encryption algorithms.
  • the base station 20 also sends the encrypted group call radio network temporary identifier and the group call parameter to the terminal through the air interface paging message, and the terminal receives the encrypted group call according to the received group root key and the group call parameter.
  • the wireless network temporary identifier is decrypted, and the encrypted group call wireless temporary identifier is decrypted according to the reverse process of encrypting the group call wireless network temporary identifier, and the decrypted group call wireless network temporary identifier is obtained, and the decrypted group call wireless network temporary identifier is obtained.
  • the group call radio network temporary identifier is the same as the group call radio network temporary identifier generated by the system side; the terminal descrambles the shared channel according to the decrypted group call radio network temporary identifier, so that the terminal communicates through the shared channel.
  • the core network 10 is further configured to update the group root of the group when the update trigger condition is met.
  • the key is sent to the terminal in the group.
  • the trigger condition may be that the member in the group changes or the security period is reached.
  • the security period may be set according to requirements. For example, if the security period is set to 10 days, the group root key corresponding to the group is updated every 10 days. By updating the group root key of the group through the core network 10, the problem of security risks caused by the leakage of the group root key can be avoided.
  • the base station 20 is configured to allocate, by using the following manner, a group call radio network temporary identifier for the group call sharing channel: acquiring group feature information corresponding to the terminal that initiates the group call, and using the group feature information as the group call sharing The channel allocation group calls the wireless network temporary identifier.
  • the base station 20 may directly receive the group feature information corresponding to the terminal that initiated the group call initiated by the terminal that initiates the group call, or may first send the group feature information acquisition request to the terminal that initiates the group call. And receiving, by the terminal that initiates the group call, the group feature information corresponding to the terminal that initiated the group call returned according to the group feature information acquisition request.
  • the group characteristic information includes group identification information, and the group identification information is group identification information of a group to which the terminal belongs.
  • the base station 20 may receive the radio resource control RRC (Radio Resource Control) signaling from the terminal, and extract the group feature corresponding to the terminal device from the radio resource control RRC signaling. information.
  • RRC Radio Resource Control
  • the base station 20 allocates a group call radio network temporary identifier to the group call sharing channel according to the set of feature information.
  • the group call radio network temporary identifier corresponding to the group call sharing channel may be generated by the random number generator according to the group of feature information.
  • the group call wireless network temporary identifiers of different group call sharing channels are different from each other.
  • the base station 20 is configured to allocate the group call wireless network temporary identifier for the group call shared channel according to the group feature information in the following manner: according to the preset group identification information and the group call wireless network.
  • the temporary identity mapping relationship is obtained by acquiring the group call wireless network temporary identifier corresponding to the group identifier information corresponding to the terminal device, and the obtained group call wireless network temporary identifier is used as the group call wireless network temporary identifier of the group call sharing channel.
  • the mapping relationship between the group identification information and the group call wireless network temporary identifier may be preset by the administrator, and the mapping relationship between the group identification information and the group call wireless network temporary identifier may be performed in a timely manner.
  • the base station 20 searches for the acquired group identification information in the mapping relationship between the group identification information and the group call radio network temporary identifier, and the acquired group identifier information exists in the mapping relationship between the group identifier information and the group call radio network temporary identifier.
  • the temporary call identifier of the group call radio network corresponding to the obtained group identifier information is read as the temporary identifier of the radio network of the group call shared channel; and the mapping relationship between the group identifier information and the temporary identifier of the group call radio network does not exist.
  • a new group call wireless network temporary identifier is generated for the acquired group identification information, as a group call wireless network temporary identifier of the group call sharing channel, and the acquired group identification information is The newly generated group call wireless network temporary identifier is recorded in the mapping relationship between the group identification information and the group call wireless network temporary identifier.
  • FIG. 6 is a schematic structural diagram of an optional embodiment of a terminal according to the present invention, where the terminal includes:
  • the interaction module 31 is configured to receive the group root key of the group to which the terminal belongs, and to receive the group call parameter sent by the base station and the encrypted group call wireless network temporary identifier when the group call is established.
  • the encrypted group call radio network temporary identifier is generated by the base station by using the group root key and the group call parameter to encrypt the group call radio network temporary identifier generated by the base station;
  • the decryption module 32 is configured to decrypt the received encrypted group call wireless network temporary identifier according to the group root key and the group call parameter;
  • the descrambling module 33 is configured to descramble the shared channel according to the decrypted group call radio network temporary identifier, so that the terminal communicates through the shared channel.
  • the core network When the group is created, the core network generates a group root key Kg for the group, and the group root key Kg of each group can be mutually exclusive to ensure the privacy and security of the group communication.
  • the terminal in the group establishes a point-to-point secure connection with the core network.
  • the terminal uses the key K stored on the terminal to establish a NAS ((Non Access Stratum) and AS (Access Stratum) with the core network.
  • the core network sends the group root key Kg of the group to which the terminal belongs to the corresponding terminal through a secure channel.
  • the delivery process may be performed multiple times. For example, when the terminal belongs to the group 1 and the group 2, the sending process includes: the first sending process is to send the group root key corresponding to the group 1 to the terminal, and the second sending process is performed. For the group The group root key corresponding to group 2 is sent to the terminal.
  • the terminal receives the group root key delivered by the core network through the interaction module 31.
  • the group root key Kg can be a value, such as 12345; the group root key can also be a string, such as Abc_de 134; the group root key can also be an array, such as A[8,9,0,1
  • the group root key may also be a vector with multiple meanings, such as a vector carrying a key value, a fixed encryption ID, or multiple optional encryption method IDs, check codes, and the like.
  • the group root key Kg can be generated directly by using a random number generator, or can use a group identification GID (Group Identification, GID, group identity,) and a random number usage function (such as using a KDF function, (key derivation function, key derivation) The function)) is generated, it can also be generated by manual setting, and so on.
  • the root key of the group is always kept unchanged.
  • the core network can be regenerated. A new group root key is sent to the terminal.
  • the terminal When the terminal is initially attached to the core network, the terminal establishes a point-to-point connection with the core network, and applies a single-call key architecture. After the terminal passes the authentication and authentication of the core network and successfully activates the security mode, the terminal and the core network The point-to-point NAS and AS secure channels are successfully established, and the data transmitted between the core network and the terminal can be encrypted and integrity protected.
  • the core network encrypts and sends the group root key of the group to which the terminal belongs to the terminal in the group information update message. The terminal saves the specific security management process that is received for subsequent group call establishment.
  • the group call parameter Group Call Rand is similar to the group root key Kg.
  • the group call parameter can be a value, such as 567235; the group call parameter can also be a string, such as shgie_125?
  • the group call parameter can also be an array such as A[8,9,0,1]; the group call parameter can also be a vector with multiple meanings, such as carrying random values, encryption method IDs, check codes, etc. vector.
  • the group call parameter can be generated directly by the random number generator, or can be generated by using the group identifier GID and the random number using function, or can be generated by manual setting, and the like.
  • the group call parameters are randomly generated or artificially generated each time a group call is established.
  • the interaction module 31 of the terminal receives the group call parameter sent by the base station.
  • the base station allocates a group call radio network temporary identifier G-RNTI for the group call sharing channel, and the group call radio network temporary identifiers of different group call sharing channels are different from each other.
  • the group call radio network temporary identifier is used for physical layer scrambling on the system side and physical layer descrambling on the terminal side.
  • the base station encrypts the temporary call identifier of the group call according to the group root key and the group call parameter to generate an encrypted group call radio network temporary identifier, and the base station wirelessly selects the group call according to the group root key and the group call parameter.
  • the group root key, the group call parameter, and the group call wireless network temporary identifier may be derived by using a preset encryption algorithm, such as a KDF function, to derive the encrypted group call wireless network temporary identifier. It is also possible to pass other existing encryption algorithms.
  • the terminal receives the encrypted group call wireless network temporary identifier sent by the base station through the interaction module 31.
  • the decryption module 32 decrypts the received encrypted group call wireless network temporary identifier according to the group root key and the group call parameter, and performs the reverse process of encrypting the group call wireless network temporary identifier before the base station, and encrypts the encrypted
  • the group call wireless network temporary identifier is decrypted, and the decrypted group call wireless network temporary identifier is obtained, and the decrypted group call wireless network temporary identifier is the same as the group call wireless network temporary identifier generated by the base station.
  • the descrambling module 33 descrambles the shared channel according to the decrypted group call radio network temporary identifier, so that the terminal communicates through the shared channel.
  • FIG. 7 is a schematic structural diagram of an optional embodiment of a base station according to the present invention, where the base station includes:
  • the receiving module 21 is configured to receive the group root key delivered by the core network when the group call is established;
  • the generating module 22 is configured to generate a group call parameter and allocate a group call wireless network temporary identifier for the group call sharing channel when the group call is established;
  • the encryption module 23 is configured to encrypt the temporary call identifier of the group call according to the group root key and the group call parameter, and generate an encrypted temporary call identifier of the group call wireless network;
  • the sending module 24 is configured to send the encrypted group call radio network temporary identifier and the group call parameter to the terminal in the group, where the terminal receives the encrypted group according to the group root key and the group call parameter. Call the wireless network temporary identifier for decryption.
  • the group root key is generated by the core network.
  • the group root key Kg is generated for the group, and the group root key Kg of each group can be mutually exclusive to ensure group communication. Privacy and security.
  • the core network sends the created group root key to the base station when the group call is established.
  • the group root key Kg can be a value, such as 12345; the group root key can also be a string, such as Abc_de 134; the group root key can also be an array, such as A[8,9,0,1
  • the group The root key Kg may also be a vector with multiple meanings, such as a vector carrying a key value, a fixed encrypted ID, or a plurality of optional encryption method IDs, check codes, and the like.
  • the group root key can be generated directly by using a random number generator, or can use a group identifier GID (Group Identification, GID, group identity,) and a random number usage function (such as using a KDF function, (key derivation function, key derivation function) )) generated, can also be generated by manual setting, and so on.
  • GID Group Identification, GID, group identity,
  • KDF function key derivation function, key derivation function
  • the root key Kg of the group is always kept unchanged.
  • the group root key may be leaked and the security risk is caused, for example, when the group member changes, a new one may be regenerated.
  • the root key Kg is set and the newly generated group root key is sent to the terminal.
  • the group call parameter Group Call Rand is similar to the group root key.
  • the group call parameter can be a value, such as 567235.
  • the group call parameter can also be a string, such as shgie_125?
  • the group call parameter can also be an array such as A[8,9,0,1]; the group call parameter can also be a vector with multiple meanings, such as carrying random values, encryption method IDs, check codes, etc. vector.
  • the group call parameter can be generated directly by the random number generator, or can be generated by using the group identifier GID and the random number using function, or can be generated by manual setting, and the like.
  • the group call parameters are randomly generated or artificially generated each time a group call is established.
  • the generating module 22 allocates a group call radio network temporary identifier G-RNTI for the group call sharing channel, and the group call radio network temporary identifiers of different group call sharing channels are different from each other.
  • the group call radio network temporary identifier is used for physical layer scrambling on the system side and physical layer descrambling on the terminal side.
  • the root key and the group call parameter may be set by using a preset encryption algorithm, such as by using a KDF function.
  • the group call wireless network temporary identifier derives the encrypted group call wireless network temporary identifier, and can also pass other existing encryption algorithms.
  • the sending module 24 sends the encrypted group call radio network temporary identifier and the group call parameter to the terminal through the air interface paging message, and the terminal receives the encrypted group call according to the received group root key and the group call parameter.
  • the wireless network temporary identifier is decrypted, and the encrypted group call wireless network temporary identifier is decrypted according to the reverse process of encrypting the group call wireless network temporary identifier, and the decrypted group call wireless network temporary identifier is obtained, and the decrypted group call wireless network temporary identifier is obtained.
  • the group call radio network temporary identifier is the same as the group call radio network temporary identifier generated by the system side (base station); the terminal descrambles the shared channel according to the decrypted group call radio network temporary identifier, so that the terminal passes the sharing Channel through letter.
  • each module/unit in the foregoing embodiment may be implemented in the form of hardware, for example, by implementing an integrated circuit to implement its corresponding function, or may be implemented in the form of a software function module, for example, executing a program in a storage and a memory by a processor. / instruction to achieve its corresponding function.
  • the invention is not limited to any specific form of combination of hardware and software.
  • the above technical solution realizes encryption of the shared channel and improves the security of the broadband cluster system.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Multimedia (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

一种宽带集群系统的共享信道管理方法，该方法包括：在群组创建时，核心网为群组生成组根密钥，并将组根密钥下发给群组中的终端；在组呼建立时，基站接收核心网下发的组根密钥，及基站生成组呼参数及为组呼共享信道分配组呼无线网络临时标识；基站根据组根密钥、组呼参数对组呼无线网络临时标识进行加密，生成加密后的组呼无线网络临时标识；基站将加密后的组呼无线网络临时标识和组呼参数下发给群组中的终端，供终端根据组根密钥和组呼参数对接收的加密后的组呼无线网络临时标识进行解密。

Description

宽带集群系统的共享信道管理方法、系统、终端和基站 技术领域
本文涉及但不限于宽带集群通信系统技术领域，尤其涉及一种宽带集群系统的共享信道管理方法、系统、终端和基站。
背景技术
集群系统是为了满足行业用户指挥调度需求而开发的，面向特定行业应用的专用无线通信系统。集群系统是一种高效的无线通信系统，通过共享无线信道，以较少的无线信道数量支持大量的无线用户进行群组通信。目前，集群系统以模拟集群系统和窄带数字通信系统为主，能够提供的基本业务集中在语音和低速数据业务方面。
随着移动互联网的飞速发展，以及全球无线城市的大规模建设，宽带化成为整个无线通信发展的趋势，集群系统也向提供更大的信道容量，更多的业务类型，更高的数据带宽等方向发展。宽带集群系统就是在这种背景下，基于LTE(Long Term Evolution，长期演进)技术演进而来的。
LTE是3GPP(3rd Generation Partnership Project，第三代合作伙伴计划)长期演进项目，LTE网络采取扁平化的架构，eNB(evolved Node B，演进的基站)部署分散化，运营商无法对其实行安全集中控制。为了用户能安全地使用网络，以及网络向合法的用户提供服务，LTE中制订了安全管理的相关协议，以有效保护不同网元间信令流和媒体流数据的安全。
宽带集群系统继承了LTE的基本架构，宽带集群系统在提供组呼业务时，由于多个听用户是采取共享下行信道的方式，LTE中并没有针对这种共享信道制定安全管理的相关协议，存在一定的安全隐患。
上述内容仅用于辅助理解本发明实施例的技术方案，并不代表承认上述内容是现有技术。
发明内容
以下是对本文详细描述的主题的概述。本概述并非是为了限制权利要求 的保护范围。
本发明实施例提供一种宽带集群系统的共享信道管理方法、系统、终端和基站，能够实现对共享信道进行加密，提高宽带集群系统的安全性。
本发明实施例提供一种宽带集群系统的共享信道管理方法，该方法包括：
在群组创建时，核心网为群组生成组根密钥，并将所述组根密钥下发给所述群组中的终端；
在组呼建立时，基站接收核心网下发的组根密钥，及所述基站生成组呼参数及为组呼共享信道分配组呼无线网络临时标识；
所述基站根据所述组根密钥、组呼参数对所述组呼无线网络临时标识进行加密，生成加密后的组呼无线网络临时标识；
所述基站将所述加密后的组呼无线网络临时标识和组呼参数下发给所述群组中的终端，供所述终端根据所述组根密钥和组呼参数对所述接收的加密后的组呼无线网络临时标识进行解密。
可选地，所述基站为组呼共享信道分配组呼无线网络临时标识的步骤包括：
所述基站获取发起组呼的终端对应的组特征信息；
所述基站根据所述组特征信息为所述组呼共享信道分配组呼无线网络临时标识。
可选地，所述组特征信息包括组标识信息；
所述基站所述根据所述组特征信息为所述组呼共享信道分配组呼无线网络临时标识的步骤包括：
所述基站根据预设的组标识信息与组呼无线网络临时标识的映射关系，获取所述终端设备对应的组标识信息对应的组呼无线网络临时标识，将获得的组呼无线网络临时标识作为组呼共享信道的组呼无线网络临时标识。
可选地，该方法还包括：
在满足更新触发条件时，所述核心网更新群组的组根密钥，并将更新后的组根密钥下发给所述群组中的终端。
本发明实施例还提出了一种宽带集群系统的共享信道管理方法，包括：
在群组创建时，核心网为群组生成组根密钥，并将所述组根密钥下发给所述群组中的终端；
在组呼建立时，核心网向基站下发生成的组根密钥。
可选的，该方法还包括：
在满足更新触发条件时，所述核心网更新群组的组根密钥，并将更新后的组根密钥下发给所述群组中的终端。
本发明实施例还提出了一种宽带集群系统的共享信道管理方法，包括：
在组呼建立时，基站接收核心网下发的组根密钥，及所述基站生成组呼参数及为组呼共享信道分配组呼无线网络临时标识；
所述基站根据所述组根密钥、组呼参数对所述组呼无线网络临时标识进行加密，生成加密后的组呼无线网络临时标识；
所述基站将所述加密后的组呼无线网络临时标识和组呼参数下发给所述群组中的终端，供所述终端根据所述组根密钥和组呼参数对所述接收的加密后的组呼无线网络临时标识进行解密。
可选的，所述基站为组呼共享信道分配组呼无线网络临时标识的步骤包括：
所述基站获取发起组呼的终端对应的组特征信息；
所述基站根据所述组特征信息为所述组呼共享信道分配组呼无线网络临时标识。
可选的，所述组特征信息包括组标识信息；
所述基站所述根据所述组特征信息为所述组呼共享信道分配组呼无线网络临时标识的步骤包括：
所述基站根据预设的组标识信息与组呼无线网络临时标识的映射关系，获取所述终端对应的组标识信息对应的组呼无线网络临时标识，将获得的组呼无线网络临时标识作为所述组呼共享信道的组呼无线网络临时标识。
本发明实施例还提供一种宽带集群系统的共享信道管理系统，所述系统 包括核心网和基站，其中：
所述核心网，设置为在群组创建时，为群组生成组根密钥，并将所述组根密钥下发给所述群组中的终端；在组呼建立时，向基站下发生成的组根密钥；
所述基站，设置为在组呼建立时，接收核心网下发的组根密钥，并生成组呼参数及为组呼共享信道分配组呼无线网络临时标识；及用于根据所述组根密钥、组呼参数对所述组呼无线网络临时标识进行加密，生成加密后的组呼无线网络临时标识；及用于将所述加密后的组呼无线网络临时标识和组呼参数下发给所述群组中的终端，供所述终端根据所述组根密钥和组呼参数对所述接收加密后的组呼无线网络临时标识进行解密。
可选地，所述基站是设置为采用以下方式实现为组呼共享信道分配组呼无线网络临时标识：
获取发起组呼的终端对应的组特征信息，及根据所述组特征信息为所述组呼共享信道分配组呼无线网络临时标识。
可选地，所述组特征信息包括组标识信息；
所述基站是设置为采用以下方式实现根据所述组特征信息为所述组呼共享信道分配组呼无线网络临时标识：
根据预设的组标识信息与组呼无线网络临时标识的映射关系，获取所述终端设备对应的组标识信息对应的组呼无线网络临时标识，将所述获取的组呼无线网络临时标识作为组呼共享信道的组呼无线网络临时标识。
可选地，所述核心网还设置为：在满足更新触发条件时，更新群组的组根密钥，并将更新后的组根密钥下发给所述群组中的终端。
本发明实施例还提供一种终端，所述终端包括：
交互模块，设置为在群组创建时，接收核心网下发的所述终端所属群组的组根密钥，以及，在组呼建立时，接收基站下发的组呼参数和加密后的组呼无线网络临时标识，所述加密后的组呼无线网络临时标识由所述基站根据组根密钥、组呼参数对所述基站生成的组呼无线网络临时标识进行加密生成；
解密模块，设置为根据所述组根密钥和组呼参数对所述接收的加密后的组呼无线网络临时标识进行解密；
解扰模块，设置为根据所述解密后的组呼无线网络临时标识对共享信道进行解扰，以使所述终端通过该共享信道进行通信。
本发明实施例还提供一种基站，所述基站包括：
接收模块，设置为在组呼建立时，接收核心网下发的组根密钥；
生成模块，设置为在组呼建立时，生成组呼参数及为组呼共享信道分配组呼无线网络临时标识；
加密模块，设置为根据所述组根密钥、组呼参数对所述组呼无线网络临时标识进行加密，生成加密后的组呼无线网络临时标识；
发送模块，设置为将所述加密后的组呼无线网络临时标识和组呼参数下发给群组中的终端，供所述终端根据所述组根密钥和组呼参数对所述接收加密后的组呼无线网络临时标识进行解密。
本发明实施例的宽带集群系统的共享信道管理方法、系统、终端和基站，通过在群组创建时，核心网为群组生成组根密钥，并将所述组根密钥下发给所述群组中的终端；在组呼建立时，所述基站接收核心网下发的组根密钥，及所述基站生成组呼参数及为组呼共享信道分配组呼无线网络临时标识；所述基站根据所述组根密钥、组呼参数对所述组呼无线网络临时标识进行加密，生成加密后的组呼无线网络临时标识；所述基站将所述加密后的组呼无线网络临时标识和组呼参数下发给所述群组中的终端，供所述终端根据所述组根密钥和组呼参数对所述接收的加密后的组呼无线网络临时标识进行解密；组根密钥由网络侧下发给终端，且仅在物理层对共享信道的组呼无线网络临时标识进行加密，对共享信道进行安全保护，对相关LTE安全协议架构改动较小，在终端侧的改动不涉及SIM卡的软件接口变化，容易做到向后兼容。
在阅读并理解了附图和详细描述后，可以明白其他方面。
附图概述
图1为本发明宽带集群系统的共享信道管理方法的可选实施例的流程示意图；
图2为本发明实施例宽带集群系统的共享信道管理方法中在组呼建立时，为组呼共享信道分配组呼无线网络临时标识的详细流程示意图；
图3为本发明实施例另一宽带集群系统的共享信道管理方法的流程图；
图4为本发明实施例另一宽带集群系统的共享信道管理方法的流程图；
图5为本发明宽带集群系统的共享信道管理系统的可选实施例的结构示意图；
图6为本发明终端的可选实施例的结构示意图；
图7为本发明基站的可选实施例的结构示意图。
本发明的实施方式
应当理解，此处所描述的具体实施例仅仅用以解释本发明，并不用于限定本发明。
参照图1，图1为本发明宽带集群系统的共享信道管理方法的可选实施例的流程示意图，该方法包括：
S10、在群组创建时，核心网为群组生成组根密钥，并将该组根密钥下发给该群组中的终端。
在群组创建时，核心网为群组生成组根密钥Kg，每个群组的组根密钥Kg可以互不重复，以保证群组通信的私密性和安全性。
群组中的终端与核心网建立点到点的安全连接，终端使用保存在终端上的密钥K，与核心网建立NAS((Non Access Stratum，非接入层)和AS(Access Stratum，接入层)的安全通道。核心网通过安全通道将终端所属群组的组根密钥Kg下发给对应的终端；当一个终端属于多个群组时，该下发过程可能要进行多次，如当该终端属于群组1和群组2时，则该下发过程包括：第一个下发过程为将群组1对应的组根密钥下发给该终端，第二个下发过程为将群组2对应的组根密钥下发给该终端。
该组根密钥可以是一个数值，如12345；该组根密钥也可以是一个字符串，如Abc_de134；该组根密钥也可以是一个数组，如A[8,9,0,1]；该组根密钥也可以是带有多种含义的向量，如携带密钥值、固定的加密身份标识(ID，Identification)或多个可选的加密方法ID、校验码等的向量。该组根密钥可以直接使用随机数发生器生成，也可以使用组标识GID(Group Identification，群体身份)与随机数使用函数(如使用KDF(key derivation function，密钥派生函数))产生，也可以通过人工设置的方式生成，等等。
在群组创建后，通常情况下，该组根密钥一直保持不变，在涉及到组根密钥可能会泄露导致安全隐患时，例如当群组成员发生变化时，核心网可重新生成新的组根密钥，并将新生成的组根密钥下发给终端。
在该终端初始附着到核心网时，终端与核心网建立点到点的连接，应用单呼密钥架构，在终端通过核心网的认证鉴权，并成功激活安全模式之后，终端与核心网之间成功建立了点到点的NAS和AS安全通道，之后在核心网和终端之间传输的数据可以得到加密和完整性保护。核心网将该终端所属组的组根密钥Kg在组信息更新消息中加密发送给终端。终端保存收到的Kg，用于后续组呼建立时的具体安全管理过程。
其中，组信息更新消息还包括组标识GID。
S20、在组呼建立时，基站接收核心网下发的组根密钥，及该基站生成组呼参数及为组呼共享信道分配组呼无线网络临时标识。
该组呼参数Group Call Rand与组根密钥类似，组呼参数可以是一个数值，如567235；组呼参数也可以是一个字符串，如shgie_125？；该组呼参数也可是一个数组如A[8,9,0,1]；该组呼参数也可以是带有多种含义的向量，如携带随机数值、加密方法ID、校验码等的向量。该组呼参数可以直接由随机数发生器生成，也可以使用组标识GID与随机数使用函数产生，也可以通过人工设置的方式生成，等等。在每次组呼建立时，该组呼参数随机产生或人工生成。
在该步骤中，基站接收核心网下发的组根密钥，且该基站为组呼共享信道分配组呼无线网络临时标识(G-RNTI，Group Radio Network Temporary Identifier)，不同的组呼共享信道的组呼无线网络临时标识互不相同。该组呼 无线网络临时标识在网络侧用于物理层加扰，在终端侧用于物理层解扰。
S30、该基站根据该组根密钥、组呼参数对该组呼无线网络临时标识进行加密，生成加密后的组呼无线网络临时标识。
在该步骤中，该基站根据该组根密钥、组呼参数对该组呼无线网络临时标识进行加密时，可通过预设的加密算法，如通过KDF函数，将该组根密钥、组呼参数和该组呼无线网络临时标识派生出加密后的组呼无线网络临时标识，还可以通过其它现有的加密算法实现。
S40、该基站将该加密后的组呼无线网络临时标识和组呼参数下发给该群组中的终端，供该终端根据该组根密钥和组呼参数对该接收的加密后的组呼无线网络临时标识进行解密。
在该步骤中，该基站将该加密后的组呼无线网络临时标识和组呼参数通过空口寻呼消息下发给终端，终端根据接收到的组根密钥和组呼参数对接收的加密后的组呼无线网络临时标识进行解密，按照之前对组呼无线网络临时标识进行加密的逆过程，对该加密后的组呼无线网络临时标识进行解密，得到解密后的组呼无线网络临时标识，该解密后的组呼无线网络临时标识与网络侧生成的组呼无线网络临时标识相同；该终端根据该解密后的组呼无线网络临时标识对共享信道进行解扰，以使得该终端通过该共享信道进行通信。
可选的，该方法还包括：在满足更新触发条件时，该核心网更新群组的组根密钥，并将更新后的组根密钥下发给该群组中的终端。
该触发条件可以为群组中的成员发生变化或者安全周期达到，该安全周期可根据需要设置，如可将安全周期设置为10天，则每10天更新一次群组对应的组根密钥。通过该步骤更新群组的组根密钥，可避免由于组根密钥泄露而导致安全隐患的问题。
采用上述实施例，通过在群组创建时，为群组生成组根密钥，并将该组根密钥下发给该群组中的终端；在组呼建立时，基站生成组呼参数及为组呼共享信道分配组呼无线网络临时标识；基站根据该组根密钥、组呼参数对该组呼无线网络临时标识进行加密，生成加密后的组呼无线网络临时标识；基站将该加密后的组呼无线网络临时标识和组呼参数下发给该群组中的终端， 供该终端根据该组根密钥和组呼参数对该接收的加密后的组呼无线网络临时标识进行解密；组根密钥由网络侧下发给终端，且仅在物理层对共享信道的组呼无线网络临时标识进行加密，对共享信道进行安全保护，对相关LTE安全协议架构改动较小，在终端侧的改动不涉及客户识别模块(SIM，Subscriber Identity Module)卡的软件接口变化，容易做到向后兼容。
参照图2，图2为本发明实施例宽带集群系统的共享信道管理方法中在组呼建立时，该基站为组呼共享信道分配组呼无线网络临时标识的详细流程示意图，详述如下：
S21、在组呼建立时，该基站获取发起组呼的终端对应的组特征信息。
在组呼建立时，该基站可直接接收该发起组呼的终端主动发送过来的该发起组呼的终端对应的组特征信息，该基站也可以先向该发起组呼的终端发送组特征信息获取请求，然后接收该发起组呼的终端根据该组特征信息获取请求返回的该发起组呼的终端对应的组特征信息。
该组特征信息包括组标识信息，该组标识信息即为该终端所属组的组标识信息。
在一实施例中，在组呼建立时，可通过接收来自终端的无线资源控制RRC(Radio Resource Control)信令，从该无线资源控制RRC信令中提取该终端设备对应的组特征信息。
S22、该基站根据该组特征信息为该组呼共享信道分配组呼无线网络临时标识。
在该步骤中，该基站根据该组特征信息为该组呼共享信道分配组呼无线网络临时标识，如可根据该组特征信息由随机数发生器生成该组呼共享信道对应的组呼无线网络临时标识。不同的组呼共享信道的组呼无线网络临时标识互不相同。
当该组特征信息包括组标识信息时，该基站根据该组特征信息为该组呼共享信道分配组呼无线网络临时标识的步骤包括：该基站根据预设的组标识信息与组呼无线网络临时标识的映射关系，获取该终端对应的组标识信息对 应的组呼无线网络临时标识，将该获得的组呼无线网络临时标识作为组呼共享信道的组呼无线网络临时标识。
该组标识信息与组呼无线网络临时标识的映射关系可由管理者预先设置，还可以适时的对该组标识信息与组呼无线网络临时标识的映射关系进行更新。在该步骤中，该基站在该组标识信息与组呼无线网络临时标识的映射关系中查找该获取的组标识信息，当该组标识信息与组呼无线网络临时标识的映射关系中存在该获取的组标识信息时，将该获取的组标识信息对应的组呼无线网络临时标识读取出来，作为组呼共享信道的组呼无线网络临时标识；当该组标识信息与组呼无线网络临时标识的映射关系中不存在该获取的组标识信息时，则重新为该获取的组标识信息生成一个新的组呼无线网络临时标识，作为组呼共享信道的组呼无线网络临时标识，并将该获取的组标识信息和新生成的组呼无线网络临时标识记录在组标识信息与组呼无线网络临时标识的映射关系中。
参照图3，本发明实施例还提出了一种宽带集群系统的共享信道管理方法，包括：
步骤300、在群组创建时，核心网为群组生成组根密钥，并将该组根密钥下发给该群组中的终端。
在群组创建时，核心网为群组生成组根密钥Kg，每个群组的组根密钥Kg可以互不重复，以保证群组通信的私密性和安全性。
群组中的终端与核心网建立点到点的安全连接，终端使用保存在终端上的密钥K，与核心网建立NAS((Non Access Stratum，非接入层)和AS(Access Stratum，接入层)的安全通道。核心网通过安全通道将终端所属群组的组根密钥Kg下发给对应的终端；当一个终端属于多个群组时，该下发过程可能要进行多次，如当该终端属于群组1和群组2时，则该下发过程包括：第一个下发过程为将群组1对应的组根密钥下发给该终端，第二个下发过程为将群组2对应的组根密钥下发给该终端。
该组根密钥可以是一个数值，如12345；该组根密钥也可以是一个字符串，如Abc_de134；该组根密钥也可以是一个数组，如A[8,9,0,1]；该组根密钥也可以是带有多种含义的向量，如携带密钥值、固定的加密身份标识(ID， Identification)或多个可选的加密方法ID、校验码等的向量。该组根密钥可以直接使用随机数发生器生成，也可以使用组标识GID(Group Identification，群体身份)与随机数使用函数(如使用KDF(key derivation function，密钥派生函数))产生，也可以通过人工设置的方式生成，等等。
在群组创建后，通常情况下，该组根密钥一直保持不变，在涉及到组根密钥可能会泄露导致安全隐患时，例如当群组成员发生变化时，核心网可重新生成新的组根密钥，并将新生成的组根密钥下发给终端。
在该终端初始附着到核心网时，终端与核心网建立点到点的连接，应用单呼密钥架构，在终端通过核心网的认证鉴权，并成功激活安全模式之后，终端与核心网之间成功建立了点到点的NAS和AS安全通道，之后在核心网和终端之间传输的数据可以得到加密和完整性保护。核心网将该终端所属组的组根密钥Kg在组信息更新消息中加密发送给终端。终端保存收到的Kg，用于后续组呼建立时的具体安全管理过程。
其中，组信息更新消息还包括GID。
步骤301、在组呼建立时，核心网向基站下发生成的组根密钥。
可选的，该方法还包括：在满足更新触发条件时，该核心网更新群组的组根密钥，并将更新后的组根密钥下发给该群组中的终端。
该触发条件可以为群组中的成员发生变化或者安全周期达到，该安全周期可根据需要设置，如可将安全周期设置为10天，则每10天更新一次群组对应的组根密钥。通过该步骤更新群组的组根密钥，可避免由于组根密钥泄露而导致安全隐患的问题。
参照图4，本发明实施例还提出了一种宽带集群系统的共享信道管理方法，包括：
步骤400、在组呼建立时，基站接收核心网下发的组根密钥，及该基站生成组呼参数及为组呼共享信道分配组呼无线网络临时标识。
该组呼参数Group Call Rand与组根密钥类似，组呼参数可以是一个数值，如567235；组呼参数也可以是一个字符串，如shgie_125？；该组呼参数也可是一个数组如A[8,9,0,1]；该组呼参数也可以是带有多种含义的向量，如携带 随机数值、加密方法ID、校验码等的向量。该组呼参数可以直接由随机数发生器生成，也可以使用组标识GID与随机数使用函数产生，也可以通过人工设置的方式生成，等等。在每次组呼建立时，该组呼参数随机产生或人工生成。
在该步骤中，基站接收核心网下发的组根密钥，且该基站为组呼共享信道分配组呼无线网络临时标识(G-RNTI，Group Radio Network Temporary Identifier)，不同的组呼共享信道的组呼无线网络临时标识互不相同。该组呼无线网络临时标识在网络侧用于物理层加扰，在终端侧用于物理层解扰。
本步骤中，基站为组呼共享信道分配组呼无线网络临时标识包括：
该基站获取发起组呼的终端对应的组特征信息；该基站根据该组特征信息为该组呼共享信道分配组呼无线网络临时标识。
在组呼建立时，该基站可直接接收该发起组呼的终端主动发送过来的该发起组呼的终端对应的组特征信息，该基站也可以先向该发起组呼的终端发送组特征信息获取请求，然后接收该发起组呼的终端根据该组特征信息获取请求返回的该发起组呼的终端对应的组特征信息。
该组特征信息包括组标识信息，该组标识信息即为该终端所属组的组标识信息。
在一实施例中，在组呼建立时，可通过接收来自终端的无线资源控制RRC(Radio Resource Control)信令，从该无线资源控制RRC信令中提取该终端设备对应的组特征信息。
该基站根据该组特征信息为该组呼共享信道分配组呼无线网络临时标识，如可根据该组特征信息由随机数发生器生成该组呼共享信道对应的组呼无线网络临时标识。不同的组呼共享信道的组呼无线网络临时标识互不相同。
当该组特征信息包括组标识信息时，该基站根据该组特征信息为该组呼共享信道分配组呼无线网络临时标识的步骤包括：该基站根据预设的组标识信息与组呼无线网络临时标识的映射关系，获取该终端对应的组标识信息对应的组呼无线网络临时标识，将该获得的组呼无线网络临时标识作为组呼共享信道的组呼无线网络临时标识。
该组标识信息与组呼无线网络临时标识的映射关系可由管理者预先设置，还可以适时的对该组标识信息与组呼无线网络临时标识的映射关系进行更新。在该步骤中，该基站在该组标识信息与组呼无线网络临时标识的映射关系中查找该获取的组标识信息，当该组标识信息与组呼无线网络临时标识的映射关系中存在该获取的组标识信息时，将该获取的组标识信息对应的组呼无线网络临时标识读取出来，作为组呼共享信道的组呼无线网络临时标识；当该组标识信息与组呼无线网络临时标识的映射关系中不存在该获取的组标识信息时，则重新为该获取的组标识信息生成一个新的组呼无线网络临时标识，作为组呼共享信道的组呼无线网络临时标识，并将该获取的组标识信息和新生成的组呼无线网络临时标识记录在组标识信息与组呼无线网络临时标识的映射关系中。
步骤401、该基站根据该组根密钥、组呼参数对该组呼无线网络临时标识进行加密，生成加密后的组呼无线网络临时标识。
在该步骤中，该基站根据该组根密钥、组呼参数对该组呼无线网络临时标识进行加密时，可通过预设的加密算法，如通过KDF函数，将该组根密钥、组呼参数和该组呼无线网络临时标识派生出加密后的组呼无线网络临时标识，还可以通过其它现有的加密算法实现。
步骤402、该基站将该加密后的组呼无线网络临时标识和组呼参数下发给该群组中的终端，供该终端根据该组根密钥和组呼参数对该接收的加密后的组呼无线网络临时标识进行解密。
在该步骤中，该基站将该加密后的组呼无线网络临时标识和组呼参数通过空口寻呼消息下发给终端，终端根据接收到的组根密钥和组呼参数对接收的加密后的组呼无线网络临时标识进行解密，按照之前对组呼无线网络临时标识进行加密的逆过程，对该加密后的组呼无线网络临时标识进行解密，得到解密后的组呼无线网络临时标识，该解密后的组呼无线网络临时标识与网络侧生成的组呼无线网络临时标识相同；该终端根据该解密后的组呼无线网络临时标识对共享信道进行解扰，以使得该终端通过该共享信道进行通信。
本发明实施例还提出了一种计算机可读存储介质，存储有计算机可执行指令，计算机可执行指令用于执行上述描述的任意一个方法。
参照图5，图5为本发明宽带集群系统的共享信道管理系统的可选实施例的结构示意图，该系统包括核心网10和基站20，其中：
该核心网10，设置为在群组创建时，为群组生成组根密钥，并将该组根密钥下发给群组中的终端；在组呼建立时，向该基站20下发生成的组根密钥；
该基站20，设置为在组呼建立时，接收核心网下发的组根密钥，并生成组呼参数及为组呼共享信道分配组呼无线网络临时标识；及设置为根据该组根密钥、组呼参数对该组呼无线网络临时标识进行加密，生成加密后的组呼无线网络临时标识；及设置为将该加密后的组呼无线网络临时标识和组呼参数下发给该群组中的终端，供该终端根据该组根密钥和组呼参数对该接收加密后的组呼无线网络临时标识进行解密。
在群组创建时，核心网10为群组生成组根密钥Kg，每个群组的组根密钥Kg可以互不重复，以保证群组通信的私密性和安全性。
群组中的终端与核心网10建立点到点的安全连接，终端使用保存在终端上的密钥K，与核心网10建立NAS((Non Access Stratum，非接入层)和AS(Access Stratum，接入层)的安全通道。核心网10通过安全通道将终端所属群组的组根密钥Kg下发给对应的终端；当一个终端属于多个群组时，该下发过程可能要进行多次，如当该终端属于群组1和群组2时，则该下发过程包括：第一个下发过程为将群组1对应的组根密钥下发给该终端，第二个下发过程为将群组2对应的组根密钥下发给该终端。
该组根密钥可以是一个数值，如12345；该组根密钥也可以是一个字符串，如Abc_de134；该组根密钥也可以是一个数组，如A[8,9,0,1]；该组根密钥也可以是带有多种含义的向量，如携带密钥值、固定的加密ID或多个可选的加密方法ID、校验码等的向量。该组根密钥可以直接使用随机数发生器生成，也可以使用组标识GID(Group Identification，GID，群体身份，)与随机数使用函数(如使用KDF函数，(key derivation function，密钥推导函数))产生，也可以通过人工设置的方式生成，等等。
在群组创建后，通常情况下，该组根密钥一直保持不变，在涉及到组根密钥可能会泄露导致安全隐患时，例如当群组成员发生变化时，核心网10可重新生成新的组根密钥，并将新生成的组根密钥下发给终端。
在该终端初始附着到核心网10时，终端与核心网10建立点到点的连接，应用单呼密钥架构，在终端通过核心网10的认证鉴权，并成功激活安全模式之后，终端与核心网10之间成功建立了点到点的NAS和AS安全通道，之后在核心网10和终端之间传输的数据可以得到加密和完整性保护。核心网10将该终端所属组的组根密钥Kg在组信息更新消息中加密发送给终端。终端保存收到的Kg，用于后续组呼建立时的具体安全管理过程。
该组呼参数Group Call Rand与组根密钥类似，组呼参数可以是一个数值，如567235；组呼参数也可以是一个字符串，如shgie_125？；该组呼参数也可是一个数组如A[8,9,0,1]；该组呼参数也可以是带有多种含义的向量，如携带随机数值、加密方法ID、校验码等的向量。该组呼参数可以直接由随机数发生器生成，也可以使用组标识GID与随机数使用函数产生，也可以通过人工设置的方式生成，等等。在每次组呼建立时，该组呼参数随机产生或人工生成。
该基站20在组呼建立时，接收核心网下发的组根密钥，且为组呼共享信道分配组呼无线网络临时标识G-RNTI，不同的组呼共享信道的组呼无线网络临时标识互不相同。该组呼无线网络临时标识在系统侧用于物理层加扰，在终端侧用于物理层解扰。
该基站20根据该组根密钥、组呼参数对该组呼无线网络临时标识进行加密时，可通过预设的加密算法，如通过KDF函数，将该该组根密钥、组呼参数和该组呼无线网络临时标识派生出加密后的组呼无线网络临时标识，还可以通过其它现有的加密算法。
该基站20还将该加密后的组呼无线网络临时标识和组呼参数通过空口寻呼消息下发给终端，终端根据接收到的组根密钥和组呼参数对接收的加密后的组呼无线网络临时标识进行解密，按照之前对组呼无线网络临时标识进行加密的逆过程，对该加密后的组呼无线临时标识进行解密，得到解密后的组呼无线网络临时标识，该解密后的组呼无线网络临时标识与系统侧生成的组呼无线网络临时标识相同；该终端根据该解密后的组呼无线网络临时标识对共享信道进行解扰，以使得该终端通过该共享信道进行通信。
可选的，该核心网10还设置为在满足更新触发条件时，更新群组的组根 密钥，并将更新后的组根密钥下发给该群组中的终端。
该触发条件可以为群组中的成员发生变化或者安全周期达到，该安全周期可根据需要设置，如可将安全周期设置为10天，则每10天更新一次群组对应的组根密钥。通过该核心网10更新群组的组根密钥，可避免由于组根密钥泄露而导致安全隐患的问题。
可选的，该基站20是设置为采用以下方式实现为组呼共享信道分配组呼无线网络临时标识：获取发起组呼的终端对应的组特征信息，及根据该组特征信息为该组呼共享信道分配组呼无线网络临时标识。
在组呼建立时，该基站20可直接接收该发起组呼的终端主动发送过来的该发起组呼的终端对应的组特征信息，也可以先向该发起组呼的终端发送组特征信息获取请求，然后接收该发起组呼的终端根据该组特征信息获取请求返回的该发起组呼的终端对应的组特征信息。
该组特征信息包括组标识信息，该组标识信息即为该终端所属组的组标识信息。
在一实施例中，在组呼建立时，该基站20可通过接收来自终端的无线资源控制RRC(Radio Resource Control)信令，从该无线资源控制RRC信令中提取该终端设备对应的组特征信息。
该基站20根据该组特征信息为该组呼共享信道分配组呼无线网络临时标识，如可根据该组特征信息由随机数发生器生成该组呼共享信道对应的组呼无线网络临时标识。不同的组呼共享信道的组呼无线网络临时标识互不相同。
当该组特征信息包括组标识信息时，该基站20是设置为采用以下方式实现根据组特征信息为组呼共享信道分配组呼无线网络临时标识：根据预设的组标识信息与组呼无线网络临时标识的映射关系，获取该终端设备对应的组标识信息对应的组呼无线网络临时标识，将该获取的组呼无线网络临时标识作为组呼共享信道的组呼无线网络临时标识。
该组标识信息与组呼无线网络临时标识的映射关系可由管理者预先设置，还可以适时的对该组标识信息与组呼无线网络临时标识的映射关系进行 更新。该基站20在该组标识信息与组呼无线网络临时标识的映射关系中查找该获取的组标识信息，当该组标识信息与组呼无线网络临时标识的映射关系中存在该获取的组标识信息时，将该获取的组标识信息对应的组呼无线网络临时标识读取出来，作为组呼共享信道的无线网络临时标识；当该组标识信息与组呼无线网络临时标识的映射关系中不存在该获取的组标识信息时，则重新为该获取的组标识信息生成一个新的组呼无线网络临时标识，作为组呼共享信道的组呼无线网络临时标识，并将该获取的组标识信息和新生成的组呼无线网络临时标识记录在组标识信息与组呼无线网络临时标识的映射关系中。
参照图6，图6为本发明的终端的可选实施例的结构示意图，该终端包括：
交互模块31，设置为接收核心网下发的该终端所属群组的组根密钥，以及，在组呼建立时，接收基站下发的组呼参数和加密后的组呼无线网络临时标识，该加密后的组呼无线网络临时标识由该基站根据组根密钥、组呼参数对该基站生成的组呼无线网络临时标识进行加密生成；
解密模块32，设置为根据该组根密钥和组呼参数对该接收的加密后的组呼无线网络临时标识进行解密；
解扰模块33，设置为根据该解密后的组呼无线网络临时标识对共享信道进行解扰，以使该终端通过该共享信道进行通信。
在群组创建时，核心网为群组生成组根密钥Kg，每个群组的组根密钥Kg可以互不重复，以保证群组通信的私密性和安全性。
群组中的终端与核心网建立点到点的安全连接，终端使用保存在终端上的密钥K，与核心网建立NAS((Non Access Stratum，非接入层)和AS(Access Stratum，接入层)的安全通道。核心网通过安全通道将终端所属群组的组根密钥Kg下发给对应的终端；当一个终端属于多个群组时，该下发过程可能要进行多次，如当该终端属于群组1和群组2时，则该下发过程包括：第一个下发过程为将群组1对应的组根密钥下发给该终端，第二个下发过程为将群 组2对应的组根密钥下发给该终端。
该终端通过交互模块31接收核心网下发的组根密钥。
该组根密钥Kg可以是一个数值，如12345；该组根密钥也可以是一个字符串，如Abc_de134；该组根密钥也可以是一个数组，如A[8,9,0,1]；该组根密钥也可以是带有多种含义的向量，如携带密钥值、固定的加密ID或多个可选的加密方法ID、校验码等的向量。该组根密钥Kg可以直接使用随机数发生器生成，也可以使用组标识GID(Group Identification，GID，群体身份，)与随机数使用函数(如使用KDF函数，(key derivation function，密钥推导函数))产生，也可以通过人工设置的方式生成，等等。
在群组创建后，通常情况下，该组根密钥一直保持不变，在涉及到组根密钥可能会泄露导致安全隐患时，例如当群组成员发生变化时，该核心网可重新生成新的组根密钥，并将新生成的组根密钥下发给终端。
在该终端初始附着到核心网时，终端与核心网建立点到点的连接，应用单呼密钥架构，在终端通过核心网的认证鉴权，并成功激活安全模式之后，终端与核心网之间成功建立了点到点的NAS和AS安全通道，之后在核心网和终端之间传输的数据可以得到加密和完整性保护。核心网将该终端所属组的组根密钥在组信息更新消息中加密发送给终端。终端保存收到的，用于后续组呼建立时的具体安全管理过程。
该组呼参数Group Call Rand与组根密钥Kg类似，组呼参数可以是一个数值，如567235；组呼参数也可以是一个字符串，如shgie_125？；该组呼参数也可是一个数组如A[8,9,0,1]；该组呼参数也可以是带有多种含义的向量，如携带随机数值、加密方法ID、校验码等的向量。该组呼参数可以直接由随机数发生器生成，也可以使用组标识GID与随机数使用函数产生，也可以通过人工设置的方式生成，等等。在每次组呼建立时，该组呼参数随机产生或人工生成。该终端的交互模块31接收该基站下发的组呼参数。
基站为组呼共享信道分配组呼无线网络临时标识G-RNTI，不同的组呼共享信道的组呼无线网络临时标识互不相同。该组呼无线网络临时标识在系统侧用于物理层加扰，在终端侧用于物理层解扰。
基站根据该组根密钥、组呼参数对该组呼无线网络临时标识进行加密生成加密后的组呼无线网络临时标识，该基站在根据该组根密钥、组呼参数对该组呼无线网络临时标识进行加密时，可通过预设的加密算法，如通过KDF函数，将该该组根密钥、组呼参数和该组呼无线网络临时标识派生出加密后的组呼无线网络临时标识，还可以通过其它现有的加密算法。该终端通过交互模块31接收该基站下发的加密后的组呼无线网络临时标识。
该解密模块32根据该组根密钥和组呼参数对该接收的加密后的组呼无线网络临时标识进行解密，按照基站之前对组呼无线网络临时标识进行加密的逆过程，对该加密后的组呼无线网络临时标识进行解密，得到解密后的组呼无线网络临时标识，该解密后的组呼无线网络临时标识与基站生成的组呼无线网络临时标识相同。
该解扰模块33根据该解密后的组呼无线网络临时标识对共享信道进行解扰，以使得该终端通过该共享信道进行通信。
参照图7，图7为本发明基站的可选实施例的结构示意图，该基站包括：
接收模块21，设置为在组呼建立时，接收核心网下发的组根密钥；
生成模块22，设置为在组呼建立时，生成组呼参数及为组呼共享信道分配组呼无线网络临时标识；
加密模块23，设置为根据该组根密钥、组呼参数对该组呼无线网络临时标识进行加密，生成加密后的组呼无线网络临时标识；
发送模块24，设置为将该加密后的组呼无线网络临时标识和组呼参数下发给群组中的终端，供该终端根据该组根密钥和组呼参数对该接收加密后的组呼无线网络临时标识进行解密。
该组根密钥由核心网生成，该核心网在群组创建时，为群组生成组根密钥Kg，每个群组的组根密钥Kg可以互不重复，以保证群组通信的私密性和安全性。该核心网在组呼建立时，向基站下发该创建的组根密钥。
该组根密钥Kg可以是一个数值，如12345；该组根密钥也可以是一个字符串，如Abc_de134；该组根密钥也可以是一个数组，如A[8,9,0,1]；该组 根密钥Kg也可以是带有多种含义的向量，如携带密钥值、固定的加密ID或多个可选的加密方法ID、校验码等的向量。该组根密钥可以直接使用随机数发生器生成，也可以使用组标识GID(Group Identification，GID，群体身份，)与随机数使用函数(如使用KDF函数，(key derivation function，密钥推导函数))产生，也可以通过人工设置的方式生成，等等。
在群组创建后，通常情况下，该组根密钥Kg一直保持不变，在涉及到组根密钥可能会泄露导致安全隐患时，例如当群组成员发生变化时，可重新生成新的组根密钥Kg，并将新生成的组根密钥下发给终端。
该组呼参数Group Call Rand与组根密钥类似，组呼参数可以是一个数值，如567235；组呼参数也可以是一个字符串，如shgie_125？；该组呼参数也可是一个数组如A[8,9,0,1]；该组呼参数也可以是带有多种含义的向量，如携带随机数值、加密方法ID、校验码等的向量。该组呼参数可以直接由随机数发生器生成，也可以使用组标识GID与随机数使用函数产生，也可以通过人工设置的方式生成，等等。在每次组呼建立时，该组呼参数随机产生或人工生成。
该生成模块22为组呼共享信道分配组呼无线网络临时标识G-RNTI，不同的组呼共享信道的组呼无线网络临时标识互不相同。该组呼无线网络临时标识在系统侧用于物理层加扰，在终端侧用于物理层解扰。
该加密模块23根据该组根密钥、组呼参数对该组呼无线网络临时标识进行加密时，可通过预设的加密算法，如通过KDF函数，将该该组根密钥、组呼参数和该组呼无线网络临时标识派生出加密后的组呼无线网络临时标识，还可以通过其它现有的加密算法。
该发送模块24将该加密后的组呼无线网络临时标识和组呼参数通过空口寻呼消息下发给终端，终端根据接收到的组根密钥和组呼参数对接收的加密后的组呼无线网络临时标识进行解密，按照之前对组呼无线网络临时标识进行加密的逆过程，对该加密后的组呼无线网络临时标识进行解密，得到解密后的组呼无线网络临时标识，该解密后的组呼无线网络临时标识与系统侧(基站)生成的组呼无线网络临时标识相同；该终端根据该解密后的组呼无线网络临时标识对共享信道进行解扰，以使得该终端通过该共享信道进行通 信。
本领域普通技术人员可以理解上述方法中的全部或部分步骤可通过程序来指令相关硬件(例如处理器)完成，所述程序可以存储于计算机可读存储介质中，如只读存储器、磁盘或光盘等。可选地，上述实施例的全部或部分步骤也可以使用一个或多个集成电路来实现。相应地，上述实施例中的各模块/单元可以采用硬件的形式实现，例如通过集成电路来实现其相应功能，也可以采用软件功能模块的形式实现，例如通过处理器执行存储与存储器中的程序/指令来实现其相应功能。本发明不限于任何特定形式的硬件和软件的结合。
以上仅为本发明的优选实施例，并非因此限制本发明的专利范围，凡是利用本发明说明书及附图内容所作的等效结构或等效流程变换，或直接或间接运用在其他相关的技术领域，均同理包括在本发明的专利保护范围内。
工业实用性
上述技术方案实现了对共享信道进行加密，提高了宽带集群系统的安全性。

Claims (15)

  1. 一种宽带集群系统的共享信道管理方法，该方法包括：
    在群组创建时，核心网为群组生成组根密钥，并将所述组根密钥下发给所述群组中的终端；
    在组呼建立时，基站接收核心网下发的组根密钥，及所述基站生成组呼参数及为组呼共享信道分配组呼无线网络临时标识；
    所述基站根据所述组根密钥、组呼参数对所述组呼无线网络临时标识进行加密，生成加密后的组呼无线网络临时标识；
    所述基站将所述加密后的组呼无线网络临时标识和组呼参数下发给所述群组中的终端，供所述终端根据所述组根密钥和组呼参数对所述接收的加密后的组呼无线网络临时标识进行解密。
  2. 如权利要求1所述的宽带集群系统的共享信道管理方法，其中，所述基站为组呼共享信道分配组呼无线网络临时标识的步骤包括：
    所述基站获取发起组呼的终端对应的组特征信息；
    所述基站根据所述组特征信息为所述组呼共享信道分配组呼无线网络临时标识。
  3. 如权利要求2所述的宽带集群系统的共享信道管理方法，其中，所述组特征信息包括组标识信息；
    所述基站所述根据所述组特征信息为所述组呼共享信道分配组呼无线网络临时标识的步骤包括：
    所述基站根据预设的组标识信息与组呼无线网络临时标识的映射关系，获取所述终端对应的组标识信息对应的组呼无线网络临时标识，将获得的组呼无线网络临时标识作为所述组呼共享信道的组呼无线网络临时标识。
  4. 如权利要求1至3任一项所述的宽带集群系统的共享信道管理方法，该方法还包括：
    在满足更新触发条件时，所述核心网更新群组的组根密钥，并将更新后的组根密钥下发给所述群组中的终端。
  5. 一种宽带集群系统的共享信道管理方法，包括：
    在群组创建时，核心网为群组生成组根密钥，并将所述组根密钥下发给所述群组中的终端；
    在组呼建立时，核心网向基站下发生成的组根密钥。
  6. 根据权利要求5所述的宽带集群系统的共享信道管理方法，该方法还包括：
    在满足更新触发条件时，所述核心网更新群组的组根密钥，并将更新后的组根密钥下发给所述群组中的终端。
  7. 一种宽带集群系统的共享信道管理方法，包括：
    在组呼建立时，基站接收核心网下发的组根密钥，及所述基站生成组呼参数及为组呼共享信道分配组呼无线网络临时标识；
    所述基站根据所述组根密钥、组呼参数对所述组呼无线网络临时标识进行加密，生成加密后的组呼无线网络临时标识；
    所述基站将所述加密后的组呼无线网络临时标识和组呼参数下发给所述群组中的终端，供所述终端根据所述组根密钥和组呼参数对所述接收的加密后的组呼无线网络临时标识进行解密。
  8. 如权利要求7所述的宽带集群系统的共享信道管理方法，其中，所述基站为组呼共享信道分配组呼无线网络临时标识的步骤包括：
    所述基站获取发起组呼的终端对应的组特征信息；
    所述基站根据所述组特征信息为所述组呼共享信道分配组呼无线网络临时标识。
  9. 如权利要求8所述的宽带集群系统的共享信道管理方法，其中，所述组特征信息包括组标识信息；
    所述基站所述根据所述组特征信息为所述组呼共享信道分配组呼无线网络临时标识的步骤包括：
    所述基站根据预设的组标识信息与组呼无线网络临时标识的映射关系，获取所述终端对应的组标识信息对应的组呼无线网络临时标识，将获得的组 呼无线网络临时标识作为所述组呼共享信道的组呼无线网络临时标识。
  10. 一种宽带集群系统的共享信道管理系统，所述系统包括核心网和基站，其中：
    所述核心网，设置为在群组创建时，为群组生成组根密钥，并将所述组根密钥下发给所述群组中的终端；在组呼建立时，向基站下发生成的组根密钥；
    所述基站，设置为在组呼建立时，接收核心网下发的组根密钥，并生成组呼参数及为组呼共享信道分配组呼无线网络临时标识；及用于根据所述组根密钥、组呼参数对所述组呼无线网络临时标识进行加密，生成加密后的组呼无线网络临时标识；及用于将所述加密后的组呼无线网络临时标识和组呼参数下发给所述群组中的终端，供所述终端根据所述组根密钥和组呼参数对所述接收加密后的组呼无线网络临时标识进行解密。
  11. 如权利要求10所述的宽带集群系统的共享信道管理系统，其中，所述基站是设置为采用以下方式实现为组呼共享信道分配组呼无线网络临时标识：
    获取发起组呼的终端对应的组特征信息，及根据所述组特征信息为所述组呼共享信道分配组呼无线网络临时标识。
  12. 如权利要求11所述的宽带集群系统的共享信道管理系统，其中，所述组特征信息包括组标识信息；
    所述基站是设置为采用以下方式实现根据所述组特征信息为所述组呼共享信道分配组呼无线网络临时标识：
    根据预设的组标识信息与组呼无线网络临时标识的映射关系，获取所述终端设备对应的组标识信息对应的组呼无线网络临时标识，将所述获取的组呼无线网络临时标识作为组呼共享信道的组呼无线网络临时标识。
  13. 如权利要求10至12任一项所述的宽带集群系统的共享信道管理系统，所述核心网还设置为：
    在满足更新触发条件时，更新群组的组根密钥，并将更新后的组根密钥下发给所述群组中的终端。
  14. 一种终端，所述终端包括：
    交互模块，设置为在群组创建时，接收核心网下发的所述终端所属群组的组根密钥，以及，在组呼建立时，接收基站下发的组呼参数和加密后的组呼无线网络临时标识，所述加密后的组呼无线网络临时标识由所述基站根据组根密钥、组呼参数对所述基站生成的组呼无线网络临时标识进行加密生成；
    解密模块，设置为根据所述组根密钥和组呼参数对所述接收的加密后的组呼无线网络临时标识进行解密；
    解扰模块，设置为根据所述解密后的组呼无线网络临时标识对共享信道进行解扰，以使所述终端通过该共享信道进行通信。
  15. 一种基站，所述基站包括：
    接收模块，设置为在组呼建立时，接收核心网下发的组根密钥；
    生成模块，设置为在组呼建立时，生成组呼参数及为组呼共享信道分配组呼无线网络临时标识；
    加密模块，设置为根据所述组根密钥、组呼参数对所述组呼无线网络临时标识进行加密，生成加密后的组呼无线网络临时标识；
    发送模块，设置为将所述加密后的组呼无线网络临时标识和组呼参数下发给群组中的终端，供所述终端根据所述组根密钥和组呼参数对所述接收加密后的组呼无线网络临时标识进行解密。
PCT/CN2016/084579 2015-07-17 2016-06-02 宽带集群系统的共享信道管理方法、系统、终端和基站 WO2017012425A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510423563.6 2015-07-17
CN201510423563.6A CN106358159A (zh) 2015-07-17 2015-07-17 宽带集群系统的共享信道管理方法、系统、终端和基站

Publications (1)

Publication Number Publication Date
WO2017012425A1 true WO2017012425A1 (zh) 2017-01-26

Family

ID=57834853

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/084579 WO2017012425A1 (zh) 2015-07-17 2016-06-02 宽带集群系统的共享信道管理方法、系统、终端和基站

Country Status (2)

Country Link
CN (1) CN106358159A (zh)
WO (1) WO2017012425A1 (zh)

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108156604B (zh) * 2017-12-01 2021-09-28 海能达通信股份有限公司 集群系统的组呼加密传输方法及装置、集群终端和系统
WO2021155540A1 (zh) * 2020-02-06 2021-08-12 华为技术有限公司 一种密钥管理方法、通信装置
CN112118267B (zh) * 2020-09-25 2022-10-18 南方电网科学研究院有限责任公司 一种匿名通信方法及相关装置

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101022608A (zh) * 2006-02-15 2007-08-22 中兴通讯股份有限公司 一种cdma制式集群系统密钥分配及动态更新方法
CN102547595A (zh) * 2012-02-07 2012-07-04 电信科学技术研究院 一种组呼会话信息的传输方法和设备
CN103096262A (zh) * 2013-01-11 2013-05-08 中兴通讯股份有限公司 在长期演进系统中实现集群单呼会话的方法、基站和终端
CN104010276A (zh) * 2013-02-27 2014-08-27 中兴通讯股份有限公司 一种宽带集群系统的组密钥分层管理方法、系统和终端
US20140314009A1 (en) * 2011-12-01 2014-10-23 Huawei Technologies Co., Ltd. Service scheduling method and apparatus
US20140323171A1 (en) * 2012-01-05 2014-10-30 Huawei Technologies Co., Ltd. Method and Apparatus for Implementing Trunking Group Call Service

Family Cites Families (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101379861B (zh) * 2006-02-10 2015-09-16 高通股份有限公司 在通信系统中使用不透明ue身份发送信令的方法和装置
US20130046821A1 (en) * 2011-08-15 2013-02-21 Renasas Mobile Corporation Advanced Machine-To-Machine Communications

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101022608A (zh) * 2006-02-15 2007-08-22 中兴通讯股份有限公司 一种cdma制式集群系统密钥分配及动态更新方法
US20140314009A1 (en) * 2011-12-01 2014-10-23 Huawei Technologies Co., Ltd. Service scheduling method and apparatus
US20140323171A1 (en) * 2012-01-05 2014-10-30 Huawei Technologies Co., Ltd. Method and Apparatus for Implementing Trunking Group Call Service
CN102547595A (zh) * 2012-02-07 2012-07-04 电信科学技术研究院 一种组呼会话信息的传输方法和设备
CN103096262A (zh) * 2013-01-11 2013-05-08 中兴通讯股份有限公司 在长期演进系统中实现集群单呼会话的方法、基站和终端
CN104010276A (zh) * 2013-02-27 2014-08-27 中兴通讯股份有限公司 一种宽带集群系统的组密钥分层管理方法、系统和终端

Also Published As

Publication number Publication date
CN106358159A (zh) 2017-01-25

Similar Documents

Publication Publication Date Title
US10903987B2 (en) Key configuration method, key management center, and network element
US10880747B2 (en) Network slice allocation method, device, and system
US11240218B2 (en) Key distribution and authentication method and system, and apparatus
US20190068591A1 (en) Key Distribution And Authentication Method And System, And Apparatus
CN111669276B (zh) 一种网络验证方法、装置及系统
CN110612729B (zh) 锚密钥生成方法、设备以及系统
KR101877733B1 (ko) 기기간 통신 환경에서 그룹 통신을 보안하는 방법 및 시스템
CN102625995B (zh) 无线网络中的伽罗瓦/计数器模式加密
WO2020221252A1 (zh) 发送终端序列号的方法和装置以及认证方法和装置
US20200228977A1 (en) Parameter Protection Method And Device, And System
CN110891269B (zh) 一种数据保护方法、设备及系统
KR20190102068A (ko) 보안 구현 방법, 기기 및 시스템
US20190036694A1 (en) Operator-Assisted Key Establishment
EP2854329B1 (en) Method, system, and device for securely establishing wireless local area network
JP2018532325A (ja) ユーザ機器ｕｅのアクセス方法、アクセスデバイス、およびアクセスシステム
WO2013185735A2 (zh) 一种加密实现方法及系统
US20120170745A1 (en) Method and device for encrypting user identity during paging procedure
WO2019023825A1 (zh) 隐私保护的方法及设备
WO2014131356A1 (zh) 一种宽带集群系统的组密钥分层管理方法、系统和终端
JP7174156B2 (ja) サイズ制限がある認証プロトコルにおける安全なアタッチメントの確保
WO2017012425A1 (zh) 宽带集群系统的共享信道管理方法、系统、终端和基站
WO2015139370A1 (zh) Mtc设备组小数据安全传输连接建立方法、hss与系统
WO2022027522A1 (zh) 一种安全通信方法以及装置
TWI801615B (zh) 終端與伺服器的通訊方法、與終端通訊的伺服器和與伺服器通訊的終端
CN101938743B (zh) 一种安全密钥的生成方法和装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16827116

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 16827116

Country of ref document: EP

Kind code of ref document: A1