WO2017070973A1

WO2017070973A1 - Internet protocol security tunnel establishing method, user equipment and base station

Info

Publication number: WO2017070973A1
Application number: PCT/CN2015/093536
Authority: WO
Inventors: 陈璟; 李�赫
Original assignee: 华为技术有限公司
Priority date: 2015-10-31
Filing date: 2015-10-31
Publication date: 2017-05-04
Also published as: CN107005410B; CN107005410A

Abstract

The embodiment of the present invention discloses an Internet protocol security IPsec tunnel establishing method, a user equipment and a base station. When the user equipment requests for access to a core network through a wireless local area network, the base station negotiates with the user equipment over an anti-replay parameter and an IPsec tunnel establishing parameter to establish an IPsec tunnel, and transmits data in the IPsec tunnel according to the IPsec tunnel transmission parameter included in the tunnel establishing parameter, thereby enabling the user equipment to securely access the core network through the wireless local area network and ensuring the security of data transmission.

Description

Internet protocol security tunnel establishment method, user equipment and base station

Technical field

The present invention relates to the field of communications technologies, and in particular, to an internet protocol security (IPsec) tunnel establishment method, a user equipment, and a base station.

Background technique

Long Term Evolution-Wireless Local Area Networks (LWA) is a high-speed data transmission system of the Long Term Evolution (LTE) system using Wireless Local Area Network (WLAN). Efficiency characteristics for downlink transmission of data is a new technology for data offloading. Its architecture definition is shown in Figure 1. The Mobility Management Entity (MME)/Serving Gateway (S-GW) is the core network side node, which represents the core network side in the architecture, and the Evolved Node B (eNB) and The core network side is connected through the S1 interface, and the eNB is connected to the WLAN terminal (WT terminal) through the Xw interface. Under this architecture, the WT and the eNB are deployed separately. For the core network side, the WT is transparent and invisible, that is, the core network side does not know the existence of the WT. A WT can be connected to multiple WLAN access nodes (APs), and the user equipment (User Equipment, UE for short) is connected to the AP to access the network. When the downlink data arrives, the eNB forwards the data to the UE through the WT to implement WLAN offloading.

Figure 1 shows the LWA technology under the new architecture, which requires compatibility with existing WLAN technologies under the new architecture. The access mode of the existing WLAN is adopted by the architecture of FIG. 2, and is accessed through the S2a and S2b interfaces.

The S2a access mode is an interface used when the UE accesses a trusted WLAN. A trusted WLAN means that the WLAN is deployed by the operator. In the S2a access mode, after the UE accesses the WLAN to complete the authentication, the UE can directly connect to the Packet Data Network-Gateway (P-GW) on the core network side to implement the WLAN access and data splitting.

The S2b interface is the interface between the ePDG and the P-GW. The UE uses this interface when accessing a non-trusted WLAN. An untrusted WLAN refers to a WLAN node that is not deployed by the operator. When the user accesses through such an untrusted WLAN, it is assisted by an Evloved Packet Data Gateway (ePDG). ePDG is a network element deployed by the carrier, so ePDG It is credible for the operator, which ensures that the untrusted WLAN has no way to see and modify the user data transmitted between the UE and the core network side, thereby ensuring that only the WLAN is used to transmit data, instead of providing other services by the WLAN. .

The new requirement is compatible with the existing WLAN, which means that it is compatible with the non-trusted WLAN access mode under the S2b access mode. According to the architecture of FIG. 1, it can be seen that the ePDG is not deployed between the WT and the eNB, so that it is impossible to protect the data security of the user under the untrusted WLAN.

Summary of the invention

The embodiment of the present invention provides an IPsec tunnel establishment method, a user equipment and a base station, to establish an IPsec tunnel between the user equipment and the base station, to ensure that the user equipment securely accesses the core network, and ensures data transmission security.

In a first aspect, a method for establishing an Internet Protocol security IPsec tunnel is provided, including:

The base station sends the first anti-replay parameter to the user equipment;

Determining, by the base station, a second anti-replay parameter of the user equipment, where the first anti-replay parameter and the second anti-replay parameter are respectively used to prevent the base station and the user equipment from generating the same key each time ;

The base station generates a first pre-shared key Kipsec according to the air interface key KeNB and the first anti-replay parameter, and generates first authentication information AUTH according to the first Kipsec;

Determining, by the base station, an IPsec tunnel establishment parameter, where the IPsec tunnel establishment parameter includes a second AUTH, wherein the user equipment generates a second Kipsec according to the KeNB and the second anti-replay parameter, and according to the second Kipsec generates the second AUTH;

The base station verifies the first AUTH and the second AUTH, and the identity of the user equipment.

When the user equipment requests access to the core network through the wireless local area network, the base station and the user equipment negotiate anti-replay parameters and IPsec tunnel establishment parameters, and establish an IPsec tunnel, thereby realizing the user equipment to securely access the core network through the wireless local area network, thereby ensuring data transmission. Security.

In a first possible implementation manner of the first aspect, the method further includes:

Sending, by the base station, an internet protocol IP address of the base station to the user equipment;

The base station receives an IP address of a wireless local area network to which the user equipment is connected, which is sent by the user equipment.

In combination with the first aspect or the first possible implementation of the first aspect, in a second possible implementation In the mode, the IPsec tunnel establishment parameter further includes an IPsec tunnel transmission parameter, where the IPsec tunnel transmission parameter includes a first security parameter and an identifier TS of an ingress/egress port for identifying a data stream protected by IPsec, the first security The parameters include a security algorithm, and the first Kipsec or the second Kipsec.

With reference to the second possible implementation of the first aspect, in a third possible implementation manner of the first aspect, the determining, by the base station, an IPsec tunnel establishment parameter includes:

Receiving, by the base station, a first Internet Key Exchange Protocol version 2 IKEv2 message sent by the user equipment, where the first IKEv2 message includes a second security parameter;

Sending, by the base station, a response message of the first IKEv2 message to the user equipment;

Receiving, by the base station, a second IKEv2 message that is sent by the user equipment according to the second security parameter, where the second IKEv2 message includes the IPsec tunnel establishment parameter;

Sending, by the base station, a response message of the second IKEv2 message to the user equipment;

The IPsec tunnel establishment parameter further includes an identifier of the user equipment, and an Internet Key Exchange Protocol header HDR, where the HDR includes an identifier SPI for identifying an IPsec tunnel establishment procedure; the security algorithm is set There are security algorithms at the security algorithm level.

In this implementation manner, the base station and the user equipment negotiate an IPsec tunnel establishment parameter by using an IP data packet, specifically an Internet Key Exchange Protocol version 2 message.

With reference to the third possible implementation of the first aspect, in a fourth possible implementation, the determining, by the base station, the identity of the user equipment includes:

The base station verifies whether the identity of the user equipment is consistent with the identity of the user equipment that has been obtained by the core network side.

With reference to the third possible implementation manner of the first aspect, in a fifth possible implementation, the acquiring, by the base station, the IPsec tunnel establishment parameters that are negotiated with the user equipment, including:

Receiving, by the base station, at least one radio resource control RRC message sent by the user equipment;

The at least one RRC message encapsulates the first IKEv2 message, the response message of the first IKEv2 message, the second IKEv2 message, and the response message of the second IKEv2 message.

In this implementation manner, the user equipment sends an IPsec tunnel establishment parameter to the base station by using an RRC message, and the base station receives the IPsec tunnel establishment parameter sent by the user equipment, and the message of the entire IKEv2 of the IPsec tunnel is encapsulated and transmitted in the RRC message, and the RRC message can be guaranteed. Transceiver is authenticated Over.

With reference to the first aspect, in a sixth possible implementation manner of the first aspect, the determining, by the base station, an IPsec tunnel establishment parameter includes:

Receiving, by the base station, the second AUTH sent by the user equipment by using a radio resource control RRC message, and a list of security algorithms supported by the user equipment;

Determining, by the base station, a level of a security algorithm of the first security parameter according to a list of security algorithm levels and a list of security algorithms supported by the user equipment, where the security algorithm level list includes multiple security algorithms and security algorithms Correspondence of levels;

The base station sends the IPsec tunnel establishment parameter to the user equipment.

In this implementation manner, the IPsec tunnel establishment necessary parameter is transmitted through the RRC message, and the IKEv2 message is not completely encapsulated.

With reference to the first aspect, in a seventh possible implementation manner of the first aspect, the determining, by the base station, an IPsec tunnel establishment parameter includes:

And sending, by the RRC message, the second AUTH and the security algorithm level list of the base station to the user equipment, so that the user equipment according to the security algorithm list supported by the user equipment, and the security algorithm of the base station a level list, determining a level of the security algorithm of the first security parameter, where the security algorithm level list includes a correspondence between multiple security algorithms and a security algorithm level;

The base station receives the IPsec tunnel establishment parameter sent by the user equipment.

In a second aspect, a method for establishing an IPsec tunnel is provided, including:

The user equipment receives the first anti-replay parameter sent by the base station;

Determining, by the user equipment, a second anti-replay parameter of the user equipment, where the first anti-replay parameter and the second anti-replay parameter are respectively used to prevent a key generated by the base station and the user equipment each time the same;

The user equipment generates a second pre-shared key Kipsec according to the air interface key KeNB and the second anti-replay parameter, and generates second authentication information AUTH according to the second Kipsec, and sends the second AUTH to The base station;

Receiving, by the user equipment, an IPsec tunnel establishment parameter sent by the base station, where the IPsec tunnel The establishing parameter includes a first AUTH, wherein the base station generates a first Kipsec according to the KeNB and the first anti-replay parameter, and the base station generates the first AUTH according to the first Kipsec;

The user equipment verifies the first AUTH and the second AUTH.

In conjunction with the first aspect, in a first possible implementation, the method further includes:

Receiving, by the user equipment, an internet protocol IP address of the base station sent by the base station;

The user equipment sends an IP address of a wireless local area network to which the user equipment is connected to the base station.

With reference to the second aspect or the first possible implementation of the second aspect, in a second possible implementation, the method further includes:

The user equipment sends a first IKEv2 message to the base station, where the first IKEv2 message includes a second security parameter;

Receiving, by the user equipment, a response message of the first IKEv2 message sent by the base station;

The user equipment encrypts the second IKEv2 message according to the second security parameter, and sends the encrypted second IKEv2 message to the base station, where the second IKEv2 message includes the IPsec tunnel establishment parameter, the IPsec The tunnel establishment parameter further includes an IPsec tunnel transmission parameter, an identity of the user equipment, and an Internet Key Exchange Protocol header HDR, where the HDR includes an identifier SPI for identifying an IPsec tunnel establishment procedure, where the IPsec tunnel transmission parameter includes a first security parameter and an identifier TS of an ingress/egress port for identifying an IPsec protected data stream, the first security parameter including a security algorithm, and the first Kipsec or the second Kipsec, the security algorithm is Set a security algorithm with a security algorithm level;

The user equipment receives a response message of the second IKEv2 message sent by the base station.

In conjunction with the second possible implementation of the second aspect, in a third possible implementation, the method further includes:

Transmitting, by the user equipment, at least one RRC message to the base station;

With reference to the second aspect, in a fourth possible implementation, the method further includes:

Sending, by the RRC message, the security algorithm list supported by the user equipment to the base station, so that the base station according to its own security algorithm level list, and the user equipment Supporting a list of security algorithms, determining a level of the security algorithm of the first security parameter, where the security algorithm level list includes a correspondence between multiple security algorithms and a security algorithm level;

The user equipment receives the IPsec tunnel establishment parameter sent by the base station, where the IPsec tunnel establishment parameter further includes an IPsec tunnel transmission parameter and an Internet Key Exchange Protocol header HDR, where the HDR includes an IPsec tunnel establishment procedure. The identification SPI, the IPsec tunnel transmission parameter includes a first security parameter and a TS, the first security parameter includes a security algorithm determining the level, and the first Kipsec or the second Kipsec.

With reference to the second aspect, in a fifth possible implementation, the method further includes:

Receiving, by the user equipment, a security algorithm level list of the base station that is sent by the base station by using an RRC message, where the security algorithm level list includes a correspondence between multiple security algorithms and a security algorithm level;

Determining, by the user equipment, a level of the security algorithm of the first security parameter according to a security algorithm list supported by the user equipment and a security algorithm level list of the base station;

The user equipment sends the IPsec tunnel establishment parameter to the base station, where the IPsec tunnel establishment parameter further includes an IPsec tunnel transmission parameter and an Internet Key Exchange Protocol header HDR, where the HDR includes an IPsec tunnel establishment procedure. The identification SPI, the IPsec tunnel transmission parameter includes a first security parameter and a TS, the first security parameter includes a security algorithm determining the level, and the first Kipsec or the second Kipsec.

In a third aspect, a base station is provided, the base station having a function of implementing a behavior of a base station in the above method. The functions may be implemented by hardware or by corresponding software implemented by hardware. The hardware or software includes one or more modules corresponding to the functions described above.

In a possible implementation manner, the base station includes: a transmitter and a processor; wherein

The transmitter is configured to send a first anti-replay parameter to the user equipment;

The processor is configured to determine a second anti-replay parameter of the user equipment, where the first anti-replay parameter and the second anti-replay parameter are respectively used to prevent the base station and the user equipment from generating each time The same key;

The processor is configured to generate a first pre-shared key Kipsec according to the air interface key KeNB and the first anti-replay parameter, and generate first authentication information AUTH according to the first Kipsec;

The processor is further configured to determine an IPsec tunnel establishment parameter, where the IPsec tunnel establishment parameter includes a second AUTH, where the user equipment generates a second Kipsec according to the KeNB and the second anti-replay parameter, and according to The second Kipsec generates the second AUTH;

The processor is further configured to verify the first AUTH and the second AUTH and an identity of the user equipment.

In another possible implementation manner, the base station includes:

a sending unit, configured to send a first anti-replay parameter to the user equipment;

a determining unit, configured to determine a second anti-replay parameter of the user equipment, where the first anti-replay parameter and the second anti-replay parameter are respectively used to prevent the base station and the user equipment from generating a secret each time The same key;

a generating unit, configured to generate a first pre-shared key Kipsec according to the air interface key KeNB and the first anti-replay parameter, and generate first authentication information AUTH according to the first Kipsec;

The determining unit is further configured to determine an IPsec tunnel establishment parameter, where the IPsec tunnel establishment parameter includes a second AUTH, where the user equipment generates a second Kipsec according to the KeNB and the second anti-replay parameter, and according to The second Kipsec generates the second AUTH;

And a verification unit, configured to verify the first AUTH and the second AUTH and the identity of the user equipment.

In a fourth aspect, a user equipment is provided, the user equipment having a function of implementing user equipment behavior in the above method. The functions may be implemented by hardware or by corresponding software implemented by hardware. The hardware or software includes one or more modules corresponding to the functions described above.

In a possible implementation, the user equipment includes: a receiver, a transmitter, and a processor;

The receiver is configured to receive a first anti-replay parameter sent by the base station;

The processor is configured to generate a second pre-shared key Kipsec according to the air interface key KeNB and the second anti-replay parameter, and generate second authentication information AUTH according to the second Kipsec;

The transmitter is further configured to send the second AUTH to the base station;

The receiver is further configured to receive an IPsec tunnel establishment parameter sent by the base station, where the IPsec tunnel establishment parameter includes a first AUTH, where the base station is configured according to the KeNB and the first anti- The playback parameter generates a first Kipsec, and the base station generates the first AUTH according to the first Kipsec;

The processor is further configured to verify the first AUTH and the second AUTH.

In another possible implementation manner, the user equipment includes:

a receiving unit, configured to receive a first anti-playback parameter sent by the base station;

a generating unit, configured to generate a second pre-shared key Kipsec according to the air interface key KeNB and the second anti-playback parameter, and generate second authentication information AUTH according to the second Kipsec;

a sending unit, configured to send the second AUTH to the base station;

The receiving unit is further configured to receive an IPsec tunnel establishment parameter sent by the base station, where the IPsec tunnel establishment parameter includes a first AUTH, where the base station generates a first according to the KeNB and the first anti-replay parameter. Kipsec, the base station generates the first AUTH according to the first Kipsec;

a verification unit for verifying the first AUTH and the second AUTH.

According to an embodiment of the present invention, an Internet Protocol security IPsec tunnel establishment method, a user equipment and a base station, when a user equipment requests access to a core network through a wireless local area network, the base station negotiates anti-replay parameters and IPsec tunnel establishment parameters with the user equipment. The IPsec tunnel is established, so that the user equipment can securely access the core network through the wireless local area network, thereby ensuring the security of data transmission.

DRAWINGS

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings to be used in the embodiments will be briefly described below. Obviously, the drawings in the following description are only some of the present invention. For the embodiments, those skilled in the art can obtain other drawings according to the drawings without any creative work.

1 is a schematic diagram of a Long Term Evolution System-Wireless Local Area Network (LTE) aggregation LWA;

2 is a schematic diagram of an access mode of an existing wireless local area network WLAN;

FIG. 3 is a schematic flowchart of a method for establishing an IPsec tunnel according to an embodiment of the present disclosure;

4 is a schematic flowchart of another IPsec tunnel establishment method according to an embodiment of the present invention;

FIG. 5 is a schematic flowchart of still another method for establishing an IPsec tunnel according to an embodiment of the present disclosure;

FIG. 6 is a schematic structural diagram of a base station according to an embodiment of the present disclosure;

FIG. 7 is a schematic structural diagram of another base station according to an embodiment of the present disclosure;

FIG. 8 is a schematic structural diagram of a user equipment according to an embodiment of the present disclosure;

FIG. 9 is a schematic structural diagram of still another base station according to an embodiment of the present invention;

FIG. 10 is a schematic structural diagram of another user equipment according to an embodiment of the present invention.

detailed description

The technical solutions in the embodiments of the present invention are clearly and completely described in the following with reference to the accompanying drawings in the embodiments of the present invention. It is obvious that the described embodiments are only a part of the embodiments of the present invention, but not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention.

The present invention requires that the new LWA architecture shown in FIG. 1 is compatible with the existing WLAN technology, that is, it is required to be compatible with the non-trusted WLAN access mode in the S2b access mode. In the embodiment of the present invention, an IPsec tunnel is established between the user equipment and the base station to achieve the role of the ePDG on the S2b interface.

Before the IPsec tunnel establishment method of the embodiment of the present invention is implemented, the user equipment has accessed the core network, and the authentication succeeds. At this time, the base station already has the identity of the user equipment, such as a Cell Radio Network Temporary Identifier (C-RNTI), and the base station can find the user equipment by using the identifier. The result of successful authentication is that the air interface security between the user equipment and the base station has been established, that is, the user equipment and the base station already hold the same confidentiality key and integrity key, and these keys are used to ensure the user equipment. The security of transmitting messages over the mobile network with the base station.

In the embodiment of the present invention, when the user equipment requests to access the core network through the wireless local area network, the base station and the user equipment negotiate anti-replay parameters and IPsec tunnel establishment parameters, establish an IPsec tunnel, and perform IPsec tunnel transmission parameters included in the tunnel establishment parameters in IPsec. The data is transmitted in the tunnel, so that the user equipment can securely access the core network through the wireless local area network, thereby ensuring the security of data transmission.

FIG. 3 is a schematic flowchart of a method for establishing an IPsec tunnel according to an embodiment of the present invention, where the method includes the following steps:

S101. The base station negotiates anti-replay parameters with the user equipment.

The anti-replay parameter is to prevent the base station or the user equipment from generating the same key each time, or the generated message is the same. If the key or the message is the same, the attacker can intercept the previous message and resend it again. Anti-replay parameters are generally random numbers, time stamps, or counter values.

The base station may carry the anti-replay parameter in the RRC message of the user equipment sending the IP address of the base station. -1, the user equipment may carry the anti-replay parameter-2 when carrying the RRC message of the base station, or may not carry the anti-replay parameter-2, which is determined by the specific configuration, for example, if the anti-replay parameter is a random number, The anti-replay parameter-1 and the anti-replay parameter-2 may be the same or different. If the method of transmitting the random number is selected, the anti-replay parameter-2 is carried in the reply message; if a counter is used The base station can set the counter, and the user equipment does not set the counter. Therefore, the base station needs to transmit the value of the counter as the anti-replay parameter-1 to the user equipment, and the user equipment does not carry the anti-weight in the reply message because there is no timer. If the user equipment is also provided with a counter, the user equipment also needs to transmit the value of its counter as the anti-replay parameter-2 to the base station; if the time stamp is used, both parties need to transmit the anti-replay parameters. Correspondingly, the RRC message of the replying base station may include: an RRC reconfiguration complete message, an RRC completion message, and the like.

S102. The base station generates a first pre-shared key Kipsec according to the air interface key KeNB and the first anti-replay parameter, and generates first authentication information AUTH according to the first Kipsec.

S103. The user equipment generates a second Kipsec according to the KeNB and the second anti-playback parameter, and generates a second AUTH according to the second Kipsec.

When the user equipment and the base station establish air interface security, the same air interface key KeNB is generated. Then, the base station and the user equipment respectively generate the first Kipsec and the second Kipsec according to the KeNB and the negotiated anti-replay parameters according to the set key generation function, and then generate the first AUTH according to the first Kipsec and the second Kipsec respectively ( The authentication and the second AUTH are the same as the key generation function, the KeNB is the same, and the anti-replay parameters are negotiated. The base station and the user equipment know the anti-replay parameters of the opposite end. Therefore, the base station and the user equipment can respectively Verify the authentication information of the peer according to its own authentication information.

S104. The base station negotiates an IPsec tunnel establishment parameter with the user equipment.

The IPsec tunnel establishment parameter includes an authentication information (AUTH) and an IPsec tunnel transmission parameter, where the IPsec tunnel transmission parameter includes a first security parameter and an identifier of an ingress/egress port for identifying a data stream protected by IPsec (Traffic Selector, TS for short) The security parameter is also called the Security Association (SA). This parameter contains the security algorithm, and the first Kipsec or the second Kipsec. The security algorithm has a security algorithm level. The security algorithm level is used to indicate which algorithm should be used. Priority is given to the use of the first Kipsec or the second Kipsec to encrypt the data stream transmitted in the IPsec tunnel in the security algorithm. The IPsec tunnel setup parameters may also include the identity IDi of the user equipment, and the identity ID of the base station. In this embodiment, in order to enable the base station to accurately determine the identity of the user equipment, C-RNTI is used as IDi. Where IDi represents the identity of the initiator, ie Identification-Initiator, and IDr represents the identity of the recipient, ie Identification-Responder.

S105. The base station and the user equipment respectively verify the first AUTH and the second AUTH.

S106. If the base station verifies that the first AUTH and the second AUTH are consistent, verify the identity of the user equipment.

After obtaining the negotiated IPsec tunnel establishment parameters, the base station and the user equipment respectively verify whether the authentication information of the peer end is consistent with the authentication information of the peer end. If the verification succeeds, the base station verifies the identity of the user equipment. The base station verifies the identity of the user equipment, and compares the identity of the user equipment that has been acquired when the air interface is connected with the identity of the user equipment that is included in the IPsec tunnel establishment parameter, and if the RRC message is received, the identity of the user equipment is already received. Verification is performed when the RRC message is received.

After the base station negotiates the IPsec tunnel transmission parameters with the user equipment, the work of establishing an IPsec tunnel is completed, so that data can be transmitted in the IPsec tunnel according to the IPsec tunnel transmission parameters.

According to an embodiment of the present invention, an IPsec tunnel is established. When a user equipment requests access to a core network through a wireless local area network, the base station and the user equipment negotiate anti-replay parameters and IPsec tunnel establishment parameters, establish an IPsec tunnel, and establish an tunnel according to the tunnel. The IPsec tunnel transmission parameters included in the parameters transmit data in the IPsec tunnel, thereby enabling the user equipment to securely access the core network through the wireless LAN, thereby ensuring the security of data transmission.

FIG. 4 is a schematic flowchart of another method for establishing an IPsec tunnel according to an embodiment of the present invention, where the method includes the following steps:

S201. The base station sends an IP address of the base station to the user equipment in the RRC reconfiguration message.

The anti-replay parameter-1 is carried in the RRC reconfiguration message.

S202. After receiving the RRC reconfiguration message of the base station, the user equipment returns an RRC reconfiguration complete message.

The anti-replay parameter-2 is carried in the RRC reconfiguration complete message.

When establishing an IPsec tunnel between the user equipment and the base station, two operations need to be performed. First, the two parties need to know the IP address of the peer. Second, the base station needs to determine that the peer end that establishes the IPsec tunnel is the user equipment, instead of attacking. The user device of the person or other person, that is, the identity of the user device is correct.

First, the base station transmits the IP address of the base station to the user equipment. The base station may select one of a plurality of Radio Resource Control (RRC) messages for transmitting the IP of the base station. Address, the RRC message includes: an RRC reconfiguration message, an RRC setup request message, an RRC re-establishment message, and the like. The choice of RRC messaging is based on a mobile network that has passed security authentication, which ensures the security of the transmitted message.

At the same time, the user equipment sends the IP address of the WLAN connected to the user equipment to the base station. Before the user equipment sends the IP, the user equipment first needs to access the WLAN through the AP, and then obtain the IP address distributed by the WLAN.

S203. The base station generates a first pre-shared key Kipsec according to the air interface key KeNB and the negotiated anti-replay parameter by using a set key generation function, and generates first authentication information AUTH according to the first Kipsec.

S204. The user equipment uses the set key generation function to generate a second Kipsec according to the KeNB and the negotiated anti-replay parameter, and generate a second AUTH according to the second Kipsec.

S205. The user equipment accesses the AP.

S206. The user equipment obtains an IP address distributed by the AP.

S207. The user equipment sends the IP address distributed by the AP to the base station.

S208. The base station and the user equipment negotiate the second security parameter by using the first Internet Key Exchange Protocol version 2 message.

Specifically, the user equipment sends an Internet Key Exchange Security Association parameter negotiation initial message IKE_SA_INIT message to the base station, where the IKE_SA_INIT message includes an Internet Key Exchange Protocol Header (HDR Header, HDR for short), and the second security parameter SAi1, the sender is substantially dense. Key KEi, random number Ni, wherein HDR includes Security Parameter Indexes (SPI) for identifying the IPsec tunnel establishment process; the base station replies with the IKE_SA_INIT message, and the reply message includes HDR, SAr1, and the reply party is basically dense. The key KEl, the random number Nr, completes the negotiation of the second security parameter between the base station and the user equipment. The second security parameter also includes a security algorithm, a security algorithm level, and a key. The security algorithm level of SAi1 and SAr1 is determined by the IKEv2 message. SAi1 and SAr1 include multiple security algorithms, and the security algorithm is used to specify the security algorithm to be adopted. The key is generated based on the base key (KEi and KEl) and the random number (Ni, Nr). The second security parameter is used to encrypt the second IKEv2 message that transmits the IPsec tunnel establishment parameters.

S209. The base station receives a second IKEv2 message that is sent by the user equipment according to the second security parameter.

Specifically, the user equipment sends an IKE_AUTH message to the base station, and the IKE_AUTH message is encrypted and sent by the second security parameter. The IKE_AUTH message includes HDR, SK{IDi, AUTH, SAi2, TSi, TSR}, where SK{} indicates that the parameter in {} is encrypted and protected by the security algorithm and the key in the second security parameter; the base station replies to the IKR_AUTH message of the user equipment, and the reply message includes HDR, SK{ IDr, AUTH, SAr2, TSi, TSR}.

In this embodiment, the IP data packet is negotiated between the base station and the user equipment, specifically the Internet Key Exchange Protocol version 2 message, and the IPsec tunnel establishment parameter is negotiated. Since the IP data packet is transmitted, the identity of the peer end has not been verified. To ensure the security of the transmission process, the security parameters of the message for transmitting the IPsec tunnel establishment parameters need to be negotiated first, and then the message for sending the IPsec tunnel establishment parameters is encrypted by the negotiated security parameters.

As an alternative to S208-S209, the user equipment sends an IPsec tunnel establishment parameter to the base station by using an RRC message, and the base station receives the IPsec tunnel establishment parameter sent by the user equipment, and the message of the entire IKEv2 of the IPsec tunnel is encapsulated and transmitted in the RRC message. Since the RRC message can ensure that the transmitting and receiving peers are authenticated, it is not necessary to emphasize the authentication information AUTH and the identity IDi of the initiator.

S210. The base station and the user equipment respectively verify the first AUTH and the second AUTH.

S211. If the base station verifies that the first AUTH and the second AUTH are consistent, verify the identity of the user equipment.

FIG. 5 is a schematic flowchart of still another method for establishing an IPsec tunnel according to an embodiment of the present invention, where the method includes the following steps:

S301. The user equipment accesses the AP.

S302. The user equipment obtains an IP address distributed by the AP.

S303. The base station sends an IP address of the base station to the user equipment in the RRC reconfiguration message.

This message carries the anti-replay parameter -1.

S304. After receiving the RRC reconfiguration message of the base station, the user equipment returns an RRC reconfiguration complete message.

The IP address of the AP connected to the user equipment and the anti-replay parameter-2.

S305. The base station generates a first pre-shared key Kipsec according to the air interface key KeNB and the negotiated anti-replay parameter by using a set key generation function, and generates first authentication information AUTH according to the first Kipsec.

S306. The user equipment uses the set key generation function to generate a second Kipsec according to the KeNB and the negotiated anti-replay parameter, and generate a second AUTH according to the second Kipsec.

S307. The base station receives a second AUTH sent by the user equipment by using an RRC message, and a list of security algorithms supported by the user equipment.

The user equipment sends the necessary parameters of the IPsec tunnel establishment to the base station by using the RRC message, and the base station receives the necessary parameters for establishing the IPsec tunnel sent by the user equipment, and the necessary parameters for establishing the IPsec tunnel include: authentication information, and a list of security algorithms supported by the user equipment. Security algorithms may include encryption algorithms and integrity protection algorithms.

Optionally, the security algorithm list supported by the user equipment may be transmitted to the base station in advance in the process of attaching the user equipment to the core network, that is, before the user equipment, the user equipment carries the user in the Attach Request message. The security algorithm list supported by the device is sent to the MME. In the Attach Accept message, the MME transmits the security algorithm list supported by the user equipment to the base station, and then completes the Attach process of the user equipment to establish a default bearer.

S308. The base station determines, according to its own security algorithm level list, and a list of security algorithms supported by the user equipment, the level of the security algorithm of the first security parameter.

A security algorithm level list is set in the base station, and the security algorithm level list includes a correspondence between multiple security algorithms and security algorithm levels. The base station can determine the level of the security algorithm of the first security parameter from the security algorithm supported by the user equipment according to the security algorithm level list and the obtained security algorithm list supported by the user equipment, and the security algorithm acts as a security algorithm for protecting the IPsec tunnel transmission. For example, the security algorithm with the highest level of algorithm security capability in the list of security algorithms supported by the user equipment can be selected.

Optionally, if the user equipment transmits the security algorithm list supported by the user equipment to the base station in advance in the attach process, the base station may use the IP address of the base station and the determined security algorithm of the first security parameter in the RRC reconfiguration message. The level is sent to the user device.

S309. The base station sends an IPsec tunnel establishment parameter to the user equipment.

After determining the authentication information and the first security algorithm, the base station sends an IPsec tunnel establishment parameter to the user equipment, where the IPsec tunnel establishment parameter includes a first security parameter and a TS, the first security parameter includes a security algorithm, and the A Kipsisec or the second Kipsec.

In this embodiment, the RRC message is used to transmit the IPsec tunnel establishment necessary parameters, and the IKEv2 message is not completely encapsulated. Since the RRC message itself can ensure the security of the data transmission, there is no need to negotiate the second security parameter.

In this embodiment, the IPsec tunnel establishment is initiated by the user equipment, as a type of S307-S309. Alternatively, the base station may initiate IPsec tunnel establishment, that is, the base station sends the IPsec tunnel establishment necessary parameters to the user equipment through the RRC message, so that the user equipment according to the list of security algorithms supported by the user equipment, and the security algorithm level list of the base station. Determining a level of the security algorithm of the first security parameter, and then the user equipment sends an IPsec tunnel establishment parameter to the base station, where the base station receives an IPsec tunnel establishment parameter sent by the user equipment.

S310. The base station and the user equipment respectively verify the first AUTH and the second AUTH.

S311. If the base station verifies that the first AUTH and the second AUTH are consistent, verify the identity of the user equipment.

It should be noted that, for the foregoing method embodiments, for the sake of simple description, they are all expressed as a series of action combinations, but those skilled in the art should understand that the present invention is not limited by the described action sequence. Because certain steps may be performed in other sequences or concurrently in accordance with the present invention. In addition, those skilled in the art should also understand that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present invention.

In the above embodiments, the descriptions of the various embodiments are different, and the details that are not detailed in a certain embodiment can be referred to the related descriptions of other embodiments.

The steps in the method of the embodiment of the present invention may be sequentially adjusted, merged, and deleted according to actual needs.

FIG. 6 is a schematic structural diagram of a base station according to an embodiment of the present invention. The base station 1000 includes a sending unit 11, a determining unit 12, a generating unit 13, and a verifying unit 14. among them:

The sending unit 11 is configured to send the first anti-replay parameter to the user equipment.

The determining unit 12 is configured to determine that the second anti-replay parameter of the user equipment may carry the anti-replay parameter-1 in the RRC message of the user equipment, and the user equipment may carry the anti-weight when replying to the RRC message of the base station. The parameter-2 can also be placed without carrying the anti-replay parameter-2, which is determined by the specific configuration. Correspondingly, the RRC message of the replying base station may include: an RRC reconfiguration complete message, an RRC completion message, and the like.

The generating unit 13 is configured to generate a first pre-shared key Kipsec according to the air interface key KeNB and the first anti-replay parameter, and generate first authentication information AUTH according to the first Kipsec.

When the user equipment and the base station establish air interface security, the same air interface key KeNB is generated. Then, the base station and the user equipment respectively generate the first Kipsec and the second Kipsec according to the KeNB and the negotiated anti-replay parameters, and then generate the first AUTH according to the first Kipsec and the second Kipsec respectively by using the set key generation function. The second AUTH, because the key generation function is the same, the KeNB is the same, and the anti-replay parameters are negotiated, and the base station and the user equipment know the anti-replay parameters of the opposite end. Therefore, the base station and the user equipment can respectively according to their own The authentication information is used to verify the authentication information of the peer.

The determining unit 12 is further configured to determine an IPsec tunnel establishment parameter.

The IPsec tunnel establishment parameter includes an authentication information and an IPsec tunnel transmission parameter, where the IPsec tunnel transmission parameter includes a first security parameter and an identifier of an ingress/egress port for identifying a data stream protected by IPsec, and the security parameter is also called a security association parameter. Security Association (SA), this parameter contains the security algorithm, and the first Kipsec or the second Kipsec, the security algorithm has a security algorithm level, the security algorithm level is used to indicate which algorithm should be prioritized, the first Kipsel or the second Kipsec is used to encrypt the data stream transmitted in an IPsec tunnel in a security algorithm. The IPsec tunnel setup parameters may also include the identity IDi of the user equipment, and the identity ID of the base station.

The verification unit 14 is configured to verify the identity of the first AUTH and the second AUTH and the user equipment.

After the base station negotiates the IPsec tunnel transmission parameters with the user equipment, the work of establishing an IPsec tunnel is completed.

According to an embodiment of the present invention, when a user equipment requests access to a core network through a wireless local area network, the base station and the user equipment negotiate anti-replay parameters and IPsec tunnel establishment parameters, establish an IPsec tunnel, and include parameters according to the tunnel establishment. The IPsec tunnel transmission parameters transmit data in the IPsec tunnel, thereby enabling the user equipment to securely access the core network through the wireless LAN, thereby ensuring the security of data transmission.

Referring to FIG. 6 , the base station further includes a receiving unit, and a specific implementation manner of the receiving unit is provided below:

The receiving unit is specifically configured to obtain the first Internet Key Exchange Protocol version with the user equipment. The second security parameter negotiated by this 2 message.

Specifically, the user equipment sends an Internet Key Exchange Security Association parameter negotiation initial message IKE_SA_INIT message to the base station, where the IKE_SA_INIT message includes HDR, a second security parameter SAi1, a sender basic key KEi, and a random number Ni, wherein the HDR includes The SPI is used to identify the IPsec tunnel establishment process. The base station replies to the IKE_SA_INIT message, and the replies include HDR, SAr1, the replies basic key KEr, and the random number Nr, thereby completing the negotiation of the second security parameter between the base station and the user equipment. The second security parameter also includes a security algorithm, a security algorithm level, and a key. The security algorithm level of SAi1 and SAr1 is determined by the IKEv2 message. SAi1 and SAr1 include multiple security algorithms, and the security algorithm is used to specify the security algorithm to be adopted. The key is generated based on the base key (KEi and KEl) and the random number (Ni, Nr). The second security parameter is used to encrypt the second IKEv2 message that transmits the IPsec tunnel establishment parameters.

The receiving unit is further configured to receive a second IKEv2 message that is sent by the user equipment according to the second security parameter.

Specifically, the user equipment sends an IKE_AUTH message to the base station, and the IKE_AUTH message is encrypted and sent by the second security parameter. The IKE_AUTH message includes HDR, SK{IDi, AUTH, SAi2, TSi, TSR}, wherein the parameter in the {{} indicates that the parameter in the {} is encrypted and protected by the security algorithm and the key in the second security parameter; The IKR_AUTH message of the user equipment includes HDR, SK{IDr, AUTH, SAr2, TSi, TSR}.

As an alternative implementation manner of the receiving unit, the user equipment sends an IPsec tunnel establishment parameter to the base station by using an RRC message, and the receiving unit receives the IPsec tunnel establishment parameter sent by the user equipment, and the message of the entire IKEv2 of the IPsec tunnel is encapsulated in the RRC message. In the RRC message, the transceiver end can be authenticated, and the authentication information AUTH and the identity IDi of the initiator need not be emphasized.

FIG. 7 is a schematic structural diagram of another base station according to an embodiment of the present disclosure, where the base station 2000 includes The sending unit 21, the receiving unit 22, the generating unit 23, the determining unit 24, and the verifying unit 25. among them:

The sending unit 21 is configured to send the Internet Protocol IP address and the anti-replay parameter of the base station to the user equipment in the RRC reconfiguration message.

The receiving unit 22 is configured to receive an IP address and an anti-replay parameter of the wireless local area network to which the user equipment is connected, which is sent by the user equipment.

The generating unit 23 is configured to generate a first pre-shared key Kipsec according to the air interface key KeNB and the negotiated anti-replay parameter by using a set key generation function, and generate first authentication information AUTH according to the first Kipsec.

The receiving unit 22 is further configured to receive a second AUTH sent by the user equipment by using an RRC message, and a list of security algorithms supported by the user equipment.

The determining unit 24 is configured to determine a level of the security algorithm of the first security parameter according to the security algorithm level list of the user and the security algorithm list supported by the user equipment.

The sending unit 21 is further configured to send an IPsec tunnel establishment parameter to the user equipment.

After determining the authentication information and the first security algorithm, the base station sends an IPsec tunnel establishment parameter to the user equipment, where the IPsec tunnel establishment parameter includes a first security parameter and a TS, the first security parameter includes a security algorithm, and the A Kipsisec or the second Kipsec. .

In this embodiment, the user equipment initiates the establishment of the IPsec tunnel. As an alternative, the base station may initiate the IPsec tunnel establishment, that is, the base station sends the necessary parameters for establishing the IPsec tunnel to the user equipment through the RRC message, so that the user equipment Determining a level of the security algorithm of the first security parameter according to a list of security algorithms supported by the base station, and a security algorithm level list of the base station, and then the user equipment sends the IPsec tunnel establishment parameter to the base station, where the base station receives the information sent by the user equipment. The IPsec tunnel establishes parameters.

The verification unit 25 is configured to verify the first AUTH and the second AUTH.

The verification unit 25 is further configured to verify the identity of the user equipment if the first AUTH and the second AUTH are verified to be consistent.

FIG. 8 is a schematic structural diagram of a user equipment according to an embodiment of the present invention. The user equipment 3000 includes a determining unit 31, a generating unit 32, a sending unit 33, a receiving unit 34, and a verifying unit 35.

a determining unit 31, configured to determine a second anti-replay parameter of the user equipment, where the first anti-replay parameter and the second anti-replay parameter are respectively used to prevent a key generated by the base station and the user equipment each time the same;

The generating unit 32 is configured to generate a second pre-shared key Kipsec according to the air interface key KeNB and the second anti-playback parameter, and generate second authentication information AUTH according to the second Kipsec;

a sending unit 33, configured to send the second AUTH to the base station;

The receiving unit 34 is configured to receive an IPsec tunnel establishment parameter sent by the base station, where the IPsec tunnel establishment parameter includes a first AUTH, where the base station generates a first Kipsc according to the KeNB and the first anti-replay parameter. The base station generates the first AUTH according to the first Kipsec;

The verification unit 35 is configured to verify the first AUTH and the second AUTH.

Further, the receiving unit 34 is further configured to receive an internet protocol IP address of the base station that is sent by the base station;

The sending unit is further configured to send an IP address of a wireless local area network to which the user equipment is connected, to the base station.

As an implementation manner, the sending unit 33 is further configured to send a first IKEv2 message to the base station, where the first IKEv2 message includes a second security parameter;

The receiving unit 34 is further configured to receive a response message of the first IKEv2 message sent by the base station;

The sending unit 33 is further configured to: encrypt the second IKEv2 message according to the second security parameter, and send the encrypted second IKEv2 message to the base station, where the second IKEv2 message includes the IPsec tunnel establishment parameter The IPsec tunnel establishment parameter further includes an IPsec tunnel transmission parameter, an identity of the user equipment, and an Internet Key Exchange Protocol header HDR, where the HDR includes an identifier SPI for identifying an IPsec tunnel establishment procedure, the IPsec The tunnel transmission parameter includes a first security parameter and an identifier TS of an ingress/egress port for identifying a data stream protected by the IPsec, the first security parameter including a security algorithm, and the first Kipsel or the second Kipsec The security algorithm is a security algorithm set with a security algorithm level;

The receiving unit 34 is further configured to receive a response message of the second IKEv2 message sent by the base station.

As another implementation manner, the sending unit 33 is further configured to send at least one RRC message to the base station;

As a further implementation manner, the sending unit 33 is further configured to send, by using an RRC message, a security algorithm list supported by the user equipment to the base station, so that the base station according to its own security algorithm level list, and the a security algorithm list supported by the user equipment, determining a level of the security algorithm of the first security parameter, where the security algorithm level list includes a correspondence between multiple security algorithms and a security algorithm level;

The receiving unit 34 is further configured to receive the IPsec tunnel establishment parameter sent by the base station, where the IPsec tunnel establishment parameter further includes an IPsec tunnel transmission parameter and an Internet key exchange protocol header. HDR, the HDR includes an identifier SPI for identifying an IPsec tunnel establishment procedure, the IPsec tunnel transmission parameter includes a first security parameter and a TS, the first security parameter includes a security algorithm determining the level, and the First Kipsec or the second Kipsec.

As a further implementation manner, the receiving unit 34 is further configured to receive a security algorithm level list of the base station that is sent by the base station by using an RRC message, where the security algorithm level list includes a correspondence between multiple security algorithms and a security algorithm level. relationship;

The determining unit 31 is further configured to determine a level of the security algorithm of the first security parameter according to a security algorithm list supported by the base and a security algorithm level list of the base station;

The sending unit 33 is further configured to send the IPsec tunnel establishment parameter to the base station, where the IPsec tunnel establishment parameter further includes an IPsec tunnel transmission parameter and an Internet Key Exchange Protocol header HDR, where the HDR includes An identification SPI of the IPsec tunnel establishment process, the IPsec tunnel transmission parameter includes a first security parameter and a TS, the first security parameter includes a security algorithm determining the level, and the first Kipsec or the second Kipsec.

According to an embodiment of the present invention, when a user equipment requests access to a core network through a wireless local area network, the base station and the user equipment negotiate anti-replay parameters and IPsec tunnel establishment parameters, establish an IPsec tunnel, and establish parameters according to the tunnel. The included IPsec tunnel transmission parameters transmit data in the IPsec tunnel, thereby enabling the user equipment to securely access the core network through the wireless local area network, thereby ensuring the security of data transmission.

As shown in FIG. 9 , a schematic structural diagram of another base station is provided for implementing the foregoing IPsec tunnel establishment function. As shown in FIG. 9 , the base station 4000 includes a transmitter 41 and a processor 42 . The transmitter 41 and the processor 42 are connected to each other via a bus 43. among them:

The processor is further configured to generate a first pre-shared key Kipsec according to the air interface key KeNB and the first anti-replay parameter, and generate first authentication information AUTH according to the first Kipsec;

The processor is further configured to determine an IPsec tunnel establishment parameter, where the IPsec tunnel establishes a parameter packet The second AUTH is generated, wherein the user equipment generates a second Kipsec according to the KeNB and the second anti-playback parameter, and generates the second AUTH according to the second Kipsec;

The processor is further configured to verify the first AUTH and the second AUTH, and an identity of the user equipment.

Further, the transmitter is further configured to send an internet protocol IP address of the base station to the user equipment;

The base station further includes: a receiver;

The receiver is further configured to receive an IP address of a wireless local area network to which the user equipment is connected, sent by the user equipment.

Further, the IPsec tunnel establishment parameter further includes an IPsec tunnel transmission parameter, where the IPsec tunnel transmission parameter includes a first security parameter and an identifier TS of an ingress/egress port for identifying a data stream protected by IPsec, the first security The parameters include a security algorithm, and the first Kipsec or the second Kipsec.

Further, the receiver is further configured to receive a first Internet Key Exchange Protocol version 2 IKEv2 message sent by the user equipment, where the first IKEv2 message includes a second security parameter;

The transmitter is further configured to send a response message of the first IKEv2 message to the user equipment;

The receiver is further configured to receive a second IKEv2 message that is sent by the user equipment according to the second security parameter, where the second IKEv2 message includes the IPsec tunnel establishment parameter;

The transmitter is further configured to send a response message of the second IKEv2 message to the user equipment;

Further, the processor is further configured to:

Verifying whether the identity of the user equipment is consistent with the identity of the user equipment that has been obtained by the core network side.

Further, the receiver is further configured to receive at least one radio resource control RRC message sent by the user equipment;

Further, the receiver is further configured to receive the second AUTH sent by the user equipment by using a radio resource control RRC message, and a list of security algorithms supported by the user equipment;

The processor is further configured to determine a level of the security algorithm of the first security parameter according to a list of security algorithm levels of the user and a list of security algorithms supported by the user equipment, where the security algorithm level list includes multiple security Correspondence between the algorithm and the level of the security algorithm;

The transmitter is further configured to send the IPsec tunnel establishment parameter to the user equipment.

Further, the transmitter is further configured to send, by using an RRC message, the second AUTH and the security algorithm level list of the base station to the user equipment, so that the user equipment according to the security algorithm list supported by the user equipment, And determining, by the security algorithm level list of the base station, a level of the security algorithm of the first security parameter, where the security algorithm level list includes a correspondence between multiple security algorithms and a security algorithm level;

The receiver is further configured to receive the IPsec tunnel establishment parameter sent by the user equipment.

As shown in FIG. 10, a schematic structural diagram of another user equipment is provided for implementing the foregoing IPsec tunnel establishment function. As shown in FIG. 10, the user equipment 5000 includes a receiver 51, a transmitter 52, and processing. The device 53, wherein the receiver 51, the transmitter 52 and the processor 53 are connected to each other by a bus 54. among them:

The processor is configured to determine a second anti-replay parameter of the user equipment, where the first anti-replay parameter and the second anti-replay parameter are respectively used to prevent the base station and the user equipment from generating a secret each time. The same key;

The processor is further configured to generate a second pre-shared key Kipsec according to the air interface key KeNB and the second anti-playback parameter, and generate second authentication information AUTH according to the second Kipsec;

a transmitter, configured to send the second AUTH to the base station;

a receiver, configured to receive an IPsec tunnel establishment parameter sent by the base station, where the IPsec tunnel The establishing parameter includes a first AUTH, wherein the base station generates a first Kipsec according to the KeNB and the first anti-replay parameter, and the base station generates the first AUTH according to the first Kipsec;

Further, the receiver is further configured to receive an internet protocol IP address of the base station sent by the base station;

Further, the transmitter is further configured to send a first IKEv2 message to the base station, where the first IKEv2 message includes a second security parameter;

The receiver is further configured to receive a response message of the first IKEv2 message sent by the base station;

The transmitter is further configured to: encrypt the second IKEv2 message according to the second security parameter, and send the encrypted second IKEv2 message to the base station, where the second IKEv2 message includes the IPsec tunnel establishment parameter, The IPsec tunnel establishment parameter further includes an IPsec tunnel transmission parameter, an identity of the user equipment, and an Internet Key Exchange Protocol header HDR, where the HDR includes an identifier SPI for identifying an IPsec tunnel establishment procedure, the IPsec tunnel The transmission parameter includes a first security parameter and an identifier TS of an ingress/egress port for identifying a data stream protected by the IPsec, the first security parameter including a security algorithm, and the first Kipsec or the second Kipsec, The security algorithm is a security algorithm set with a security algorithm level;

The receiver is further configured to receive a response message of the second IKEv2 message sent by the base station.

Further, the transmitter is further configured to send at least one RRC message to the base station;

Further, the transmitter is further configured to send, by using an RRC message, a security algorithm list supported by the user equipment to the base station, so that the base station according to its own security algorithm level list, and supported by the user equipment a security algorithm list, determining a level of the security algorithm of the first security parameter, where the security algorithm level list includes a correspondence between multiple security algorithms and a security algorithm level;

The receiver is further configured to receive the IPsec tunnel establishment parameter sent by the base station, where the IPsec tunnel establishment parameter further includes an IPsec tunnel transmission parameter and an Internet Key Exchange Protocol header HDR, where the HDR includes an identifier for identifying IPsec Identification SPI of the tunnel establishment process, the IPsec tunnel transmission The input parameter includes a first security parameter and a TS, the first security parameter including a security algorithm that determines the level, and the first Kipsel or the second Kipsec.

Further, the receiver is further configured to receive a security algorithm level list of the base station that is sent by the base station by using an RRC message, where the security algorithm level list includes a correspondence between multiple security algorithms and a security algorithm level;

The processor is further configured to determine a level of the security algorithm of the first security parameter according to a list of security algorithms supported by the base and a security algorithm level list of the base station;

The transmitter is further configured to send the IPsec tunnel establishment parameter to the base station, where the IPsec tunnel establishment parameter further includes an IPsec tunnel transmission parameter and an Internet Key Exchange Protocol header HDR, where the HDR includes an identifier for identifying IPsec. An identifier SPI of the tunnel establishment process, where the IPsec tunnel transmission parameter includes a first security parameter and a TS, the first security parameter includes a security algorithm determining the level, and the first Kipsec or the second Kipsec.

The units in the apparatus of the embodiment of the present invention may be combined, divided, and deleted according to actual needs. Those skilled in the art can combine or combine the different embodiments described in the specification and the features of the different embodiments.

Through the description of the above embodiments, those skilled in the art can clearly understand that the present invention can be implemented in hardware, firmware implementation, or a combination thereof. When implemented in software, the functions described above may be stored in or transmitted as one or more instructions or code on a computer readable medium. Computer readable media includes both computer storage media and communication media including any medium that facilitates transfer of a computer program from one location to another. A storage medium may be any available media that can be accessed by a computer. For example, but not limited to, the computer readable medium may include a random access memory (RAM), a read-only memory (ROM), and an electrically erasable programmable read-only memory (Electrically Erasable Programmable). Read-Only Memory, EEPROM), Read-Only Disc (Compact Disc) Read-Only Memory (CD-ROM) or other optical disc storage, disk storage media or other magnetic storage device, or any other device that can be used to carry or store desired program code in the form of instructions or data structures and accessible by a computer. medium. Also. Any connection may suitably be a computer readable medium. For example, if the software is transmitted from a website, server, or other remote source using coaxial cable, fiber optic cable, twisted pair, Digital Subscriber Line (DSL), or wireless technologies such as infrared, radio, and microwave, Then coaxial cable, fiber optic cable, twisted pair, DSL or wireless technologies such as infrared, wireless and microwave are included in the fixing of the associated medium. As used in the present invention, a disk and a disc include a compact disc (CD), a laser disc, a compact disc, a digital versatile disc (DVD), a floppy disk, and a Blu-ray disc, wherein the disc is usually magnetically copied, and the disc is The laser is used to optically replicate the data. Combinations of the above should also be included within the scope of the computer readable media.

In summary, the above description is only a preferred embodiment of the technical solution of the present invention, and is not intended to limit the scope of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and scope of the present invention are intended to be included within the scope of the present invention.

Claims

An Internet Protocol Security IPsec Tunnel Establishment Method, comprising:

The base station sends the first anti-replay parameter to the user equipment;

Determining, by the base station, a second anti-replay parameter of the user equipment, where the first anti-replay parameter and the second anti-replay parameter are respectively used to prevent the base station and the user equipment from generating the same key each time ;

The base station generates a first pre-shared key Kipsec according to the air interface key KeNB and the first anti-replay parameter, and generates first authentication information AUTH according to the first Kipsec;

Determining, by the base station, an IPsec tunnel establishment parameter, where the IPsec tunnel establishment parameter includes a second AUTH, wherein the user equipment generates a second Kipsec according to the KeNB and the second anti-replay parameter, and according to the second Kipsec generates the second AUTH;

The base station verifies the first AUTH and the second AUTH, and the identity of the user equipment.
The method of claim 1 further comprising:

Sending, by the base station, an internet protocol IP address of the base station to the user equipment;

The base station receives an IP address of a wireless local area network to which the user equipment is connected, which is sent by the user equipment.
The method according to claim 1 or 2, wherein the IPsec tunnel establishment parameter further comprises an IPsec tunnel transmission parameter, the IPsec tunnel transmission parameter comprising a first security parameter and a data flow for identifying IPsec protection ID of the in/out port, the first security parameter including a security algorithm, and the first Kipsec or the second Kipsec.
The method of claim 3, wherein the base station determines IPsec tunnel establishment parameters, including:

Receiving, by the base station, a first Internet Key Exchange Protocol version 2 IKEv2 message sent by the user equipment, where the first IKEv2 message includes a second security parameter;

Sending, by the base station, a response message of the first IKEv2 message to the user equipment;

Receiving, by the base station, a second IKEv2 message that is sent by the user equipment according to the second security parameter, where the second IKEv2 message includes the IPsec tunnel establishment parameter;

Sending, by the base station, a response message of the second IKEv2 message to the user equipment;

The IPsec tunnel establishment parameter further includes an identifier of the user equipment, and an Internet Key Exchange Protocol header HDR, where the HDR includes an identifier SPI for identifying an IPsec tunnel establishment procedure; the security algorithm is set There are security algorithms at the security algorithm level.
The method according to claim 4, wherein the base station verifies the identity of the user equipment, including:

The base station verifies whether the identity of the user equipment is consistent with the identity of the user equipment that has been obtained by the core network side.
The method of claim 4, wherein the base station determines IPsec tunnel establishment parameters, including:

Receiving, by the base station, at least one radio resource control RRC message sent by the user equipment;

The at least one RRC message encapsulates the first IKEv2 message, the response message of the first IKEv2 message, the second IKEv2 message, and the response message of the second IKEv2 message.
The method of claim 3, wherein the base station determines IPsec tunnel establishment parameters, including:

Receiving, by the base station, the second AUTH sent by the user equipment by using a radio resource control RRC message, and a list of security algorithms supported by the user equipment;

Determining, by the base station, a level of a security algorithm of the first security parameter according to a list of security algorithm levels and a list of security algorithms supported by the user equipment, where the security algorithm level list includes multiple security algorithms and security algorithms Correspondence of levels;

The base station sends the IPsec tunnel establishment parameter to the user equipment.
The method of claim 3, wherein the base station determines IPsec tunnel establishment parameters, including:

And sending, by the RRC message, the second AUTH and the security algorithm level list of the base station to the user equipment, so that the user equipment according to the security algorithm list supported by the user equipment, and the security algorithm of the base station a level list, determining a level of the security algorithm of the first security parameter, where the security algorithm level list includes a correspondence between multiple security algorithms and a security algorithm level;

The base station receives the IPsec tunnel establishment parameter sent by the user equipment.
An IPsec tunnel establishing method, comprising:

The user equipment receives the first anti-replay parameter sent by the base station;

Determining, by the user equipment, a second anti-replay parameter of the user equipment, where the first anti-replay parameter and the second anti-replay parameter are respectively used to prevent a key generated by the base station and the user equipment each time the same;

The user equipment generates a second pre-shared key Kipsec according to the air interface key KeNB and the second anti-replay parameter, and generates second authentication information AUTH according to the second Kipsec, and sends the second AUTH to The base station;

Receiving, by the user equipment, an IPsec tunnel establishment parameter sent by the base station, where the IPsec tunnel establishment parameter includes a first AUTH, where the base station generates a first Kipsec according to the KeNB and the first anti-replay parameter, where The base station generates the first AUTH according to the first Kipsec;

The user equipment verifies the first AUTH and the second AUTH.
The method of claim 9 further comprising:

Receiving, by the user equipment, an internet protocol IP address of the base station sent by the base station;

The user equipment sends an IP address of a wireless local area network to which the user equipment is connected to the base station.
The method of claim 9 or 10, further comprising:

The user equipment sends a first IKEv2 message to the base station, where the first IKEv2 message includes a second security parameter;

Receiving, by the user equipment, a response message of the first IKEv2 message sent by the base station;

The user equipment encrypts the second IKEv2 message according to the second security parameter, and sends the encrypted second IKEv2 message to the base station, where the second IKEv2 message includes the IPsec a tunnel establishment parameter, where the IPsec tunnel establishment parameter further includes an IPsec tunnel transmission parameter, an identity of the user equipment, and an Internet Key Exchange Protocol header HDR, where the HDR includes an identifier SPI for identifying an IPsec tunnel establishment procedure. The IPsec tunnel transmission parameter includes a first security parameter and an identifier TS of an ingress/egress port for identifying a data stream protected by IPsec, the first security parameter including a security algorithm, and the first Kipsel or the second Kipsec, the security algorithm is a security algorithm set with a security algorithm level;

The user equipment receives a response message of the second IKEv2 message sent by the base station.
The method of claim 11 further comprising:

Transmitting, by the user equipment, at least one RRC message to the base station;

The at least one RRC message encapsulates the first IKEv2 message, the response message of the first IKEv2 message, the second IKEv2 message, and the response message of the second IKEv2 message.
The method of claim 9 or 10, further comprising:

And the user equipment sends the security algorithm list supported by the user equipment to the base station by using an RRC message, so that the base station determines, according to its own security algorithm level list, and a list of security algorithms supported by the user equipment. a level of a security algorithm of the first security parameter, where the security algorithm level list includes a correspondence between a plurality of security algorithms and a security algorithm level;

The user equipment receives the IPsec tunnel establishment parameter sent by the base station, where the IPsec tunnel establishment parameter further includes an IPsec tunnel transmission parameter and an Internet Key Exchange Protocol header HDR, where the HDR includes an IPsec tunnel establishment procedure. The identification SPI, the IPsec tunnel transmission parameter includes a first security parameter and a TS, the first security parameter includes a security algorithm determining the level, and the first Kipsec or the second Kipsec.
The method of claim 9 or 10, further comprising:

Receiving, by the user equipment, a security algorithm level list of the base station that is sent by the base station by using an RRC message, where the security algorithm level list includes a correspondence between multiple security algorithms and a security algorithm level;

The user equipment according to a list of security algorithms supported by itself, and a security algorithm of the base station a level list, determining a level of the security algorithm of the first security parameter;

The user equipment sends the IPsec tunnel establishment parameter to the base station, where the IPsec tunnel establishment parameter further includes an IPsec tunnel transmission parameter and an Internet Key Exchange Protocol header HDR, where the HDR includes an IPsec tunnel establishment procedure. The identification SPI, the IPsec tunnel transmission parameter includes a first security parameter and a TS, the first security parameter includes a security algorithm determining the level, and the first Kipsec or the second Kipsec.
A base station, comprising:

a sending unit, configured to send a first anti-replay parameter to the user equipment;

a determining unit, configured to determine a second anti-replay parameter of the user equipment, where the first anti-replay parameter and the second anti-replay parameter are respectively used to prevent the base station and the user equipment from generating a secret each time The same key;

a generating unit, configured to generate a first pre-shared key Kipsec according to the air interface key KeNB and the first anti-replay parameter, and generate first authentication information AUTH according to the first Kipsec;

The determining unit is further configured to determine an IPsec tunnel establishment parameter, where the IPsec tunnel establishment parameter includes a second AUTH, where the user equipment generates a second Kipsec according to the KeNB and the second anti-replay parameter, and according to The second Kipsec generates the second AUTH;

And a verification unit, configured to verify the first AUTH and the second AUTH, and an identity of the user equipment.
The base station of claim 14 wherein:

The sending unit is further configured to send an internet protocol IP address of the base station to the user equipment;

The base station further includes: a receiving unit;

The receiving unit is further configured to receive an IP address of a wireless local area network that is connected by the user equipment and sent by the user equipment.
The base station according to claim 15, wherein said IPsec tunnel establishment parameter further comprises an IPsec tunnel transmission parameter, said IPsec tunnel transmission parameter comprising a first security parameter and an in/out of a data stream for identifying IPsec protection The identifier TS of the port, the first security parameter includes an The full algorithm, and the first Kipsec or the second Kipsec.
The base station of claim 16 wherein:

The receiving unit is further configured to receive a first Internet Key Exchange Protocol version 2 IKEv2 message sent by the user equipment, where the first IKEv2 message includes a second security parameter;

The sending unit is further configured to send a response message of the first IKEv2 message to the user equipment;

The receiving unit is further configured to receive a second IKEv2 message that is sent by the user equipment according to the second security parameter, where the second IKEv2 message includes the IPsec tunnel establishment parameter;

The sending unit is further configured to send a response message of the second IKEv2 message to the user equipment;

The IPsec tunnel establishment parameter further includes an identifier of the user equipment, and an Internet Key Exchange Protocol header HDR, where the HDR includes an identifier SPI for identifying an IPsec tunnel establishment procedure; the security algorithm is set There are security algorithms at the security algorithm level.
The base station according to claim 17, wherein the verification unit is specifically configured to:

Verifying whether the identity of the user equipment is consistent with the identity of the user equipment that has been obtained by the core network side.
The base station of claim 16 wherein:

The receiving unit is further configured to receive at least one radio resource control RRC message sent by the user equipment;

The at least one RRC message encapsulates the first IKEv2 message, the response message of the first IKEv2 message, the second IKEv2 message, and the response message of the second IKEv2 message.
The base station of claim 16 wherein:

The receiving unit is further configured to receive the second AUTH sent by the user equipment by using a radio resource control RRC message, and a list of security algorithms supported by the user equipment;

The determining unit is further configured to: according to its own security algorithm level list, and the user equipment Supporting a list of security algorithms, determining a level of the security algorithm of the first security parameter, where the security algorithm level list includes a correspondence between multiple security algorithms and a security algorithm level;

The sending unit is further configured to send the IPsec tunnel establishment parameter to the user equipment.
The base station of claim 16 wherein:

The sending unit is further configured to send, by using an RRC message, the second AUTH and the security algorithm level list of the base station to the user equipment, so that the user equipment according to the security algorithm list supported by the user equipment, and the a security algorithm level list of the base station, determining a level of the security algorithm of the first security parameter, where the security algorithm level list includes a correspondence between multiple security algorithms and a security algorithm level;

The receiving unit is further configured to receive the IPsec tunnel establishment parameter sent by the user equipment.
A user equipment, comprising:

a determining unit, configured to determine a second anti-replay parameter of the user equipment, where the first anti-replay parameter and the second anti-replay parameter are respectively used to prevent the base station and the user equipment from generating the same key each time ;

a generating unit, configured to generate a second pre-shared key Kipsec according to the air interface key KeNB and the second anti-playback parameter, and generate second authentication information AUTH according to the second Kipsec;

a sending unit, configured to send the second AUTH to the base station;

a receiving unit, configured to receive an IPsec tunnel establishment parameter sent by the base station, where the IPsec tunnel establishment parameter includes a first AUTH, where the base station generates a first Kipsec according to the KeNB and the first anti-replay parameter, The base station generates the first AUTH according to the first Kipsec;

a verification unit for verifying the first AUTH and the second AUTH.
The user equipment of claim 22, wherein:

The receiving unit is further configured to receive an internet protocol IP address of the base station sent by the base station;

The sending unit is further configured to send an IP address of a wireless local area network to which the user equipment is connected, to the base station.
A user equipment according to claim 22 or 23, wherein:

The sending unit is further configured to send a first IKEv2 message to the base station, where the first IKEv2 message includes a second security parameter;

The receiving unit is further configured to receive a response message of the first IKEv2 message sent by the base station;

The sending unit is further configured to: encrypt the second IKEv2 message according to the second security parameter, and send the encrypted second IKEv2 message to the base station, where the second IKEv2 message includes the IPsec tunnel establishment parameter, The IPsec tunnel establishment parameter further includes an IPsec tunnel transmission parameter, an identity of the user equipment, and an Internet Key Exchange Protocol header HDR, where the HDR includes an identifier SPI for identifying an IPsec tunnel establishment procedure, the IPsec tunnel The transmission parameter includes a first security parameter and an identifier TS of an ingress/egress port for identifying a data stream protected by the IPsec, the first security parameter including a security algorithm, and the first Kipsec or the second Kipsec, The security algorithm is a security algorithm set with a security algorithm level;

The receiving unit is further configured to receive a response message of the second IKEv2 message sent by the base station.
The user equipment of claim 24, wherein:

The sending unit is further configured to send at least one RRC message to the base station;

The at least one RRC message encapsulates the first IKEv2 message, the response message of the first IKEv2 message, the second IKEv2 message, and the response message of the second IKEv2 message.
A user equipment according to claim 22 or 23, wherein:

The sending unit is further configured to send, by using an RRC message, a security algorithm list supported by the user equipment to the base station, so that the base station according to its own security algorithm level list, and a list of security algorithms supported by the user equipment Determining a level of the security algorithm of the first security parameter, where the security algorithm level list includes a correspondence between multiple security algorithms and a security algorithm level;

The receiving unit is further configured to receive the IPsec tunnel establishment parameter sent by the base station, where the IPsec tunnel establishment parameter further includes an IPsec tunnel transmission parameter and an Internet Key Exchange Protocol header HDR, where the HDR includes an identifier for identifying IPsec An identifier SPI of the tunnel establishment process, where the IPsec tunnel transmission parameter includes a first security parameter and a TS, and the first security parameter includes determining the level of security An algorithm, and the first Kipsec or the second Kipsec.
A user equipment according to claim 22 or 23, wherein:

The receiving unit is further configured to receive a security algorithm level list of the base station that is sent by the base station by using an RRC message, where the security algorithm level list includes a correspondence between multiple security algorithms and a security algorithm level;

The determining unit is further configured to determine a level of the security algorithm of the first security parameter according to a security algorithm list supported by the base station and a security algorithm level list of the base station;

The sending unit is further configured to send the IPsec tunnel establishment parameter to the base station, where the IPsec tunnel establishment parameter further includes an IPsec tunnel transmission parameter and an Internet Key Exchange Protocol header HDR, where the HDR includes identifier for identifying IPsec An identifier SPI of the tunnel establishment process, where the IPsec tunnel transmission parameter includes a first security parameter and a TS, the first security parameter includes a security algorithm determining the level, and the first Kipsec or the second Kipsec.
A base station, comprising: a transmitter and a processor;

The transmitter is configured to send a first anti-replay parameter to the user equipment;

The processor is configured to determine a second anti-replay parameter of the user equipment, where the first anti-replay parameter and the second anti-replay parameter are respectively used to prevent the base station and the user equipment from generating each time The same key;

The processor is further configured to generate a first pre-shared key Kipsec according to the air interface key KeNB and the first anti-replay parameter, and generate first authentication information AUTH according to the first Kipsec;

The processor is further configured to determine an IPsec tunnel establishment parameter, where the IPsec tunnel establishment parameter includes a second AUTH, where the user equipment generates a second Kipsec according to the KeNB and the second anti-replay parameter, and according to The second Kipsec generates the second AUTH;

The processor is further configured to verify the first AUTH and the second AUTH, and an identity of the user equipment.
A base station according to claim 28, wherein:

The transmitter is further configured to send an internet protocol IP address of the base station to the user equipment;

The base station further includes: a receiver;

The receiver is further configured to receive an IP address of a wireless local area network to which the user equipment is connected, sent by the user equipment.
The base station according to claim 29, wherein said IPsec tunnel establishment parameter further comprises an IPsec tunnel transmission parameter, said IPsec tunnel transmission parameter comprising a first security parameter and an in/out of a data stream for identifying IPsec protection The identifier TS of the port, the first security parameter includes a security algorithm, and the first Kipsec or the second Kipsec.
A base station according to claim 30, wherein:

The receiver is further configured to receive a first Internet Key Exchange Protocol version 2 IKEv2 message sent by the user equipment, where the first IKEv2 message includes a second security parameter;

The transmitter is further configured to send a response message of the first IKEv2 message to the user equipment;

The receiver is further configured to receive a second IKEv2 message that is sent by the user equipment according to the second security parameter, where the second IKEv2 message includes the IPsec tunnel establishment parameter;

The transmitter is further configured to send a response message of the second IKEv2 message to the user equipment;

The IPsec tunnel establishment parameter further includes an identifier of the user equipment, and an Internet Key Exchange Protocol header HDR, where the HDR includes an identifier SPI for identifying an IPsec tunnel establishment procedure; the security algorithm is set There are security algorithms at the security algorithm level.
The base station according to claim 31, wherein the processor is further configured to:

Verifying whether the identity of the user equipment is consistent with the identity of the user equipment that has been obtained by the core network side.
A base station according to claim 30, wherein:

The receiver is further configured to receive at least one radio resource control RRC message sent by the user equipment;

The at least one RRC message encapsulates the first IKEv2 message, the response message of the first IKEv2 message, the second IKEv2 message, and the response message of the second IKEv2 message.
A base station according to claim 30, wherein:

The receiver is further configured to receive the second AUTH sent by the user equipment by using a radio resource control RRC message, and a list of security algorithms supported by the user equipment;

The processor is further configured to determine a level of the security algorithm of the first security parameter according to a list of security algorithm levels of the user and a list of security algorithms supported by the user equipment, where the security algorithm level list includes multiple security Correspondence between the algorithm and the level of the security algorithm;

The transmitter is further configured to send the IPsec tunnel establishment parameter to the user equipment.
A base station according to claim 30, wherein:

The transmitter is further configured to send, by using an RRC message, the second AUTH and the security algorithm level list of the base station to the user equipment, so that the user equipment according to the security algorithm list supported by the user equipment, and the a security algorithm level list of the base station, determining a level of the security algorithm of the first security parameter, where the security algorithm level list includes a correspondence between multiple security algorithms and a security algorithm level;

The receiver is further configured to receive the IPsec tunnel establishment parameter sent by the user equipment.
A user equipment, comprising: a processor, a transmitter, and a receiver; wherein

The processor is configured to determine a second anti-replay parameter of the user equipment, where the first anti-replay parameter and the second anti-replay parameter are respectively used to prevent the base station and the user equipment from generating a secret each time. The same key;

The processor is further configured to generate a second pre-shared key Kipsec according to the air interface key KeNB and the second anti-playback parameter, and generate second authentication information AUTH according to the second Kipsec;

a transmitter, configured to send the second AUTH to the base station;

a receiver, configured to receive an IPsec tunnel establishment parameter sent by the base station, where the IPsec tunnel establishment parameter includes a first AUTH, where the base station generates a first Kipsec according to the KeNB and the first anti-replay parameter, The base station generates the first AUTH according to the first Kipsec;

The processor is further configured to verify the first AUTH and the second AUTH.
The user equipment of claim 36, wherein:

The receiver is further configured to receive an internet protocol IP address of the base station sent by the base station;

The sending unit is further configured to send an IP address of a wireless local area network to which the user equipment is connected, to the base station.
A user equipment according to claim 36 or 37, wherein:

The transmitter is further configured to send a first IKEv2 message to the base station, where the first IKEv2 message includes a second security parameter;

The receiver is further configured to receive a response message of the first IKEv2 message sent by the base station;

The transmitter is further configured to: encrypt the second IKEv2 message according to the second security parameter, and send the encrypted second IKEv2 message to the base station, where the second IKEv2 message includes the IPsec tunnel establishment parameter, The IPsec tunnel establishment parameter further includes an IPsec tunnel transmission parameter, an identity of the user equipment, and an Internet Key Exchange Protocol header HDR, where the HDR includes an identifier SPI for identifying an IPsec tunnel establishment procedure, the IPsec tunnel The transmission parameter includes a first security parameter and an identifier TS of an ingress/egress port for identifying a data stream protected by the IPsec, the first security parameter including a security algorithm, and the first Kipsec or the second Kipsec, The security algorithm is a security algorithm set with a security algorithm level;

The receiver is further configured to receive a response message of the second IKEv2 message sent by the base station.
The user equipment of claim 38, wherein:

The transmitter is further configured to send at least one RRC message to the base station;

The at least one RRC message encapsulates the first IKEv2 message, the response message of the first IKEv2 message, the second IKEv2 message, and the response message of the second IKEv2 message.
A user equipment according to claim 36 or 37, wherein:

The transmitter is further configured to send, by using an RRC message, a security algorithm list supported by the user equipment to the base station, so that the base station according to its own security algorithm level list, and a list of security algorithms supported by the user equipment Determining a level of the security algorithm of the first security parameter, where the security algorithm level list includes a correspondence between multiple security algorithms and a security algorithm level;

The receiver is further configured to receive the IPsec tunnel establishment parameter sent by the base station, where the IPsec tunnel establishment parameter further includes an IPsec tunnel transmission parameter and an Internet key exchange protocol header HDR. The HDR includes an identifier SPI for identifying an IPsec tunnel establishment procedure, where the IPsec tunnel transmission parameter includes a first security parameter and a TS, the first security parameter includes a security algorithm that determines the level, and the first Kipsec or the second Kipsec.
A user equipment according to claim 36 or 37, wherein:

The receiver is further configured to receive a security algorithm level list of the base station that is sent by the base station by using an RRC message, where the security algorithm level list includes a correspondence between multiple security algorithms and a security algorithm level;

The processor is further configured to determine a level of the security algorithm of the first security parameter according to a list of security algorithms supported by the base and a security algorithm level list of the base station;

The transmitter is further configured to send the IPsec tunnel establishment parameter to the base station, where the IPsec tunnel establishment parameter further includes an IPsec tunnel transmission parameter and an Internet Key Exchange Protocol header HDR, where the HDR includes an identifier for identifying IPsec. An identifier SPI of the tunnel establishment process, where the IPsec tunnel transmission parameter includes a first security parameter and a TS, the first security parameter includes a security algorithm determining the level, and the first Kipsec or the second Kipsec.