WO2017091959A1 - Procédé de transmission de données, équipement utilisateur et dispositif côté réseau - Google Patents

Procédé de transmission de données, équipement utilisateur et dispositif côté réseau Download PDF

Info

Publication number
WO2017091959A1
WO2017091959A1 PCT/CN2015/096035 CN2015096035W WO2017091959A1 WO 2017091959 A1 WO2017091959 A1 WO 2017091959A1 CN 2015096035 W CN2015096035 W CN 2015096035W WO 2017091959 A1 WO2017091959 A1 WO 2017091959A1
Authority
WO
WIPO (PCT)
Prior art keywords
network side
data packet
side device
key
identifier
Prior art date
Application number
PCT/CN2015/096035
Other languages
English (en)
Chinese (zh)
Inventor
刘菁
黄敏
舒兵
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to PCT/CN2015/096035 priority Critical patent/WO2017091959A1/fr
Priority to CN201580084940.6A priority patent/CN108293223B/zh
Publication of WO2017091959A1 publication Critical patent/WO2017091959A1/fr

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/03—Protecting confidentiality, e.g. by encryption
    • H04W12/033—Protecting confidentiality, e.g. by encryption of the user plane, e.g. user's traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/041—Key generation or derivation
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/10—Integrity
    • H04W12/106—Packet or message integrity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W48/00—Access restriction; Network selection; Access point selection
    • H04W48/08—Access restriction or access information delivery, e.g. discovery data delivery

Definitions

  • the present invention relates to the field of communications technologies, and in particular, to a data transmission method, a user equipment, and a network side device.
  • the user equipment For the third generation mobile communication system (3rd generation, 3G) and its Long Term Evolution (LTE) system, in order to ensure the security of data transmission, the user equipment (User Equipment, UE) transmits data to the network side.
  • the security authentication and key agreement process between the UE and the network side must be performed.
  • EPS Evolved Packet System
  • AKA Authentication and Key Agreement
  • the security authentication and key agreement process between the UE and the network side is completed.
  • the connection establishment process of the radio resource control (RRC) between the UE and the base station is required, that is, the control between the UE and the base station needs to be established.
  • RRC radio resource control
  • M2M Machine-to-Machine
  • M2M technology is the integration of wireless communication and information technology for two-way. Communication for safety monitoring, vending machines, cargo tracking, payment systems (automated teller machines, support terminals and parking metering meters, etc.) and vehicle remote control (eg fleet management, toll collection, vehicle recovery and payment of premiums based on driving conditions) Etc) and other fields.
  • the M2M can be divided into three communication modes: machine-to-machine, machine-to-mobile terminal (such as user remote monitoring), and mobile terminal-to-machine (such as user remote control).
  • MTC Machine Type Communication
  • MTC requires no human intervention and can communicate directly between the machine and the machine.
  • MTC is becoming more and more abundant, and MTC is also a trend of intelligent development in the future. Therefore, MTC functions need to be supported in LTE systems.
  • the data sent by the MTC device to the network side is usually packet data (usually tens to hundreds of bytes).
  • the UE needs to establish a control plane connection between the UE and the eNB, a control plane connection between the eNB and the core network, and a user plane before sending the packet data to the network side.
  • the bearer and the user plane bearer process between the UE and the eNB have a large number of signaling interactions when establishing these connection/bearing processes, and thus a large signaling overhead is generated, resulting in low system efficiency.
  • the embodiments of the present invention provide a data transmission method, a user equipment, and a network side device, so that signaling resources required for establishing a control plane connection and a user plane bearer can be reduced, and system efficiency is improved.
  • an embodiment of the present invention provides a user equipment, including a processor, a receiver, and a transmitter.
  • the processor is configured to invoke the data storage program code stored in the memory to perform the following operations: using an encryption key. Encrypting and integrity protection of the data packet with the integrity protection key, wherein the encryption key and the integrity protection key are first random numbers generated by the user equipment UE according to the UE or from the network side device Generated by the received second random number, the data packet includes the identifier of the UE and user data; when the UE does not establish an RRC connection with the radio resource control of the base station, the encryption and integrity are performed by the transmitter The protected data packet is sent to the network side device.
  • the UE may generate an encryption key and an integrity protection key according to the first random number generated by the UE or the second random number received by the network side device, and further, the data packet to be transmitted.
  • the security processing is performed, and the securely processed data packet is sent to the network side device, which ensures the security of the data transmission, and can reduce the signaling resources required for establishing the control plane connection and the user plane bearer, thereby improving system efficiency.
  • the data packet further includes the first random number, where the first random number is used by the network side device to determine the data
  • the decryption key and integrity verification key used by the packet for decryption and integrity verification.
  • the UE does not rely on the random number of the home subscriber HSS to generate and deliver the derivative key, but instead generates the first random number of the derived key by the UE, and First random number
  • the encryption key and integrity protection key for generating encryption and integrity protection of the data packet to be transmitted are processed to securely process the data packet, thereby ensuring the security of data transmission and improving data transmission efficiency.
  • the data packet further includes the security algorithm indication information selected by the UE,
  • the security algorithm indication information is used by the network side device to determine a decryption algorithm and an integrity verification algorithm used for decrypting and integrity verification of the data packet.
  • the UE has user data to be sent, it does not rely on the security algorithm selected and delivered by the network side device (including the encryption algorithm and the integrity protection algorithm), but the UE selects the data packet to be transmitted for security.
  • the security algorithm is processed to securely process the data packet, thereby ensuring the security of the data transmission and improving the data transmission efficiency.
  • the processor before the encrypting and integrity protection of the data packet by using the encryption key and the integrity protection key, the processor is further configured to perform the following The operation is: when the UE does not establish the RRC connection with the base station, the network side device sends an authentication request to the home subscription user server HSS, where the authentication request includes the identifier of the UE, The authentication request is used to trigger the HSS to generate the second random number and determine, according to the identifier of the UE and the second random number, that the network side device uses the data packet to perform decryption and integrity verification.
  • the UE requests authentication from the network side device when the RRC connection is not established, and generates an encryption key and an integrity protection key for performing security processing on the data packet to be transmitted by using the second random number received from the network side device, thereby ensuring no RRC.
  • the security of the data transmission during the connection reduces the signaling overhead of establishing the control plane connection and the user plane bearer, improves the system efficiency, and the UE can implement the network side device by performing integrity verification on the response message sent by the network side device.
  • the security authentication does not depend on the authentication vector generated and delivered by the HSS, which simplifies the security authentication process of the UE to the network side device.
  • the processor is further configured to: receive the network by using the receiver A confirmation message sent by the side device after the integrity verification of the data packet is successful;
  • the integrity protection key performs integrity verification on the acknowledgment message.
  • the UE can perform the security verification on the network side device by performing the integrity verification on the acknowledgment message sent by the network side device, and no longer relies on the HSS to generate and send the authentication vector, which simplifies the security authentication process of the UE to the network side device.
  • the data packet further includes a third random number generated by the UE, where the third random number is used.
  • the network side device updates the identifier of the UE; the processor is further configured to: after performing integrity verification on the acknowledgement message, according to The third random number updates an identifier of the UE.
  • the UE and the network side device synchronously update the identifier of the UE, which can enhance the privacy of the UE, avoid exposing the UE's whereabouts during data transmission, and further improve the security of data transmission.
  • the network side device includes a base station or a serving gateway.
  • the data packet further includes an identifier of the destination server, where the identifier of the destination server is used to serve the gateway and the The destination server establishes a Transmission Control Protocol TCP connection and sends the user data to the destination server through the TCP connection.
  • the network side device includes the service And the identifier of the serving gateway is used by the base station to send the data packet to the serving gateway.
  • the sending, by the transmitter, the encrypted and integrity-protected data packet to the network side device includes: performing, by the transmitter, the encrypted and integrity-protected data packet by using a random connection
  • the incoming preamble message or the RRC connection setup request message is sent to the base station.
  • the UE reduces the establishment of the control plane by carrying the data packet in the random access preamble message or the RRC connection setup request message or other resources allocated by the base station to the UE, and then sending the data packet to the network side device.
  • the connection and user planes carry the required signaling resources, which improves system efficiency.
  • an embodiment of the present invention provides a network side device, including a processor, a receiver, and a transmitter, wherein the data transmission program code used by the processor to invoke the memory performs an operation of: receiving, by the receiver, a data packet sent by a user equipment UE when a radio resource control RRC connection with a base station is not established,
  • the data packet includes an identifier of the UE and user data, where the data packet is a data packet obtained by performing encryption and integrity protection on the UE, and determining, according to the identifier of the UE, a decryption key corresponding to the UE.
  • the network side device receives a data packet sent by the UE when the RRC connection with the base station is not established, and determines a decryption key and an integrity verification key for decrypting and integrity verification of the data packet according to the identifier of the UE, and the data is verified by using the data.
  • the integrity verification of the packet implements the security authentication of the UE, which simplifies the security authentication process of the network side device to the UE, and reduces the signaling overhead of establishing control plane connection and user plane bearer, and improves system efficiency.
  • the data packet further includes a first random number generated by the UE, and determining, according to the identifier of the UE, the decryption corresponding to the UE And the key and integrity verification key, including: sending the identifier of the UE and the first random number to a home subscription subscriber server HSS, generating an intermediate key of the UE by using the HSS, and according to the HSS The generated intermediate key generates a decryption key and an integrity verification key corresponding to the UE, and stores a correspondence between the identifier of the UE and the decryption key and the integrity verification key.
  • the data packet further includes the security algorithm indication information selected by the UE, where The security algorithm indication information is used by the network side device to determine a decryption algorithm and an integrity verification algorithm used for decrypting and integrity verification of the data packet.
  • the receiving, by the receiver, the data packet that is sent by the user equipment UE when the radio resource control RRC connection with the base station is not established is performed by the receiver,
  • the processor is further configured to: receive, by the receiver, an authentication request sent by the UE when the RRC connection is not established with the base station, where the authentication request includes an identifier of the UE; Sending the authentication request to the home subscriber server HSS, the authentication request is used to trigger the HSS to generate a second random number and according to the identifier of the UE and the second Generating, by the random number, an intermediate key of the UE, the network side device generating a decryption key and an integrity verification key according to the intermediate key generated by the HSS, and storing the identifier of the UE and the decryption key Corresponding relationship between the key and the integrity verification key; sending, by the transmitter, a response message to the UE, the response message includes the second random number, and the
  • the network side device receives an authentication request sent by the UE when the RRC connection with the base station is not established, generates a second random number of the derived key by using the HSS, and determines to decrypt the data packet according to the intermediate key of the UE generated by the HSS.
  • the integrity verification decryption key and the integrity verification key realize the security authentication of the UE by performing integrity verification on the data packet, simplifying the security authentication process of the network side device to the UE, and reducing the establishment of the control plane connection and the user.
  • the signaling overhead carried by the plane improves the system efficiency.
  • the processor is further configured to: perform integrity on the data packet After the verification is successful, an acknowledgement message is sent to the UE by the transmitter, and the acknowledgement message is used by the UE to perform integrity verification on the acknowledgement message by using the integrity protection key of the UE.
  • the data packet further includes a third random number generated by the UE, where the third random number is used.
  • the identifier of the UE is updated; the processor is further configured to: after performing integrity verification on the data packet, according to the The three random numbers update the identifier of the UE, and store the updated correspondence between the identifier of the UE and the decryption key and the integrity verification key.
  • the network side device and the UE synchronously update the identifier of the UE, which can enhance the privacy of the UE, avoid exposing the UE's whereabouts during data transmission, and further improve the security of data transmission.
  • the network side device includes a base station or a serving gateway.
  • the data packet further includes an identifier of the destination server, where the user data is sent by the transmitter
  • the sending to the destination server includes: establishing a transmission control protocol TCP connection with the destination server according to the identifier of the destination server, and sending the user data to the destination server by using the TCP connection. Therefore, the DNS domain name resolution process is no longer triggered by the UE, that is, the UE does not need to pass.
  • the TCP connection process with the destination server is established by occupying a large number of air interface resources, but the DNS process is triggered by the service gateway instead of the UE, and the service gateway establishes a TCP connection with the destination server, thereby connecting the decrypted user data through the TCP connection. Sent to the destination server, thus reducing the signaling resources for establishing a TCP connection.
  • the network side device includes the service And the identifier of the serving gateway is used by the base station to send the data packet to the serving gateway.
  • the receiving, by the receiver, the data packet that is sent by the user equipment UE when the RRC connection with the radio resource control of the base station is not established includes: receiving, by the receiver, the user equipment, the UE, does not establish radio resource control with the base station.
  • an embodiment of the present invention provides a data transmission method, where a user equipment UE implements secure transmission of data when a radio resource control RRC connection with a base station is not established, and the method includes: the UE uses an encryption key.
  • the key and the integrity protection key perform encryption and integrity protection on the data packet, where the encryption key and the integrity protection key are the first random number generated by the UE according to the UE or from the network side
  • the data packet further includes the first random number, where the first random number is used by the network side device to determine the data The decryption key and integrity verification key used by the packet for decryption and integrity verification.
  • the data packet further includes the security algorithm indication information selected by the UE, where The security algorithm indication information is used by the network side device to determine a decryption algorithm and an integrity verification algorithm used for decrypting and integrity verification of the data packet.
  • the UE uses Before the encryption and integrity protection of the data packet by the secret key and the integrity protection key, the method further includes: when the UE does not establish the RRC connection with the base station, using the network side device to the home subscription user server The HSS sends an authentication request, where the authentication request includes an identifier of the UE, where the authentication request is used to trigger the HSS to generate the second random number, and determine the identifier according to the identifier of the UE and the second random number.
  • the UE receives a response message sent by the HSS by using the network side device, where the response message includes The second random number; the UE performs integrity verification on the response message by using the integrity protection key.
  • the fourth possible implementation manner of the third aspect An acknowledgement message sent after the packet is successfully verified by the integrity; the UE uses the integrity protection key to perform integrity verification on the acknowledgement message.
  • the data packet further includes a third random number generated by the UE, where the third random number is used.
  • the network side device updates the identifier of the UE; the method further includes: after the UE successfully performs integrity verification on the acknowledgement message, according to the The third random number updates the identity of the UE.
  • the network side device includes a base station or a serving gateway.
  • the data packet further includes an identifier of the destination server, where the identifier of the destination server is used to serve the gateway and the The destination server establishes a Transmission Control Protocol TCP connection and sends the user data to the destination server through the TCP connection.
  • the network side device when the network side device includes the service And the identifier of the serving gateway is used by the base station to send the data packet to the serving gateway.
  • the sending, by the encryption and integrity protection, the data packet to the network side device includes: sending, by using the random access preamble message or the RRC connection setup request message, the encrypted and integrity protected data packet. To the base station.
  • the embodiment of the present invention provides a data transmission method, including: a network side device receiving a data packet sent by a user equipment UE when a radio resource control RRC connection with a base station is not established, the data packet including the UE And the user data, the data packet is obtained by performing encryption and integrity protection on the UE, and the network side device determines, according to the identifier of the UE, a decryption key and integrity verification corresponding to the UE. Key; the network side device decrypts and integrity verifies the data packet by using the decryption key and the integrity verification key; the network side device successfully performs integrity verification on the data packet The user data is then sent to the destination server.
  • the data packet further includes a first random number generated by the UE, and the network side device determines the UE according to the identifier of the UE.
  • Corresponding decryption key and integrity verification key comprising: the network side device sending the identifier of the UE and the first random number to a home subscription subscriber server HSS, and generating, by the HSS, the middle of the UE Generating a decryption key and an integrity verification key corresponding to the UE according to the intermediate key generated by the HSS, and storing the identifier of the UE and the decryption key and the integrity verification The correspondence of the keys.
  • the data packet further includes the security algorithm indication information selected by the UE, where The security algorithm indication information is used by the network side device to determine a decryption algorithm and an integrity verification algorithm used for decrypting and integrity verification of the data packet.
  • the network side device before receiving the data packet sent by the user equipment UE when the radio resource control RRC connection with the base station is not established, further includes: The network side device receives an authentication request sent by the UE when the RRC connection is not established with the base station, where the authentication request includes an identifier of the UE, and the network side device sends the authentication request to a home subscription.
  • the authentication request is used to trigger the HSS to generate a second random number, and generate an intermediate key of the UE according to the identifier of the UE and the second random number, where the network side device is configured according to the The intermediate key generated by the HSS generates a decryption key and an integrity verification key, and stores the identifier of the UE and the decryption key and the integrity verification Corresponding relationship of the key; the network side device sends a response message to the UE, the response message includes the second random number, and the second random number is used by the UE to generate and encrypt the data packet And the encryption key and integrity protection key used for integrity protection.
  • the method further includes: the network side device performing integrity on the data packet After the verification succeeds, an acknowledgment message is sent to the UE, and the acknowledgment message is used by the UE to perform integrity verification on the acknowledgment message by using the integrity protection key of the UE.
  • the data packet further includes a third random number generated by the UE, where the third random number is used After the integrity verification of the acknowledgment message by the UE is successful, the identifier of the UE is updated; the method further includes: after the network side device successfully performs integrity verification on the data packet, according to the The third random number updates the identifier of the UE, and stores the updated correspondence between the identifier of the UE and the decryption key and the integrity verification key.
  • the network side device includes a base station or a serving gateway.
  • the data packet further includes an identifier of the destination server, where the user data is sent to the destination server
  • the method includes: the serving gateway establishes a transmission control protocol TCP connection with the destination server according to the identifier of the destination server, and sends the user data to the destination server by using the TCP connection.
  • the network side device includes the serving gateway And the data packet further includes an identifier of the serving gateway, where the identifier of the serving gateway is used by the base station to send the data packet to the serving gateway.
  • the network side device receives a data packet that is sent by the user equipment UE when the RRC connection with the radio resource control of the base station is not established, and includes: receiving, by the base station, the random access by the user equipment UE when establishing the radio resource control RRC connection with the base station Sending a preamble message or an RRC connection setup request message Packet.
  • the embodiment of the present invention provides a user equipment, where the user equipment is used to perform the foregoing third aspect, or the data transmission method in any one of the possible implementation manners of the third aspect, where the user equipment includes A module or unit for performing the above third aspect, or any one of the data transmission methods of the third aspect.
  • the embodiment of the present invention provides a network side device, where the network side device is configured to perform the foregoing fourth aspect, or the data transmission method in any one possible implementation manner of the fourth aspect, where the network
  • the side device includes a module or unit for performing the above fourth aspect, or any one of the data transmission methods of the fourth aspect.
  • the embodiment of the present invention provides a data transmission system, including a user equipment and a network side device, where the user equipment is in the foregoing first aspect, or in any possible implementation manner of the first aspect.
  • the network side device is the network side device in the foregoing second aspect, or any possible implementation manner of the second aspect.
  • an embodiment of the present invention provides a computer program, where the computer program includes program code, when the user equipment UE runs the computer program, the program code performs the third aspect, or the third aspect. Any data transmission method.
  • an embodiment of the present invention provides a computer program, where the computer program includes program code, and when the network side device runs the computer program, the program code performs the fourth aspect, or the fourth aspect. Any data transmission method.
  • 1A is a schematic diagram of a network architecture of an LTE system
  • FIG. 1B is a schematic diagram of a signaling process of an AKA security authentication and key agreement process
  • FIG. 2 is a schematic diagram of a signaling flow of a connection/bearer establishment process before data transmission
  • FIG. 3 is a schematic diagram of a network architecture of an LTE system according to an embodiment of the present invention.
  • FIG. 4A is a schematic flowchart of a data transmission method according to an embodiment of the present invention.
  • 4B is a schematic flowchart of another data transmission method according to an embodiment of the present invention.
  • 4C is a schematic flowchart of another data transmission method according to an embodiment of the present invention.
  • 4D is a schematic flowchart of another data transmission method according to an embodiment of the present invention.
  • 4E is a schematic flowchart of another data transmission method according to an embodiment of the present invention.
  • 4F is a schematic flowchart of another data transmission method according to an embodiment of the present invention.
  • 4G is a schematic flowchart of another data transmission method according to an embodiment of the present invention.
  • FIG. 5 is a schematic structural diagram of a user equipment according to an embodiment of the present disclosure.
  • FIG. 6 is a schematic structural diagram of a network side device according to an embodiment of the present disclosure.
  • FIG. 7 is a schematic structural diagram of another user equipment according to an embodiment of the present disclosure.
  • FIG. 7B is a schematic structural diagram of another user equipment according to an embodiment of the present disclosure.
  • FIG. 7C is a schematic structural diagram of another user equipment according to an embodiment of the present disclosure.
  • FIG. 7D is a schematic structural diagram of another user equipment according to an embodiment of the present invention.
  • FIG. 8 is a schematic structural diagram of another network side device according to an embodiment of the present disclosure.
  • FIG. 8B is a schematic structural diagram of another network side device according to an embodiment of the present disclosure.
  • FIG. 8C is a schematic structural diagram of another network side device according to an embodiment of the present disclosure.
  • FIG. 8 is a schematic structural diagram of another network side device according to an embodiment of the present disclosure.
  • FIG. 8E is a schematic structural diagram of another network side device according to an embodiment of the present invention.
  • the following describes the network architecture, AKA security authentication, and key agreement process of the LTE system, and connection/bearer establishment before data transmission. The process is described.
  • FIG. 1A is a schematic diagram of a network architecture of an LTE system.
  • the LTE system network architecture mainly includes a UE, an EUTRAN Node B (eNB), a Mobility Management Entity (MME), a Serving Gateway (S-GW), and a Packet Data Network Gateway. , P-GW) and Home Subscriber Server (HSS), where the eNB is an evolved universal radio access network (Evolved)
  • EUTRAN Universal Terrestrial Radio Access Network
  • the MME, the S-GW, the P-GW, and the HSS are network elements in an Evolved Packet Core (EPC).
  • EPC Evolved Packet Core
  • the UE and the eNB implement wireless communication through the Uu interface.
  • the communication interface between the eNB and the MME is S1-MME
  • the communication interface between the eNB and the S-GW is S1-U.
  • the LTE system adopts a design method in which the user plane and the control plane are separated.
  • the control plane signaling and the user plane bearer in the core network corresponding to the LTE system are respectively responsible by the independent network element MME and the S-GW.
  • the main functions of the MME include non-access stratum (NAS) signaling establishment, NAS signaling security, signaling establishment across the core network, tracking service (when the UE is in IDLE mode), roaming service, Authorization and bearer management, etc.
  • NAS non-access stratum
  • the S-GW is the gateway point for eNB handover, forwarding 2G/3G and other system service gateway points, completing buffering of downlink packets, some initialization work, prescribed interception interception, packet routing and forwarding, and the like.
  • the P-GW is used for policy enforcement, packet filtering, prescribed interception, allocation of IP addresses of UEs, charging functions, packet reproduction, and the like.
  • control signaling between the UE, the eNB and the core network is processed by the MME; the user data is transmitted to the P-GW through the S-GW, and then transmitted to the outside by the P-GW (relative to the operator) Access point name (APN) nodes, such as Public Data Network (PDN).
  • PDN Access point name
  • PDN Public Data Network
  • FIG. 1B is a schematic diagram of a signaling flow of an AKA security authentication and key agreement process.
  • Entities participating in the security authentication and key agreement process in the LTE system include: UE, MME, and HSS.
  • the security authentication and the key agreement process are performed based on the symmetry key, that is, a root key K is pre-shared between the UE and the HSS, specifically, the Universal Subscriber Identity Module (USIM) of the UE/ A Permanent Symmetric Root Key K is shared on the Subscriber Identity Module (SIM) and the HSS maintained by the operator.
  • This K is written once during the manufacture of the USIM/SIM and is protected by the USIM/SIM. The mechanism is protected and cannot be read.
  • the security authentication and key agreement process includes the following steps.
  • the UE sends an authentication request to the MME, where the message carries the International Mobile Subscriber Identity (IMSI) of the UE, the capability of the UE (the encryption algorithm and the integrity protection algorithm supported by the UE), and the IDHSS of the HSS. Identification and other information.
  • IMSI International Mobile Subscriber Identity
  • the capability of the UE the encryption algorithm and the integrity protection algorithm supported by the UE
  • the IDHSS the HSS. Identification and other information.
  • the MME forwards the authentication request of the UE to the HSS, where the message carries the IMSI, the network identifier (Serving Network ID, SNID), and the service network type (Network Type) of the service network.
  • the HSS looks up the IMSI and the SNID in the local database to verify the legality of the two entities. If the verification succeeds, the root key K corresponding to the UE is found according to the IMSI, and a random number RAND is randomly generated, and then the authentication corresponding to the UE is generated according to the RAND, the authentication sequence number SQN, the key K and other information currently saved by itself.
  • Authentication Vector AV
  • AV Authentication Vector
  • AUTN Authentication Token
  • XRES Expected Response
  • Shared Key K ASME used to generate non-access stratum and access
  • the HSS returns an authentication response to the MME, where the message carries the authentication vector AV of the UE, and the MME saves the received authentication vector of the UE.
  • MME sends an authentication request to the UE, where the message carries the authentication vector of the UE corresponding to the RAND and AUTN, and the MME is the key K ASME is assigned a key identifier KSI ASME.
  • the UE After receiving the authentication request, the UE performs verification according to the received RAND and AUTN, including: calculating an AUTN′ according to the SQN in the RAND, the AUTN, and the root key K shared with the network side, and comparing the Whether the AUTN' is consistent with the received AUTN. If the UE passes the security authentication on the network side, the RAND and the root key K jointly calculate a response (Response, RES) and send it to the MME. The UE further generates an air interface key K eNB according to K ASME .
  • the MME compares the received RES with the XRES in the authentication vector AV. If they are the same, the MME passes the security authentication of the UE, and further generates an air interface key K eNB based on the K ASME key, and K eNB And the capabilities of the UE are sent to the eNB.
  • the eNB determines an encryption algorithm and an integrity protection algorithm for the air interface user plane data and the control plane signaling according to the capability of the UE and the encryption algorithm and the integrity protection algorithm supported by the eNB, and adopts a security mode command (Security Mode Command, SMC).
  • SMC Security Mode Command
  • the message sends the selected encryption algorithm and integrity protection algorithm to the UE.
  • the UE and the eNB can respectively generate the secret for air interface encryption and integrity protection by using the air interface key K eNB and the agreed key algorithm.
  • KUP enc is a user data encryption key for securing uplink data between the UE and the eNB
  • KRRC enc is an access layer RRC signaling encryption key for guarantee The confidentiality of the RRC signaling between the UE and the eNB
  • the KRRC int is the access layer RRC signaling integrity protection key, which is used to ensure the integrity of the RRC signaling between the UE and the eNB.
  • the connection establishment process of the radio resource control (RRC) between the UE and the eNB needs to be established, that is, the connection establishment process needs to be established.
  • the control plane is connected/beared between the UE and the eNB, and after the RRC connection is established, the control plane connection and the user plane bearer between the eNB and the core network, and the user plane bearer between the UE and the eNB are also required to be established. After these connections/bearers are established, the UE can send user data to the network side through the user plane bearer.
  • FIG. 2 is a schematic diagram of a signaling flow of a connection/bearer setup process before data transmission.
  • the signaling flow in the connection/bearer establishment process before data transmission is as follows.
  • S201 When the UE has data to be sent, it waits for a physical random access channel (PRACH) scheduling period according to the random access resource information configured by the system, and sends a random access preamble (Random Access Preamble) to the eNB.
  • PRACH physical random access channel
  • Preamble message the Preamble message includes a random access preamble sequence preamble selected by the UE.
  • the eNB After receiving the preamble sent by the UE, the eNB sends a random access response to the UE in a random access response window.
  • the random access response message may respond to a random access request (preamble) of multiple UEs.
  • the random access response is scheduled by the Downlink Control Information (DCI) carried in the Physical Downlink Control Channel (PDCCH) that is scrambled by the Radio Network Temporary Identity (RA-RNTI). And the RA-RNTI is determined by the PRACH time-frequency resource location of the preamble.
  • the content of the random access response includes: a backoff parameter, a preamble identifier corresponding to the Preamble message, a Timing Advance (TA), an uplink resource allocated for the UE to send a third message, and a cell radio. Cell Radio Network Temporary Identity (C-RNTI), etc.
  • the backoff parameter is used to indicate the average delay of the next time the UE initiates random access if the random access fails.
  • the UE may be determined by the preamble identifier in the RA-RNTI and the random access response.
  • the random access response sent by the eNB to the eNB if the preamble corresponding to the preamble identifier in the random access response includes the preamble when the random access is initiated by itself, the user considers that the user successfully receives the random access response message, and then proceeds to the network.
  • the third message is sent by the side. If the UE does not correctly receive the random access response, the delay of the next random access is determined according to the delay limit of the backoff parameter, and the random access resource is additionally selected to initiate the next random access. After the maximum number of random accesses is reached, the UE media access control layer (MAC) reports a random access problem to the RRC layer, triggering a radio link failure process.
  • MAC media access control layer
  • the UE After receiving the random access response, the UE sends a third message on the uplink resource allocated by the eNB.
  • the third message contains different contents for different scenarios. For example, when the UE initially accesses, the third message carries an RRC connection setup request message generated by the RRC layer.
  • the eNB and the UE complete the final contention resolution by using the fourth message.
  • the fourth message content corresponds to the content of the third message.
  • the fourth message carries the UE Contention Resolution Identity (MAC), and after the UE receives the MAC CE, the user identifier and the third message carried by the MAC CE are received. The user IDs carried in the comparison are compared. If they are completely consistent, the UE can know that the competition is successful.
  • MAC UE Contention Resolution Identity
  • the fourth message may further include an RRC connection setup message, configured to establish a signaling radio bearer 1 (SRB1) of the UE.
  • SRB1 signaling radio bearer 1
  • the UE After completing the contention resolution, the UE establishes a signaling radio bearer 1 (SRB1) according to the information in the RRC connection setup message, and sends an RRC connection setup complete message to the network.
  • SRB1 signaling radio bearer 1
  • the NAS service request message may be sent to the network side when the RRC connection setup complete message is sent.
  • the eNB After receiving the RRC connection setup complete message, the eNB sends the piggybacked NAS service request message to the MME, where the MME is configured to request the MME to establish a related connection between the eNB corresponding to the UE and the core network element (ie, the control plane of the MME is connected. And S1 bearer with S-GW).
  • the MME notifies the eNB of the information corresponding to the UE connection.
  • the eNB sends a Security Mode Command (SMC) and an RRC Connection Reconfiguration message to the UE, which is used to activate the security of the UE and establish a Data Radio Bearer (DRB) and other Signaling Radio Bearers (SRB2) for the UE.
  • SMC Security Mode Command
  • RRC Connection Reconfiguration message to the UE, which is used to activate the security of the UE and establish a Data Radio Bearer (DRB) and other Signaling Radio Bearers (SRB2) for the UE.
  • DRB Data Radio Bearer
  • SRB2 Signaling Radio Bearers
  • the security mode command needs to perform integrity protection processing before sending, and the RRC connection reconfiguration message needs to be encrypted and integrity protected before being sent.
  • the UE After the security activation and the DRB and SRB2 configuration are completed, the UE sends a security mode complete message and an RRC connection reconfiguration complete message to the network side.
  • the user plane data of the UE is sent to the PGW by the DRB between the UE and the eNB, and the S1 bearer between the eNB and the SGW; the control signaling of the UE and the core network is between the UE and the eNB.
  • the SRB, and the S1AP between the eNB and the MME are sent to the MME.
  • the MTC device In many application scenarios of the MTC service, the MTC device only sends small data volume data to the network side, and usually the data transmission period is also long, which may be a second-level unit, or in units of days, or even months. .
  • data reporting of smart metering devices such as smart meters, smart water meters, smart gas meters, etc.
  • POS point of sale
  • a large signaling overhead for example, related signaling overhead in the signaling flow before the foregoing data transmission
  • a large signaling overhead for example, related signaling overhead in the signaling flow before the foregoing data transmission
  • the embodiment of the present invention provides a data transmission method, a user equipment, and a network side device, so that when the UE does not establish an RRC connection with the base station, that is, the control plane connection and the user plane bearer are not established,
  • the UE can transmit data to the network side, and can ensure the security of the data transmission, thereby reducing the signaling required to establish the control plane and the user plane connection, reducing the signaling overhead, and improving the system efficiency.
  • the user equipment UE in the following embodiments of the present invention includes, but is not limited to, an MTC device and a Mobile Broadband (MBB) device, where the user data for the MTC service (small packet data transmission service is usually not more than one kilobyte).
  • the terminal is called an MTC device, and the MTC device may be a UE having MTC characteristics, such as a meter reading terminal, a mobile phone, a tablet computer, a notebook computer, and a palm.
  • MID mobile Internet device
  • a wearable device such as a smart watch, a smart bracelet, smart glasses, etc.
  • other terminal device or communication module in which a USIM/SIM card is deployed.
  • MTC devices can access Global System for Mobile Communication (GSM), General Packet Radio Service (GPRS), Universal Mobile Telecommunications System (UMTS), Evolved Universal Land A network such as a UMTS Terrestrial Radio Access Network (UTRAN) or EUTRAN communicates with an MTC server or other MTC device to implement an MTC application.
  • Terminals for MBB services (such as the transmission of packet data such as WeChat) are called MBB devices, such as mobile phones, tablets, laptops, PDAs, MIDs, wearable devices (such as smart watches, smart bracelets, smart glasses, etc.) ) or other installation of a terminal device or communication module with a USIM/SIM card installed.
  • FIG. 3 is a schematic diagram of a network architecture of an LTE system according to an embodiment of the present invention.
  • the LTE system network architecture mainly includes a UE, a base station eNB, and a core network, where the core network mainly includes: an S-GW (for example, an MTC-GW in an MTC service), an HSS, and a P-GW, where P- The GW can exist independently, and the functions of the P-GW can be integrated into the S-GW to implement all functions of the existing S-GW and the P-GW through a separate S-GW, and the Uu interface is adopted between the UE and the eNB.
  • S-GW for example, an MTC-GW in an MTC service
  • HSS HSS
  • P-GW P-GW
  • P- The GW can exist independently, and the functions of the P-GW can be integrated into the S-GW to implement all functions of the existing S-GW and the P-GW through a separate S-GW, and the Uu interface is adopted between the UE
  • the eNB and the S-GW realize data transmission through the S1-U interface, and the S-GW and the HSS implement data transmission through the newly added S-HSS interface, and the S-HSS is S-GW and HSS.
  • the newly added interface name, the newly added interface name between the S-GW and the HSS may be other names, which are not specifically limited in the embodiment of the present invention, and the eNB may perform data transmission through the S-GW and the HSS.
  • the user data is transmitted to the P-GW through the S-GW, and then transmitted by the P-GW to the destination server Server, or the S-GW directly transmits the user data to the server.
  • FIG. 4A is a schematic flowchart of a data transmission method according to an embodiment of the present invention, where the method includes but is not limited to the following steps.
  • the user equipment UE encrypts and integrity protects the data packet by using an encryption key and an integrity protection key.
  • the UE when the user equipment UE in the IDEL state needs to send the user data to the network side device, the UE performs security processing (including encryption processing and integrity) on the data packet to be transmitted according to the encryption key and the integrity protection key. Protection processing).
  • the UE includes but is not limited to MTC
  • the device or the MBB device includes, but is not limited to, an identifier of the UE and user data to be transmitted by the UE.
  • the user data is packet data, that is, small data volume user data.
  • the user data transmitted by the MTC device to the network side device is packet data (usually several tens to several hundred words).
  • the UE can report the meter/water meter information to the network side device every month, and upload the meter/water meter information to the destination server (for example, the cell meter reading server) through the network side device.
  • the destination server for example, the cell meter reading server
  • Statistical processing wherein the reported meter/water meter information corresponds to a small amount of data, usually several tens of bytes.
  • WeChat service in the MBB service one WeChat user data transmitted by the MBB device to the network side device usually does not exceed one kilobyte.
  • the UE generates a first random number of the derived key, and generates key information of the UE step by step according to the first random number (including encrypting the transmitted data packet and The cryptographic key and the integrity protection key used by the integrity protection; as an alternative implementation, the HSS generates a second random number of the derived key, and sends the same to the And the UE generates the key information of the UE step by step according to the second random number sent by the network side device.
  • the UE may generate the key information, where the UE may use the first random number (or the second random number) and the root key K of the UE as input parameters, according to the UE and the UE.
  • the network side device negotiates a good key algorithm for processing to generate the key information step by step. Therefore, it can be understood that the network side device may also process the first random number (or the second random number) and the root key of the UE as an input parameter, and process according to the key algorithm.
  • the key information corresponding to the UE (including the decryption key and the integrity verification key used for decrypting and integrity verification of the transmitted data packet) is generated step by step.
  • the encryption key generated by the UE is the same as the decryption key generated by the network side device, and the integrity protection key generated by the UE and the complete
  • the authentication keys are the same, and the network side devices include, but are not limited to, a base station (for example, an eNB) and a serving gateway (for example, an S-GW, and the service gateway is an MTC-GW for MTC services).
  • the key algorithm may be negotiated in advance between the UE and the network side device. For example, the UE may select a key algorithm, and then send the key algorithm to the network side device. Or, the network side device selects a key algorithm, and then sends the key algorithm to the UE, which is not specifically limited in the embodiment of the present invention.
  • the UE and the network side device may further add other key generation parameters to generate key information of the UE. For example, the identity of the UE, and the like.
  • the UE encrypts user data in the data packet according to the encryption key to obtain encrypted user data, and the UE compares parameter information in the data packet according to the integrity protection key (
  • the integrity protection is included, including but not limited to the identity of the UE, to obtain integrity protection information, ie, Message Authentication Code for Inter-Massage (MAC-I).
  • the UE transmits the encrypted user data, the parameter information, and the MAC-I obtained by the encryption and integrity protection processing as the data packet to be transmitted.
  • the UE takes the user data and the encryption key as input parameters, and then processes the encryption data (which can be considered as a hash function) to obtain encrypted user data, and the UE will use the UE.
  • the identity and the integrity protection key are used as input parameters, and then processed by an integrity protection algorithm (a hash function) to obtain the complete message authentication code MAC-I.
  • the identifier of the UE is A
  • the user data is B
  • the encrypted user data obtained by encrypting the user data B by using the encryption key is B′
  • the protection key A performs integrity protection
  • the MAC-I obtained is a
  • the content carried in the data packet is: A, B', and a.
  • the user data may also participate in the integrity protection process, that is, the UE performs integrity protection on the parameter information and the user data according to the integrity protection key corresponding to the UE, and obtains a MAC. -I.
  • other parameter parameters other than the identifier of the UE in the parameter information (for example, parameters that the network side device does not need to directly use before decrypting the received data packet) may also participate in the encryption process and obtain encryption. Parameters, such that the data packet includes encrypted user data, encryption parameters, unencrypted parameters, and the MAC-I.
  • the UE is to the user.
  • the two processes of encrypting data and performing integrity protection on the parameter information may be performed simultaneously, or may be performed in a time-sharing manner, and when the time-sharing is performed, the embodiment of the present invention does not limit the sequence.
  • the UE first performs integrity protection processing on the user data and the parameter information, obtains the MAC-I, performs encryption processing on the user data, and performs the encryption process on the user data.
  • the encryption process is performed on the sub-parameters, wherein the encryption process of the user data and the encryption of the partial parameters may be performed simultaneously, or may be performed in a time-sharing manner, and when the time-sharing is performed, the embodiment of the present invention The order is not limited.
  • the parameter information in the data packet further includes security algorithm indication information selected by the UE, where the security algorithm indication information includes The encryption algorithm identifier corresponding to the encryption algorithm used by the UE (for example, EEA0 (empty algorithm) in the Encryption Algority (EEA), EEA1 (standard algorithm based on 3G network), EEA2 (enhanced encryption algorithm) or EEA3 (Zhu Chongzhi algorithm), etc.) integrity protection algorithm identifier corresponding to the integrity protection algorithm used by the UE (eg EIA0 (empty algorithm), EIA1 (3G network-based standard) in EPS Integrity Algorym (EIA) Algorithm), EIA2 (Enhanced Encryption Algorithm) or EIA3 (Augmented Algorithm), etc., the encryption algorithm is used by the UE to encrypt the data packet, and the integrity protection algorithm is used by the UE to
  • the encryption algorithm is an algorithm used by the UE to encrypt the user data and encrypt some parameters in the parameter information, where the integrity protection algorithm is The algorithm used by the parameter information for integrity protection processing.
  • the security algorithm indication information is only carried in the first data packet sent by the UE to the network side device, and the network side device obtains the security algorithm indication information after receiving the data packet.
  • the security algorithm indication information may or may not be carried, and is not specifically limited in this embodiment of the present invention.
  • the parameter information in the data packet further includes an identifier of the destination server.
  • the identifier of the destination server includes, but is not limited to, a Uniform Resource Locator (URL).
  • the identifier of the destination server participates in an integrity protection process, and the identifier of the destination server may also participate in an encryption process.
  • the parameter information in the data packet further includes an identifier of the serving gateway.
  • the serving gateway sends the identifier to the UE, and the next time the UE sends the data packet to the serving gateway.
  • the parameter information in the data packet further includes an identifier of the serving gateway.
  • the service gateway Identifies participation in the integrity protection process and does not participate in the encryption process.
  • the UE performs encryption and integrity protection on the data packet, and the packet data convergence protocol in the second layer (data link layer) of the wireless interface (Packet Data) Implemented in the layer of the Convergence Protocol (PDCP); if the network side device is a serving gateway, the UE and the serving gateway need to have a peer protocol sublayer, so the UE performs the data packet
  • the encryption and integrity protection process is implemented in the peer-to-peer protocol sublayer.
  • the protocol sublayer may be a new protocol sublayer or an extension of an existing protocol sublayer function.
  • the UE sends the encrypted and integrity-protected data packet to the network side device when the RRC connection with the radio resource control of the base station is not established.
  • the UE sends the data packet obtained by the encryption and integrity protection processing to the network side device, and the network side device receives the UE and the base station is not established, if the RRC connection with the base station is not established.
  • the RRC connection is sent with packets that are encrypted and integrity protected.
  • the network side device includes, but is not limited to, a base station and a serving gateway, that is, the network side device may be a base station, a service gateway, or a base station and a serving gateway. If the network side device is a base station, the UE sends the data packet to the base station, the base station receives the data packet, and performs step S405, and the message or data transmitted between the base station and the serving gateway passes the Internet protocol security.
  • IPsec Internet Protocol Security
  • IPsec Internet Protocol Security
  • other protocols perform security protection; if the network side device is a serving gateway, the UE sends the data packet to a base station, the base station receives the data packet, and the data is The packet is transparently transmitted to the serving gateway, and the serving gateway receives the data packet sent by the base station and performs step S405.
  • the UE sends the encrypted and integrity-protected data packet to the network side device, including:
  • the UE sends the encrypted and integrity-protected data packet to the base station by using a random access preamble message (ie, a Preamble message) or an RRC connection setup request message or other resources allocated by the base station to the UE.
  • a random access preamble message ie, a Preamble message
  • RRC connection setup request message or other resources allocated by the base station to the UE.
  • the UE is in a resource in a preamble sequence in a Preamble message or in a resource in an RRC connection setup request message or in resources allocated by the other base station to the UE.
  • Carrying the data packet, and sending the data packet to the base station Receiving, by the base station, a data packet sent by the user equipment UE through a preamble sequence in a Preamble message or a resource in an RRC connection setup request message or other resources allocated by the base station to the UE when the RRC connection is not established;
  • the network side device is a serving gateway, and the UE carries the data packet in a preamble sequence in a Preamble message or in a resource in an RRC connection setup request message or in a resource allocated by the other base station to the UE.
  • the data packet is sent to the base station, and the base station receives the data packet and transparently transmits the data packet to the serving gateway. Since the two messages of the Preamble message and the RRC connection setup request message are sent to the base station before the UE establishes the RRC connection, the UE has not established the control plane connection and the user plane bearer with the network side device, so the establishment can be reduced. These bear the required signaling resources.
  • the network side device determines, according to the identifier of the UE, a decryption key and an integrity verification key corresponding to the UE.
  • the network side device determines a decryption key and an integrity verification key corresponding to the UE according to the identifier of the UE carried in the data packet.
  • the decryption key generated by the network side device is the same as the encryption key generated by the UE, and the integrity verification key generated by the network side device and the complete The sex protection key is the same.
  • the network side device determines, according to the identifier of the UE, that the decryption key and the integrity verification key corresponding to the UE are:
  • the network side device searches, according to the identifier of the UE, whether the key information corresponding to the identifier of the UE is stored in the local end, and if yes, indicating that the network side device has previously received the data packet sent by the UE. And the key information corresponding to the UE is also obtained in the process. Therefore, the network side device can obtain the key information of the UE directly at the local end after receiving the data packet.
  • the network side device receives the data packet sent by the UE for the first time, the data packet carries the first random number generated by the UE, and the network side device needs to receive the received data.
  • the identifier of the UE and the first random number are further sent to the HSS, and the HSS generates an intermediate key of the UE according to the identifier of the UE and the first random number, and the HSS further furtherifies the intermediate key Sent to the network side device Further generated by the network-side apparatus of the key information of the UE, and stores the correspondence between the identifier and the key information of the UE.
  • the network side device may store the key information of the UE, so the UE subsequently sends the UE to the network side device. Hair When the data packet is sent, the network side device can directly search for the key information of the UE at the local end.
  • the network side device is configured according to the identifier of the UE. Determining the decryption key and the integrity verification key corresponding to the UE, where the HSS generates a second random number in advance, and generates an intermediate key of the UE according to the identifier of the UE and the second random number. And then the HSS sends the intermediate key to the network side device, where the network side device further generates key information of the UE, and stores a correspondence between the identifier of the UE and the key information.
  • the relationship between the UE and the network side device may, after receiving the data packet sent by the UE, directly find the key information of the UE according to the identifier of the UE.
  • the network side device decrypts and completes the data packet by using the decryption key and the integrity verification key.
  • the network side device uses the key information of the UE to perform decryption and integrity verification on the received data packet.
  • the network side device decrypts the encrypted user data by using the obtained decryption key, and uses the obtained integrity verification key and parameter information carried in the data packet.
  • the integrity protection information ie, the MAC-I
  • the integrity protection information carried in the data packet performs integrity verification to implement security authentication for the UE.
  • the network side device takes the encrypted user data and the decryption key in the data packet as input parameters, and then processes the decryption algorithm (a hash function for the inverse algorithm of the encryption algorithm used by the UE).
  • the encrypted user data can be decrypted to obtain the user data of the plaintext, and the network side device takes the identifier of the UE and the integrity verification key as input parameters, and then passes the integrity verification algorithm (a hash function) And processing, the same as the integrity protection algorithm used by the UE, to obtain a complete message authentication code MAC-I', by determining whether the MAC-I' is consistent with the MAC-I carried in the data packet.
  • the integrity verification of the data packet is completed. If the data is consistent, the network side device successfully verifies the integrity of the data packet. If the network side device successfully verifies the integrity of the MAC-I, it indicates that the data and/or parameters in the data packet are complete, that is, the data packet is not tampered by a third party during transmission. Or inserting, and may also indicate that the network side device can successfully obtain the key information of the UE according to the identifier of the UE, and therefore the UE is authenticated as a legitimate user.
  • the integrity verification algorithm a hash function
  • the data packet sent by the UE includes: A, B', and a, and the network side device decrypts the encrypted user data B' according to the obtained decryption key to obtain user data B.
  • the network side device verifies the integrity of a according to the obtained integrity verification key and the identifier A of the UE.
  • the network side device is The process of decrypting the encrypted user data and performing the integrity verification on the parameter information by the network side device may be performed at the same time, or may be performed in a time-sharing manner, and the time interval is not performed in the embodiment of the present invention. limited.
  • the decryption key decrypts the encrypted user data and the encryption parameter, and performs integrity verification on the MAC-I according to the integrity verification key, the decrypted user data, and the decrypted parameter.
  • the decryption objects of the network side device are in one-to-one correspondence, and the integrity protection object of the UE is in one-to-one correspondence with the integrity verification object of the network side device.
  • the parameter information in the data packet further includes security algorithm indication information selected by the UE, where the security algorithm indicates that the information is used. Determining, by the network side device, a decryption algorithm and an integrity verification algorithm used for decrypting and integrity verification of the data packet, where the security algorithm indication information includes an encryption algorithm identifier and integrity corresponding to an encryption algorithm used by the UE
  • the security protection algorithm is associated with the integrity protection algorithm identifier.
  • the security algorithm supported by the network side device covers the security algorithm supported by each UE. Therefore, the network side device may determine the UE usage according to the encryption algorithm identifier.
  • the authentication algorithm is the same as the integrity protection algorithm used by the UE.
  • the decryption algorithm is used by the network side device to decrypt a data packet, where the integrity verification algorithm is used by the network side device to perform integrity verification on the data packet, and after receiving the data packet, the network side device receives the data packet. Decrypting the data packet according to the obtained decryption key of the UE, the decryption algorithm, and the data according to the obtained integrity verification key of the UE and the integrity verification algorithm.
  • Package integrity verification is used by the network side device to decrypt a data packet, where the integrity verification algorithm is used by the network side device to perform integrity verification on the data packet, and after receiving the data packet, the network side device receives the data packet. Decrypting the data packet according to the obtained decryption key of the UE, the decryption algorithm, and the data according to the obtained integrity verification key of the UE and the integrity verification algorithm.
  • the base station decrypts the data packet and performs an integrity verification process in a PDCP layer in a second layer of the wireless interface; if the network side device is a service
  • the gateway the UE and the serving gateway need to have a peer protocol sublayer, and the service gateway decrypts the data packet and the integrity verification process is implemented in the peer protocol sublayer.
  • the peer protocol sublayer may be a new protocol sublayer or an extension of an existing protocol sublayer function.
  • FIG. 4B is a schematic flowchart of another data transmission method according to an embodiment of the present invention.
  • the network side device in the embodiment of the present invention uses a base station as an example for description.
  • FIG. 4B For the steps S401-S407, please refer to the related description in the embodiment shown in FIG. 4A, and details are not described herein again. 4B is compared with FIG. 4A, the network side device described in step S409 sends the user data to the destination server, specifically:
  • the base station After the integrity verification of the data packet is successful, the base station sends the decrypted user data and the identifier of the destination server to the service gateway, and the service gateway is configured according to the identifier of the destination server.
  • the destination server establishes a Transmission Control Protocol (TCP) connection, and sends the user data to the destination server by using the TCP connection.
  • TCP Transmission Control Protocol
  • the base station sends the decrypted user data and an identifier (for example, a URL) of the destination server to the serving gateway, where the serving gateway receives the user data and The URL, the service gateway triggers a DNS (Domain Name System) resolution process, and the DNS server (the domain name server stores the domain name of all hosts in the network and the corresponding Internet Protocol (IP) address, and The server having the function of converting the domain name into an IP address obtains an IP address corresponding to the URL of the destination server, and establishes a TCP connection with the destination server according to the IP address of the destination server.
  • DNS Domain Name System
  • FIG. 4C is a schematic flowchart of another data transmission method according to an embodiment of the present invention.
  • the network side device in the embodiment of the present invention uses a service gateway as an example for description.
  • Steps S401-S407 in FIG. 4C please refer to the related description in the embodiment shown in FIG. 4A. I will not repeat them here.
  • 4C is compared with FIG. 4A, the network side device described in step S409 sends the user data to the destination server, specifically:
  • the serving gateway After successfully verifying the integrity of the data packet, the serving gateway establishes a TCP connection with the destination server according to the identifier of the destination server, and sends the decrypted user data to the destination through the TCP connection. server.
  • the DNS domain name resolution process is triggered, and the IP address corresponding to the URL of the destination server is obtained from the DNS server, and according to the IP address of the destination server. Establishing a TCP connection with the destination server.
  • the DNS domain name resolution process is not triggered by the UE, that is, the UE does not need to occupy a large number of air interface resources to establish a TCP connection process with the destination server, but the service gateway replaces the UE to trigger a DNS process, and the service gateway Establishing a TCP connection with the destination server, and then transmitting the decrypted user data to the destination server through a TCP connection, thereby reducing signaling resources for establishing a TCP connection.
  • the UE By performing the above steps S401-S409, the UE performs encryption and integrity protection on the data packet to be transmitted according to the key information thereof, and then sends the data packet to the network side device, and the network side device can obtain the data according to the acquisition.
  • the key information to the UE is further decrypted and integrity verified, thereby ensuring the security of the data transmission, reducing the signaling overhead of establishing the control plane connection and the user plane bearer, and improving the system efficiency.
  • FIG. 4D is a schematic flowchart of another data transmission method according to an embodiment of the present invention.
  • the first random number generated by the UE itself to generate a derived key is implemented by performing step S4001, and then the encryption key and the integrity protection key of the UE are generated according to the first random number.
  • the embodiment of the present invention is described by taking the step S4001 before the step S401 in FIG. 4A as an example.
  • steps S401-S409 in FIG. 4D please refer to the related description in the embodiment shown in FIG. 4A, and details are not described herein again.
  • a detailed description of step S4001 in FIG. 4D is as follows.
  • the UE generates the first random number, and generates the encryption key and the integrity protection key according to the first random number.
  • the UE itself generates a first random number, and according to the first random number and the The root key of the UE generates the key information of the UE step by step.
  • the data packet to be transmitted may be encrypted and integrity-protected according to the key information.
  • the parameter information in the data packet further includes the first random number, where the first random number participates in an integrity protection process and does not participate in an encryption process.
  • the first random number when the UE sends the data packet to the network side device for the first time, the first random number needs to be carried, and the UE sends a data packet to the network side device, and then When the data packet is sent to the network side device, the first random number may or may not be carried, and the specific random key is generated, and the UE randomly generates a new first random number and uses the new one. The generated first random number is used to derive the key information, and then the key information is used to perform the security processing of the sent data. In this case, the UE needs to carry the newly generated first random number when transmitting the data packet. Specifically limited.
  • the network side device described in step S405 determines that the decryption key and the integrity verification key corresponding to the UE are specifically determined according to the identifier of the UE:
  • the network side device sends the identifier of the UE and the first random number to the home subscription subscriber server HSS, generates an intermediate key of the UE by using the HSS, and generates the intermediate density according to the HSS.
  • the key generates a decryption key and an integrity verification key corresponding to the UE, and stores a correspondence between the identifier of the UE and the decryption key and the integrity verification key.
  • the HSS stores a root key of the UE, and after receiving the identifier of the UE and the first random number sent by the network side device, the HSS searches for the identifier according to the identifier of the UE. Generating a root key of the UE, and generating an intermediate key corresponding to the UE according to the root key of the UE and the first random number, where the HSS sends an intermediate key of the UE to the network side And the network side device receives the intermediate key of the UE, and further generates a decryption key and an integrity verification key corresponding to the UE.
  • the key information of the UE may be updated once, and the key update may be triggered by the UE. It can be triggered by the network side device. After the key update is triggered by one party, the key update indication needs to be sent to the other party, so that both parties complete the update of the key.
  • the UE regenerates the first random number, and according to the new The generated first random number generates the key information of the UE step by step, and the UE sends the newly generated first random number to the network side device, and the network side device receives the newly generated After the first random number, the identifier of the UE and the newly generated first random number are sent to the HSS, and the HSS searches for the root key of the UE according to the identifier of the UE, and according to the UE The root key and the first random number newly generated by the UE regenerate the intermediate key of the UE, and send the intermediate key of the UE to the network side device, where the network side device according to the The intermediate key of the UE regenerates the key information of the UE to update the key information of the UE, and stores a correspondence between the identifier of the UE and the updated key information.
  • the HSS when the key update is required, regenerates the second random number. And generating an intermediate key of the UE according to the newly generated second random number, and sending the newly generated second random number and the newly generated intermediate key to the network side device, where the network side device And further generating key information of the UE according to the newly generated intermediate key, and storing a correspondence between the identifier of the UE and the updated key information, and sending the second random number to the UE, where The UE generates key information of the UE step by step according to the newly generated second random number.
  • the preset number may be 2, 5, 10, or the like.
  • the key update can prevent the third party from cracking the key negotiated between the UE and the network side device, further improving the security of data transmission and ensuring information security of both parties.
  • step S4001 when the UE has data to be transmitted, the UE does not rely on the HSS to generate and deliver the random number of the derived key, but instead generates a random number by the UE, and then derives the key information of the UE according to the generated random number. Therefore, the data packet to be transmitted is processed securely, thereby ensuring the security of the data transmission and improving the data transmission efficiency, and the network side device can implement the security authentication of the UE according to the data packet transmitted by the UE, without relying on the HSS generation and the next.
  • the authentication vector is sent, which simplifies the security authentication process of the network side device to the UE.
  • FIG. 4E is a schematic flowchart of another data transmission method according to an embodiment of the present invention.
  • the UE Before performing step S401 in the embodiment shown in FIG. 4A or FIG. 4B or FIG. 4C, Obtaining, by performing steps S4003-S4009, the UE requests authentication from the network side device, so as to acquire a second random number of the derived key sent by the network side device, and further generates an encryption key and completeness of the UE according to the second random number. Sexual protection key.
  • the embodiment of the present invention takes the step S4001 in the figure.
  • the execution of the step S401 in FIG. 4A is described as an example.
  • the steps S401-S409 in FIG. 4E please refer to the related description in the embodiment shown in FIG. 4A, and details are not described herein again.
  • a detailed description of steps S4003-S4009 in FIG. 4E is as follows.
  • the UE when the UE in the IDLE state has data to be sent, the UE sends an authentication request to the home subscriber server HSS through the network side device, and the network side device receives the An authentication request sent by the UE when the RRC connection is not established with the base station, where the authentication request includes an identifier of the UE, and the authentication request may further include the capability of the UE.
  • the UE may be in a preamble sequence in a Preamble message or a resource in an RRC connection setup request message or other resources allocated by the base station to the UE. Carrying the authentication request, and then sending to the base station; if the network side device is a serving gateway, the UE may pass the resource in the preamble sequence in the Preamble message or the RRC connection establishment request message or other The base station carries the authentication request in the resource allocated by the UE, and then sends the authentication request to the base station, where the base station sends the authentication request to the serving gateway.
  • the network side device sends the authentication request to the home subscription subscriber server HSS, where the authentication request is used to trigger the HSS to generate a second random number and generate according to the identifier of the UE and the second random number.
  • An intermediate key of the UE the network side device generates a decryption key and an integrity verification key according to the intermediate key generated by the HSS, and stores the identifier of the UE and the decryption key and the The correspondence between the integrity verification keys.
  • the network side device sends the authentication request to the HSS, the HSS receives the authentication request, generates a second random number according to the authentication request, and searches for the UE according to the identifier of the UE. a root key, and generating an intermediate key of the UE according to the root key of the UE and the second random number, where the HSS sends the second random number and an intermediate key of the UE to the The network side device receives the second random number and an intermediate key of the UE, and further generates the decryption key and an integrity verification key.
  • the inter-key indicates that the HSS stores the root key corresponding to the identifier of the UE, and thus indicates that the UE is a valid user, so as to implement security authentication of the UE by the network-side device.
  • the UE sends an authentication request to the network side device only when the data is sent for the first time. Once the network side device generates and stores the key information of the UE according to the authentication request, the subsequent UE is The security processed data can be directly sent to the network side device.
  • the network side device sends a response message to the UE.
  • the network side device after generating the key information of the UE according to the identifier of the UE, the network side device sends a response message to the UE, where the response message includes the second random number, and the response message is The network side device obtains the integrity protection according to the integrity verification key. The UE receives a response message sent by the HSS by using the network side device.
  • the network side device is a serving gateway
  • the response message may include an identifier of the serving gateway, where the UE saves the identifier of the serving gateway after receiving the identifier of the serving gateway, and next time
  • the parameter information in the data packet further includes an identifier of the serving gateway, where the UE sends the data packet to a base station, and the base station receives the data packet.
  • the serving gateway Sending, according to the identifier of the serving gateway carried in the data packet, the data packet to a serving gateway corresponding to the identifier of the serving gateway (that is, when the UE sends a data packet last time, the base station is a serving gateway allocated by the UE, after receiving the data packet sent by the UE, the serving gateway generates and stores key information of the UE, so that the base station does not change to the UE
  • the serving gateway that provides the service that is, the base station does not select a new serving gateway for the UE, continues to use the old serving gateway, thus reducing the resources occupied by the serving gateway at the time of handover, and reducing the delay.
  • the response message may include the security algorithm indication information selected by the network side device.
  • the network side device crosses the encryption priority list of the encryption algorithm and the capability of the UE, and selects The highest-priority encryption algorithm, and the integrity list of its integrity protection algorithm and the capability of the UE are intersected, and the highest-priority plus integrity protection algorithm is selected.
  • the security algorithm indication information includes an encryption algorithm identifier (eg, EEA0, EEA1, EEA2, or EEA3, etc.) and an integrity protection algorithm identifier (eg, EIA0, EIA1, EIA2, or EIA3, etc.).
  • the network side device After the network side device determines the decryption key and the integrity verification key according to the authentication request, determining, according to the capability of the UE and a security algorithm supported by the network side device, that the UE and the network side device share Security calculation And sending, by the response message, the selected security algorithm indication information to the UE, where the UE uses the encryption key of the UE and an encryption algorithm corresponding to the security algorithm sent by the network side device to The data packet is encrypted, and the UE performs integrity protection on the data packet by using an integrity protection key of the UE and an integrity protection algorithm corresponding to the security algorithm sent by the network side device.
  • the network side device After receiving the data packet, the network side device decrypts the data packet according to the decryption key and a decryption algorithm corresponding to the security algorithm, and according to the integrity verification key of the UE, the The integrity verification algorithm corresponding to the security algorithm performs integrity verification on the data packet.
  • the UE generates the encryption key and the integrity protection key according to the second random number, and performs integrity verification on the response message by using the integrity protection key.
  • the UE generates the encryption key and the integrity protection key according to the second random number carried in the response message, and pairs the response message according to the integrity protection key.
  • the integrity is verified to implement the security authentication of the network side device by the UE. If the UE successfully verifies the integrity of the response message, it indicates that the response message is complete, that is, the response message.
  • the network side device is authenticated as legal without the tampering or insertion by the third party and indicating that the network side device correctly receives the authentication request. So far, mutual authentication is completed between the UE and the network side device. After the UE successfully verifies the integrity of the response message sent by the network side device, the UE may send the data packet to the network side device.
  • the UE requests authentication from the network side device when the RRC connection is not established, and acquires a random number of the derived key that is generated and delivered by the HSS, and derives the key information of the UE according to the random number, and the UE passes the pair.
  • the integrity verification of the response message sent by the network side device can implement the security authentication of the network side device, and no longer depends on the HSS generation and the issued authentication vector, which reduces the signaling overhead of establishing the control plane connection and the user plane bearer. System efficiency.
  • FIG. 4F is a schematic flowchart of another data transmission method according to an embodiment of the present invention.
  • the UE After the data transmission method described in S409, the UE performs security authentication on the network side device by performing steps S411 and S413.
  • the embodiment of the present invention is described by taking the steps S411 and S413 after the step S409 in FIG. 4A as an example.
  • steps S411 and S413 in FIG. 4F please refer to the related description in the embodiment shown in FIG. 4A, and details are not described herein again. Wherein, steps S411 and S413 The detailed description is as follows.
  • the UE receives an acknowledgement message sent by the network side device after performing integrity verification on the data packet.
  • the acknowledgment message includes, but is not limited to, an acknowledgment (ACK) message, and the acknowledgment message is obtained after the network side device performs integrity protection according to the integrity protection key.
  • ACK acknowledgment
  • the network side device is a serving gateway
  • the acknowledgment message sent by the serving gateway to the UE includes an identifier of the serving gateway
  • the UE saves the identifier after receiving the identifier of the serving gateway.
  • the identifier of the serving gateway when the data packet is sent to the serving gateway next time, the identifier of the serving gateway is also required to be carried, the UE sends the data packet to the base station, and the base station receives the data packet, according to the The identifier of the serving gateway carried in the data packet, the data packet is sent to a serving gateway corresponding to the identifier of the serving gateway, so that the base station does not change the serving gateway serving the UE, That is, the base station does not select a new serving gateway for the UE, and continues to use the old serving gateway, thereby reducing resources occupied by the serving gateway at the time of handover, and reducing delay.
  • the two processes of sending the user data to the destination server and sending the acknowledgement message to the UE may be performed simultaneously.
  • the embodiment of the present invention does not limit the sequence in the time when the time division is performed.
  • the UE performs integrity verification on the acknowledgement message by using the integrity protection key.
  • the network side device After the network side device successfully verifies the integrity of the data packet according to the integrity verification key, the network side device sends an acknowledgement message to the UE, where the UE receives the data from the network side device.
  • An acknowledgment message sent after the integrity verification of the packet is successfully performed, and the integrity verification key is used to perform integrity verification on the acknowledgment message to implement security authentication of the network side device by the UE, if the UE is If the integrity verification of the acknowledgment message is successful, it indicates that the acknowledgment message is complete, that is, the acknowledgment message is not tampering or inserted by a third party, and indicates that the network side device correctly receives the data packet, and therefore The network side device is legal.
  • the UE can implement the security authentication of the network side device according to the acknowledgement message sent by the network side device, and no longer relies on the HSS to generate and send the authentication vector, simplifying The security authentication process of the UE to the network side device.
  • FIG. 4G is a schematic flowchart of another data transmission method according to an embodiment of the present invention. After performing step S413 in FIG. 4F, the method may further implement steps S415 and S417. The identity of the UE is updated.
  • steps S401-S409 in FIG. 4G please refer to the related description in the embodiment shown in FIG. 4A.
  • Steps S411 and S413 in FIG. 4G refer to the related description in the embodiment shown in FIG. 4F, and details are not described herein again.
  • the detailed description of steps S415 and S417 is as follows.
  • the UE After the UE performs the integrity verification on the acknowledgment message, the UE updates the identifier of the UE according to the third random number generated by the UE.
  • the identifier of the UE is an IMSI of the UE, and the IMSI is a unique identifier of the UE, and is called a permanent identifier, if the UE The permanent identification is used each time data is sent to the network side device, which may expose the UE's whereabouts.
  • a "bad" third party can track the same IMSI, that is, the same UE, by intercepting the data of the air interface, thereby tracking the UE's actions.
  • Temp ID plays a role in hiding the UE's whereabouts.
  • the Temp ID is only valid for the network side device that provides services for the UE.
  • the network side device maintains the mapping of the Temp ID to the permanent identifier.
  • the UE Receiving, by the UE, an acknowledgment message sent by the network side device after performing integrity verification on the data packet, and verifying the integrity of the acknowledgment message, the UE according to the identifier of the UE
  • the third random number is used to update the identifier of the UE. Therefore, when the UE sends the user data to the network side device, the identifier of the UE carried in the data packet is the identifier of the updated UE. And updating, by the UE, the identifier of the UE according to the identifier of the UE and the third random number, where the UE is updated according to the old identifier of the UE, the third random number, and a preset identifier.
  • the preset identifier update algorithm is pre-negotiated between the UE and the network side device. Therefore, it can be understood that the network side device may also be according to the UE.
  • the old identity, the third random number, and the preset identity update algorithm generate a new identity of the UE. Specifically, the third random number participates in an integrity protection process, and the third random number may also participate in an encryption process.
  • the network side device updates the identifier of the UE according to the third random number, and stores the updated identifier of the UE and the decryption. The correspondence between the key and the integrity verification key.
  • the network side device updates the identifier of the UE according to the identifier of the UE and the third random number, where the network side device saves the identifier of the updated UE and the decryption key of the UE.
  • the network side device further stores a mapping relationship between the IMSI of the UE and the updated identifier. So far, both the UE and the network side device complete the update of the UE identity.
  • the update of the identifier of the UE may be performed once after the UE sends the data packet once, or may be performed once after the UE sends the data packet of the preset number of times, which is not specifically implemented in the embodiment of the present invention.
  • the predetermined number of times may be 1 time, 2 times, 5 times, or the like.
  • the UE When the UE needs to update the identifier, the UE sends the identifier of the current UE and the third random number generated by the UE to the network side device, where the network side device receives the location sent by the UE The third random number is updated, after the integrity verification of the data packet is successful, the identifier of the UE is updated, and the network side device sends an acknowledgement message to the UE, where the UE After the integrity verification of the acknowledgment message is successful, the identifier of the UE is updated, and the sequence in which the network side device updates the identifier of the UE and sends the acknowledgment message to the UE is not limited.
  • the UE and the network side device synchronously update the identifier of the UE, which can enhance the privacy of the UE, avoid exposing the UE's whereabouts during data transmission, and further improve the security of data transmission.
  • FIG. 5 is a schematic structural diagram of a user equipment 50 according to an embodiment of the present invention.
  • the user equipment 50 includes a modem 501.
  • the modem 501 includes a processor 5011 (the processor may be a Digital Signal Processing (DSP) chip, the DSP chip includes encryption and integrity protection for the transmitted data packet, and the received message.
  • DSP Digital Signal Processing
  • a PDCP entity that performs integrity verification or another entity corresponding to the newly added protocol sublayer, a memory 5012, a receiver 5013, and a transmitter 5014, wherein the receiver 5013 is a receiving circuit and the transmitter 5014 is a transmitting circuit.
  • the receiver 5013 may specifically be an antenna and can receive through an antenna.
  • the transmitter 5014 may specifically be an antenna, and the radio frequency signal is transmitted through the antenna.
  • the processor 5011, the memory 5012, the receiver 5013, and the transmitter 5014 may be connected by a bus or other means, wherein the connection through the bus 5015 is taken as an example in FIG.
  • the structure of the user equipment 50 shown in FIG. 5 does not constitute a limitation on the user equipment, and may include more or less components than those illustrated, or combine some components, or different component arrangements.
  • the user equipment 50 may further include: at least one amplifier, a tuner, one or more oscillators, a SIM card, etc., and details are not described herein again.
  • the memory 5012 is configured to store data transmission program code
  • the processor 5011 is configured to invoke the data transmission program code stored by the memory 5012 to implement data security of the user equipment UE without establishing an RRC connection with the base station. transmission.
  • the processor 5011 performs encryption and integrity protection on the data packet by using an encryption key and an integrity protection key, where the encryption key and the integrity protection key are generated by the user equipment UE according to the UE. Generating the first random number or the second random number received from the network side device, the data packet includes the identifier of the UE and user data; wherein the encryption key and the integrity protection password may be stored in In the memory 5012, the processor 5011 encrypts and completes the data packet by using the encryption key and the integrity protection key by using an entity corresponding to the PDCP entity or another newly added protocol sublayer. Sexual protection.
  • the encrypted and integrity-protected data packet is sent to the network side device by the transmitter 5014 when the UE does not establish a radio resource control RRC connection with the base station.
  • the data packet further includes the first random number, where the first random number is used by the network side device to determine a decryption key and complete used for decrypting and integrity verification of the data packet.
  • Sexual verification key is used by the network side device to determine a decryption key and complete used for decrypting and integrity verification of the data packet.
  • the data packet further includes the first random number, where the first random number is used by the network side device to determine a decryption key and complete used for decrypting and integrity verification of the data packet.
  • sexual verification key is used by the network side device to determine a decryption key and complete used for decrypting and integrity verification of the data packet.
  • the data packet further includes security algorithm indication information selected by the UE, where the security algorithm indication information is used by the network side device to determine decryption used for decrypting and integrity verification of the data packet. Algorithm and integrity verification algorithm.
  • the processor 5011 before the processor 5011 encrypts and integrity protects the data packet by using the encryption key and the integrity protection key, the processor 5011 is further configured to perform the following operations:
  • the network side device When the UE does not establish the RRC connection with the base station by using the transmitter 5014, the network side device sends an authentication request to the home subscription subscriber server HSS, where the authentication request includes the identifier of the UE.
  • the authentication request is used to trigger the HSS to generate the second random number and determine, according to the identifier of the UE and the second random number, the network side device used to decrypt and verify the data packet. Decryption key and integrity verification key;
  • the response message is integrity verified using the integrity protection key.
  • the processor 5011 performs integrity verification on the response message by using the integrity protection key by the PDCP entity or another entity corresponding to the newly added protocol sublayer.
  • processor 5011 is further configured to:
  • the acknowledgment message is integrity verified using the integrity protection key.
  • the processor 5011 performs integrity verification on the acknowledgement message by using the integrity protection key by the PDCP entity or another entity corresponding to the newly added protocol sublayer.
  • the data packet further includes a third random number generated by the UE, where the third random number is used by the network side device to the UE after performing integrity verification on the data packet.
  • the identifier is updated; the processor 5011 is further configured to execute:
  • the identifier of the UE is updated according to the third random number.
  • the network side device includes a base station or a serving gateway.
  • the data packet further includes an identifier of the destination server, where the identifier of the destination server is used by the serving gateway to establish a transmission control protocol TCP connection with the destination server, and send the user data to the TCP connection by using the TCP connection.
  • the destination server is used by the serving gateway to establish a transmission control protocol TCP connection with the destination server, and send the user data to the TCP connection by using the TCP connection.
  • the data packet when the network side device includes the serving gateway, the data packet further includes an identifier of the serving gateway, where the identifier of the serving gateway is used by the base station to send the data packet to the serving gateway.
  • the data packet after the encryption and integrity protection is performed by the transmitter 5014 Send to network side devices, including:
  • the encrypted and integrity-protected data packet is transmitted to the base station by the transmitter 5014 through a random access preamble message or an RRC connection setup request message.
  • the processor 5011 adds the encrypted and integrity-protected data packet to a random access preamble message or an RRC connection setup request message, and passes the random access preamble message to the physical device through the transmitter 5014.
  • the random access channel is sent to the base station, or the RRC connection setup request message is sent to the base station by the base station for the uplink resource allocated by the base station by the transmitter 5014.
  • FIG. 6 is a schematic structural diagram of a network side device 60 according to an embodiment of the present invention.
  • the network side device 60 includes a modem 601.
  • the modem 601 includes a processor 6011 (which may be a Digital Signal Processing (DSP) chip.
  • DSP Digital Signal Processing
  • the DSP chip includes decryption and integrity verification of the received data packet.
  • a PDCP entity that performs integrity protection on the sent message;
  • the DSP includes a new protocol for decrypting and integrity verification of the received data packet, and integrity protection of the sent message.
  • the sub-layer corresponds to the entity), the memory 6012, the receiver 6013, and the transmitter 6014, wherein the receiver 6013 is a receiving circuit and the transmitter 6014 is a transmitting circuit.
  • the receiver 6013 may be an antenna, and receives an RF signal through an antenna.
  • the transmitter 6014 may be an antenna, and the RF signal is sent through the antenna.
  • the processor 6011, the memory 6012, the receiver 6013, and the transmitter 6014 may be connected by a bus or other means, wherein the connection through the bus 6015 is taken as an example in FIG. It will be understood by those skilled in the art that the structure of the user equipment 60 shown in FIG. 6 does not constitute a limitation on the user equipment, and may include more or less components than those illustrated, or combine some components, or different component arrangements. .
  • the memory 6012 is configured to store a data transmission program code
  • the processor 6011 is configured to invoke the data transmission program code stored by the memory 6012 to enable the network side device to receive the user equipment UE, if the RRC connection with the base station is not established. User data transmitted.
  • the processor 6011 receives, by the receiver 6013, a data packet that is sent by the user equipment UE when the RRC connection with the radio resource control of the base station is not established, and the data packet includes the identifier of the UE. And user data, the data packet obtained by the UE after encryption and integrity protection;
  • the user data is sent to the destination server.
  • the data packet further includes a first random number generated by the UE
  • Determining, according to the identifier of the UE, the decryption key and the integrity verification key corresponding to the UE including:
  • the data packet further includes security algorithm indication information selected by the UE, where the security algorithm indication information is used by the network side device to determine decryption used for decrypting and integrity verification of the data packet. Algorithm and integrity verification algorithm.
  • the processor is further configured to:
  • the authentication request is used to trigger the HSS to generate a second random number, and generate an intermediate key of the UE according to the identifier of the UE and the second random number.
  • the network side device generates a decryption key and an integrity verification key according to the intermediate key generated by the HSS, and stores the identifier of the UE and the decryption key and the integrity verification key.
  • the transmitter 6014 Sending, by the transmitter 6014, a response message to the UE, the response message includes the second random number, and the second random number is used by the UE to generate and encrypt the data packet.
  • the encryption key and integrity protection key used for sexual protection.
  • processor 6011 is further configured to:
  • an acknowledgement message is sent to the UE by the transmitter 6014, and the acknowledgement message is used by the UE to use the integrity protection key pair of the UE to confirm the The message is integrity verified.
  • the data packet further includes a third random number generated by the UE, where the third random number is used by the UE to update the identifier of the UE after performing integrity verification on the acknowledgement message.
  • the processor is also used to execute:
  • the network side device includes a base station or a serving gateway.
  • the data packet further includes an identifier of the destination server
  • the sending the user data to the destination server includes:
  • the data packet when the network side device includes the serving gateway, the data packet further includes an identifier of the serving gateway, where the identifier of the serving gateway is used by the base station to send the data packet to the serving gateway.
  • the receiving, by the receiver 6013, the data packet that is sent by the user equipment UE when the RRC connection with the radio resource control of the base station is not established includes:
  • the receiver 6013 And receiving, by the receiver 6013, a data packet that is sent by the user equipment UE by using a random access preamble message or an RRC connection setup request message when the radio resource control RRC connection is not established with the base station.
  • FIG. 7A is a schematic structural diagram of a user equipment according to an embodiment of the present invention.
  • the user equipment 70 may include a security processing unit 701 and a sending unit 703, where A detailed description of each unit is as follows.
  • the security processing unit 701 is configured to perform encryption and integrity protection on the data packet by using an encryption key and an integrity protection key of the user equipment UE, where the encryption key and the integrity protection key are the UE And generating, according to the first random number generated by the UE or the second random number received by the network side device, the data packet includes the identifier of the UE and user data;
  • the sending unit 703 is configured to send the encrypted and integrity-protected data packet to the network side device when the UE does not establish a radio resource control RRC connection with the base station.
  • FIG. 7B is a schematic structural diagram of another user equipment according to an embodiment of the present invention.
  • the user equipment 70 shown in FIG. 7B is optimized by the user equipment 70 shown in FIG. 7A.
  • the user equipment 70 shown in FIG. 7B may further include a first receiving unit 705 and a first verification unit 707, in addition to the security processing unit 701 and the sending unit 703.
  • the sending unit 703 is further configured to: before the security processing unit 701 encrypts and protects the data packet by using the encryption key and the integrity protection key of the user equipment UE, and before the UE is not established with the base station,
  • the network side device sends an authentication request to the home subscriber server HSS, where the authentication request includes an identifier of the UE, and the authentication request is used to trigger the HSS to generate the second random number. And determining, according to the identifier of the UE and the second random number, a decryption key and an integrity verification key used by the network side device to perform decryption and integrity verification on the data packet;
  • the first receiving unit 705 is configured to receive a response message sent by the HSS by using the network side device, where the response message includes the second random number;
  • the first verification unit 707 is configured to perform integrity verification on the response message by using the integrity protection key.
  • FIG. 7C is a schematic structural diagram of another user equipment according to an embodiment of the present invention.
  • the user equipment 70 shown in FIG. 7C is optimized by the user equipment 70 shown in FIG. 7A.
  • the user equipment 70 shown in FIG. 7C may further include a second receiving unit 709 and a second verifying unit 711, in addition to the foregoing security processing unit 701 and the sending unit 703, where
  • the second receiving unit 709 is configured to receive a confirmation message that is sent by the network side device after performing integrity verification on the data packet.
  • a second verification unit 711 configured to complete the confirmation message by using the integrity protection key Authenticity verification.
  • the foregoing user equipment 70 may further include a security processing unit 701, a sending unit 703, a first receiving unit 705, a first verifying unit 707, a second receiving unit 709, and a second verifying unit 711.
  • a security processing unit 701 a sending unit 703, a first receiving unit 705, a first verifying unit 707, a second receiving unit 709, and a second verifying unit 711.
  • FIG. 7D is a schematic structural diagram of another user equipment according to an embodiment of the present invention.
  • the user equipment 70 shown in FIG. 7D is optimized by the user equipment 70 shown in FIG. 7C.
  • the user equipment 70 shown in FIG. 7D may further include an update unit 713 in addition to the security processing unit 701, the sending unit 703, the second receiving unit 709, and the second verification unit 711.
  • the updating unit 713 is configured to update the identifier of the UE according to the third random number after successfully performing integrity verification on the acknowledgement message.
  • the foregoing user equipment 70 may further include a security processing unit 701, a sending unit 703, a first receiving unit 705, a first verifying unit 707, a second receiving unit 709, a second verifying unit 711, and an updating unit 713.
  • a security processing unit 701 a sending unit 703, a first receiving unit 705, a first verifying unit 707, a second receiving unit 709, a second verifying unit 711, and an updating unit 713.
  • FIG. 8A is a schematic structural diagram of a network side device according to an embodiment of the present invention.
  • the network side device 80 may include a receiving unit 801, a key determining unit 803, a security processing unit 805, and a first transmitting unit 807, wherein the detailed description of each unit is as follows.
  • the receiving unit 801 is configured to receive a data packet that is sent by the user equipment UE when the RRC connection with the radio resource control of the base station is not established, where the data packet includes the identifier of the UE and user data, where the data packet is performed by the UE. a packet obtained after encryption and integrity protection;
  • the key determining unit 803 is configured to determine, according to the identifier of the UE, a decryption key and an integrity verification key corresponding to the UE;
  • a security processing unit 805, configured to perform decryption and integrity verification on the data packet by using the decryption key and the integrity verification key;
  • the first sending unit 807 is configured to send the user data to the destination server after the security processing unit successfully performs integrity verification on the data packet.
  • FIG. 8B is a schematic structural diagram of another network side device according to an embodiment of the present invention.
  • the network side device 80 shown in FIG. 8B is optimized by the network side device 80 shown in FIG. 8A.
  • the key determining unit 803 shown in FIG. 8B includes: a second transmitting unit 8031 and a first key generating unit 8033, wherein
  • a second sending unit 8031 configured to send the identifier of the UE and the first random number to a home subscriber server HSS, and generate an intermediate key of the UE by using the HSS;
  • a first key generating unit 8033 configured to generate, according to the intermediate key generated by the HSS, a decryption key and an integrity verification key corresponding to the UE, and store the identifier of the UE and the decryption key Correspondence relationship with the integrity verification key.
  • FIG. 8C is a schematic structural diagram of another network side device according to an embodiment of the present invention.
  • the network side device 80 shown in FIG. 8C is optimized by the network side device 80 shown in FIG. 8A.
  • the network side device 80 shown in FIG. 8C includes a receiving unit 801, a key determining unit 803, a security processing unit 805, and a first sending unit 807, and may further include a third sending unit 809. a second key generation unit 811 and a fourth transmission unit 813, wherein
  • the receiving unit 801 is further configured to: before receiving the data packet sent by the user equipment UE, receive an authentication request sent by the UE when the RRC connection is not established with the base station, where the authentication request includes an identifier of the UE;
  • the third sending unit 809 is configured to send the authentication request to the home subscription subscriber server HSS, where the authentication request is used to trigger the HSS to generate a second random number according to the identifier of the UE and the second random number. Generating an intermediate key of the UE;
  • a second key generating unit 811 configured to generate a decryption key and an integrity verification key according to the intermediate key generated by the HSS, and store the identifier of the UE and the decryption key and the integrity Verify the correspondence of the keys;
  • a fourth sending unit 813 configured to send a response message to the UE, where the response message includes the second random number, where the second random number is used by the UE to generate encryption and integrity of the data packet. Protect the encryption key and integrity protection key used.
  • FIG. 8D is a structural diagram of another network side device according to an embodiment of the present invention. intention.
  • the network side device 80 shown in FIG. 8D is optimized by the network side device 80 shown in FIG. 8A.
  • the network side device 80 shown in FIG. 8D includes a receiving unit 801, a key determining unit 803, a security processing unit 805, and a first sending unit 807, and may further include a fifth sending unit 815. among them,
  • the fifth sending unit 815 is configured to send an acknowledgment message to the UE after the security processing unit 805 successfully performs integrity verification on the data packet, where the acknowledgment message is used by the UE to use the completeness of the UE.
  • the sexual protection key performs integrity verification on the acknowledgment message.
  • the network side device 80 may further include a receiving unit 801, a second sending unit 8031, a first key generating unit 8033, a security processing unit 805, a first sending unit 807, and a fifth sending unit 815.
  • a receiving unit 801 a second sending unit 8031, a first key generating unit 8033, a security processing unit 805, a first sending unit 807, and a fifth sending unit 815.
  • the network side device 80 may further include a receiving unit 801, a key determining unit 803, a security processing unit 805, a first sending unit 807, a third sending unit 809, a second key generating unit 811, and a fourth.
  • the sending unit 813 and the fifth sending unit 815, the specific implementation of each unit may refer to the description of the same unit in the above solution, and details are not described herein again.
  • FIG. 8E is a schematic structural diagram of another network side device according to an embodiment of the present invention.
  • the network side device 80 shown in FIG. 8E is optimized by the network side device 80 shown in FIG. 8D.
  • the network side device 80 shown in FIG. 8E includes, in addition to the foregoing receiving unit 801, the key determining unit 803, the security processing unit 805, the first sending unit 807, and the fifth sending unit 815, Update unit 817, wherein
  • the updating unit 817 is configured to: after the security processing unit 805 successfully performs integrity verification on the data packet, update the identifier of the UE according to the third random number, and store the updated UE Corresponding to the decryption key and the integrity verification key.
  • the network side device 80 may further include a receiving unit 801, a second sending unit 8031, a first key generating unit 8033, a security processing unit 805, a first sending unit 807, a fifth sending unit 815, and an updating unit. 817, the specific implementation of each unit can refer to the description of the same unit in the above solution, and details are not described herein again.
  • the network side device 80 may further include a receiving unit 801, a key determining unit 803, a security processing unit 805, a first sending unit 807, a third sending unit 809, and a second key.
  • the generating unit 811, the fourth sending unit 813, the fifth sending unit 815, and the updating unit 817, the specific implementation of each unit may refer to the description of the same unit in the above solution, and details are not described herein again.
  • the UE can transmit data to the network side without establishing an RRC connection with the base station, and can ensure the security of the data transmission, thereby reducing the establishment of the control plane connection and the user plane. Carry the required signaling resources to improve system efficiency. Further, the UE and the network side device implement the security authentication process for the peer end by using the transmitted data packet or the message, and no longer rely on the HSS generation and the issued authentication vector, which simplifies the security authentication process between the UE and the network side device. .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

La présente invention concerne un procédé de transmission de données, un équipement utilisateur et un dispositif côté réseau. Le procédé comprend les étapes suivantes : un équipement utilisateur (UE) emploie une clé de chiffrement et une clé de protection d'intégrité pour effectuer une protection de chiffrement et d'intégrité sur un paquet de données, la clé de chiffrement et la clé de protection d'intégrité sont générées par l'UE selon un premier nombre aléatoire généré par l'UE ou un second nombre aléatoire reçu du dispositif côté réseau, et le paquet de données comprend un identificateur de l'UE et des données utilisateur ; et si une connexion de commande de ressource radio (RRC) à une station de base n'est pas établie, l'UE transmet le paquet de données chiffré et protégé en intégrité au dispositif côté réseau. La mise en œuvre de la présente invention peut réaliser une transmission de données sécurisée si une connexion RRC n'est pas établie entre un UE et une station de base, réduisant ainsi la surcharge de signalisation.
PCT/CN2015/096035 2015-11-30 2015-11-30 Procédé de transmission de données, équipement utilisateur et dispositif côté réseau WO2017091959A1 (fr)

Priority Applications (2)

Application Number Priority Date Filing Date Title
PCT/CN2015/096035 WO2017091959A1 (fr) 2015-11-30 2015-11-30 Procédé de transmission de données, équipement utilisateur et dispositif côté réseau
CN201580084940.6A CN108293223B (zh) 2015-11-30 2015-11-30 一种数据传输方法、用户设备和网络侧设备

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2015/096035 WO2017091959A1 (fr) 2015-11-30 2015-11-30 Procédé de transmission de données, équipement utilisateur et dispositif côté réseau

Publications (1)

Publication Number Publication Date
WO2017091959A1 true WO2017091959A1 (fr) 2017-06-08

Family

ID=58796141

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2015/096035 WO2017091959A1 (fr) 2015-11-30 2015-11-30 Procédé de transmission de données, équipement utilisateur et dispositif côté réseau

Country Status (2)

Country Link
CN (1) CN108293223B (fr)
WO (1) WO2017091959A1 (fr)

Cited By (13)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110830396A (zh) * 2019-10-29 2020-02-21 西安交通大学 一种基于物理层密钥的imsi隐私保护方法和设备
CN111212424A (zh) * 2018-11-22 2020-05-29 展讯通信（上海）有限公司 一种从eps到5gs互操作时鉴权ue的方法及系统
CN111327583A (zh) * 2019-08-22 2020-06-23 刘高峰 一种身份认证方法、智能设备及认证服务器
US20200305001A1 (en) * 2018-08-23 2020-09-24 Huawei Technologies Co., Ltd. Routing method, apparatus, and system
CN112383917A (zh) * 2020-10-21 2021-02-19 华北电力大学 一种基于商密算法的北斗安全通信方法和系统
CN113329399A (zh) * 2020-02-28 2021-08-31 阿里巴巴集团控股有限公司 数据传输、配网与管理方法、设备、系统及存储介质
CN113839958A (zh) * 2021-09-29 2021-12-24 广州河东科技有限公司 智能家居的通信加密方法、装置、控制系统和存储介质
CN113836546A (zh) * 2021-08-30 2021-12-24 广东浪潮智慧计算技术有限公司 一种密钥管理方法、装置、设备及存储介质
CN114095150A (zh) * 2021-11-12 2022-02-25 微位（深圳）网络科技有限公司 身份鉴定方法、装置、设备及可读存储介质
CN114513860A (zh) * 2020-10-23 2022-05-17 中国移动通信有限公司研究院 一种终端附着方法、设备及存储介质
CN114521013A (zh) * 2020-11-20 2022-05-20 深圳市中兴微电子技术有限公司 终端定位方法、系统、存储介质和电子装置
CN115694599A (zh) * 2021-07-31 2023-02-03 华为技术有限公司 一种传输方法、系统及相关装置
WO2023102751A1 (fr) * 2021-12-07 2023-06-15 北京小米移动软件有限公司 Procédé et appareil de vérification d'informations système, et support de stockage

Families Citing this family (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111431839B (zh) * 2019-01-09 2024-03-19 中兴通讯股份有限公司 隐藏用户标识的处理方法及装置
CN111586076B (zh) * 2020-05-26 2021-12-07 清华大学 基于混合密码的遥控遥测信息防篡改加解密方法和系统
CN112788594B (zh) * 2020-06-03 2023-06-27 中兴通讯股份有限公司 数据传输方法、装置和系统、电子设备、存储介质
CN112487408B (zh) * 2020-12-24 2022-08-23 潍柴动力股份有限公司 用于车内ecu的安全访问方法、系统及存储介质
CN113282910B (zh) * 2021-04-22 2023-07-18 中国科学院软件研究所 一种可信计算信任根的根密钥保护方法
CN115277200B (zh) * 2022-07-27 2023-08-15 北京国领科技有限公司 一种链路层透明加密系统多节点密钥自动协商管理的方法
CN115720160B (zh) * 2022-11-09 2023-09-01 中创通信技术（深圳）有限公司 一种基于量子密钥的数据通信方法及系统

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2007103906A2 (fr) * 2006-03-06 2007-09-13 Imagineer Software, Inc. Transmission sécurisée de données utilisant des données non découvrables 'noires'
CN101291325A (zh) * 2007-04-17 2008-10-22 三星电子株式会社 对消息加密的方法以及对消息解密的方法
CN104969578A (zh) * 2013-04-17 2015-10-07 华为技术有限公司 数据传输方法、装置及系统

Family Cites Families (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1315344C (zh) * 2003-09-22 2007-05-09 华为技术有限公司 一种集群业务中传送数据的方法
CN101197673B (zh) * 2006-12-05 2011-08-10 中兴通讯股份有限公司 固定网络接入ims双向认证及密钥分发方法
CN101141250A (zh) * 2007-10-10 2008-03-12 北京握奇数据系统有限公司 仪表设备、数据安全存取方法、装置和系统
CN101426190A (zh) * 2007-11-01 2009-05-06 华为技术有限公司 一种服务访问认证方法和系统
WO2014169451A1 (fr) * 2013-04-17 2014-10-23 华为技术有限公司 Procédé et dispositif pour la transmission de données
WO2015024260A1 (fr) * 2013-08-23 2015-02-26 华为技术有限公司 Procédé de transmission de données, équipement utilisateur et équipement proxy

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2007103906A2 (fr) * 2006-03-06 2007-09-13 Imagineer Software, Inc. Transmission sécurisée de données utilisant des données non découvrables 'noires'
CN101291325A (zh) * 2007-04-17 2008-10-22 三星电子株式会社 对消息加密的方法以及对消息解密的方法
CN104969578A (zh) * 2013-04-17 2015-10-07 华为技术有限公司 数据传输方法、装置及系统

Cited By (19)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20200305001A1 (en) * 2018-08-23 2020-09-24 Huawei Technologies Co., Ltd. Routing method, apparatus, and system
US11974132B2 (en) * 2018-08-23 2024-04-30 Huawei Technologies Co., Ltd. Routing method, apparatus, and system
CN111212424A (zh) * 2018-11-22 2020-05-29 展讯通信（上海）有限公司 一种从eps到5gs互操作时鉴权ue的方法及系统
CN111327583A (zh) * 2019-08-22 2020-06-23 刘高峰 一种身份认证方法、智能设备及认证服务器
CN111327583B (zh) * 2019-08-22 2022-03-04 刘高峰 一种身份认证方法、智能设备及认证服务器
CN110830396A (zh) * 2019-10-29 2020-02-21 西安交通大学 一种基于物理层密钥的imsi隐私保护方法和设备
CN113329399A (zh) * 2020-02-28 2021-08-31 阿里巴巴集团控股有限公司 数据传输、配网与管理方法、设备、系统及存储介质
CN112383917A (zh) * 2020-10-21 2021-02-19 华北电力大学 一种基于商密算法的北斗安全通信方法和系统
CN114513860B (zh) * 2020-10-23 2023-05-05 中国移动通信有限公司研究院 一种终端附着方法、设备及存储介质
CN114513860A (zh) * 2020-10-23 2022-05-17 中国移动通信有限公司研究院 一种终端附着方法、设备及存储介质
CN114521013A (zh) * 2020-11-20 2022-05-20 深圳市中兴微电子技术有限公司 终端定位方法、系统、存储介质和电子装置
CN115694599A (zh) * 2021-07-31 2023-02-03 华为技术有限公司 一种传输方法、系统及相关装置
CN113836546A (zh) * 2021-08-30 2021-12-24 广东浪潮智慧计算技术有限公司 一种密钥管理方法、装置、设备及存储介质
CN113836546B (zh) * 2021-08-30 2024-02-13 广东浪潮智慧计算技术有限公司 一种密钥管理方法、装置、设备及存储介质
CN113839958B (zh) * 2021-09-29 2023-05-26 广州河东科技有限公司 智能家居的通信加密方法、装置、控制系统和存储介质
CN113839958A (zh) * 2021-09-29 2021-12-24 广州河东科技有限公司 智能家居的通信加密方法、装置、控制系统和存储介质
CN114095150A (zh) * 2021-11-12 2022-02-25 微位（深圳）网络科技有限公司 身份鉴定方法、装置、设备及可读存储介质
CN114095150B (zh) * 2021-11-12 2024-01-26 微位（深圳）网络科技有限公司 身份鉴定方法、装置、设备及可读存储介质
WO2023102751A1 (fr) * 2021-12-07 2023-06-15 北京小米移动软件有限公司 Procédé et appareil de vérification d'informations système, et support de stockage

Also Published As

Publication number Publication date
CN108293223B (zh) 2020-11-17
CN108293223A (zh) 2018-07-17

Similar Documents

Publication Publication Date Title
WO2017091959A1 (fr) Procédé de transmission de données, équipement utilisateur et dispositif côté réseau
US11039311B2 (en) Profile download method and apparatus for use in wireless communication system
US11863975B2 (en) Protection of initial non-access stratum protocol message in 5G systems
TWI733675B (zh) 具有加密的客戶端設備上下文的網路架構和安全
US11877149B2 (en) Protection of initial non-access stratum protocol message in 5G systems
CN104737572B (zh) 对扩展的发现范围的基于邻近的服务发现提供完整性保护的方法和装置
KR102224368B1 (ko) D2D(device to device) 통신에서의 과금 정보 기록을 위한 방법 및 시스템
TW201703556A (zh) 網路安全架構
KR20180098251A (ko) 셀룰러 사물 인터넷에 대한 무상태 액세스 계층 보안
US11109206B2 (en) Security method and system for supporting discovery and communication between proximity based service terminals in mobile communication system environment
CN109922474B (zh) 触发网络鉴权的方法及相关设备
WO2019096075A1 (fr) Procédé et appareil de protection de messages
EP3284276B1 (fr) Améliorations de la sécurité dans un réseau cellulaire
KR20230054421A (ko) 셀룰러 슬라이싱된 네트워크들에서의 중계기 선택의 프라이버시
WO2017197596A1 (fr) Procédé de communication, dispositif de réseau et équipement utilisateur
WO2023283789A1 (fr) Procédé et appareil de communication sécurisée, dispositif terminal et périphérique de réseau
EP3622736B1 (fr) Clé de confidentialité dans un système de communication sans fil
JP2022530955A (ja) マルチｓｉｍ装置及びサブスクリプション情報を検証する方法及びプロセス
CN112514436A (zh) 发起器和响应器之间的安全的、被认证的通信
KR101431214B1 (ko) 머신 타입 통신에서의 네트워크와의 상호 인증 방법 및 시스템, 키 분배 방법 및 시스템, 및 ｕｉｃｃ와 디바이스 쌍 인증 방법 및 시스템
JP2020505845A (ja) 緊急アクセス中のパラメータ交換のための方法およびデバイス
CN105393567B (zh) 数据的安全传输方法和设备
CN110169128B (zh) 一种通信方法、装置和系统
Saedy et al. Machine-to-machine communications and security solution in cellular systems
WO2020182557A1 (fr) Fourniture d'informations de capacité d'ue à un serveur d'authentification

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 15909476

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 15909476

Country of ref document: EP

Kind code of ref document: A1