WO2018053804A1 - 一种加密保护方法及相关设备 - Google Patents

一种加密保护方法及相关设备 Download PDF

Info

Publication number
WO2018053804A1
WO2018053804A1 PCT/CN2016/099869 CN2016099869W WO2018053804A1 WO 2018053804 A1 WO2018053804 A1 WO 2018053804A1 CN 2016099869 W CN2016099869 W CN 2016099869W WO 2018053804 A1 WO2018053804 A1 WO 2018053804A1
Authority
WO
WIPO (PCT)
Prior art keywords
identifier
hss
user terminal
network device
terminal
Prior art date
Application number
PCT/CN2016/099869
Other languages
English (en)
French (fr)
Inventor
曾信
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to PCT/CN2016/099869 priority Critical patent/WO2018053804A1/zh
Publication of WO2018053804A1 publication Critical patent/WO2018053804A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/02—Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/03—Protecting confidentiality, e.g. by encryption
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/60—Context-dependent security
    • H04W12/63—Location-dependent; Proximity-dependent
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/60—Context-dependent security
    • H04W12/69—Identity-dependent
    • H04W12/72—Subscriber identity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/60—Context-dependent security
    • H04W12/69—Identity-dependent
    • H04W12/73—Access point logical identity

Definitions

  • the embodiments of the present invention relate to the field of communications technologies, and in particular, to an encryption protection method and related devices.
  • the identity of the user terminal in the network can be uniquely determined by an identifier such as an International Mobile Subscriber Identification Number (IMSI) or an International Mobile Equipment Identity (IMEI).
  • IMSI International Mobile Subscriber Identification Number
  • IMEI International Mobile Equipment Identity
  • the plaintext is supported to obtain the identity of the user terminal. For example, in a case where a user terminal accesses a Long Term Evolution (LTE) network, in a scenario of initially attaching an LTE network or in a scenario where a network is in error, the user terminal is required to report the IMSI of the user to the network plaintext. Otherwise, the network device cannot determine the user corresponding to the user terminal.
  • LTE Long Term Evolution
  • the user identifier belongs to the privacy of the user, if it is acquired by a device such as a pseudo base station, the private information of the user may be leaked.
  • the pseudo base station may know the current location of the user by acquiring the IMSI.
  • TMSI Temporary Mobile Subscriber Identity
  • the network device cannot determine the identity of the user through the TMSI, such as:
  • the network device still requires the user terminal to provide the IMSI. At this time, the user terminal will feedback in the plaintext form of the IMSI, and still exists. The risk of the user identity being compromised reduces the security of the user identity transmission.
  • the embodiment of the invention provides an encryption protection method and related device, which can implement encryption protection on the terminal information, and enable the network device to know how to decrypt the terminal information ciphertext by transmitting the identifier of the HSS, thereby obtaining the terminal information, thereby improving the pair.
  • an embodiment of the present invention provides an encryption protection method, including:
  • the user terminal acquires a location identifier of the current cell
  • the user terminal encrypts the terminal information of the user terminal according to the location identifier and the security parameter according to a preset encryption algorithm to generate a terminal information ciphertext;
  • the user terminal sends an identifier indication message to the network device, where the identifier indication message includes the terminal information ciphertext and the identifier of the HSS, so that the network device acquires and decrypts the terminal information confidentiality according to the identifier of the HSS.
  • the working key of the text includes the terminal information ciphertext and the identifier of the HSS.
  • the terminal information may be any terminal information reported by the user terminal to the network device, for example, information that may leak the privacy of the terminal, including a terminal identifier or a terminal capability, where the terminal identifier may include a TMSI, The IMSI, the IMEI, and the like; the terminal capability may include, but is not limited to, at least one of a security capability of the terminal, a supported transmission mode, a supported terminal capability level, and whether to support intra-frequency inter-frequency handover.
  • the protection of the terminal information is implemented by means of encryption. Further, the identifier of the HSS enables the network device to know how to decrypt the terminal information ciphertext, thereby obtaining the terminal information, thereby improving the pair. The security of terminal information transmission.
  • the method before the acquiring, by the user terminal, the location identifier of the current cell, the method further includes:
  • the user terminal receives a terminal information acquisition request sent by the network device.
  • the user terminal can send the terminal information ciphertext after receiving the terminal information acquisition request, in addition to the case where the terminal information ciphertext can be transmitted autonomously.
  • the user terminal acquires a location identifier of a current cell, including:
  • the user terminal receives a system message sent by the network device, where the system message carries a location identifier of a cell where the user terminal is currently located.
  • the user terminal may receive a system message sent by the network device after accessing the currently located cell.
  • the first implementation manner of the first aspect, or the second implementation manner of the first aspect, in the third implementation manner of the first aspect, before the user terminal acquires the location identifier of the current cell also includes:
  • the user terminal If the user terminal is contracted with the HSS, the user terminal stores the security parameters pre-generated by the HSS and the identifier of the HSS.
  • the storage security parameter of the user terminal and the identifier of the HSS may be used to encrypt the terminal information.
  • an embodiment of the present invention provides an encryption protection method, including:
  • the network device receives the identifier indication message sent by the user terminal, where the identifier indication message includes the identifier of the terminal information and the identifier of the HSS;
  • the network device decrypts the terminal information ciphertext according to the security key generated by the HSS corresponding to the work key and the identifier of the HSS according to a preset decryption algorithm, to obtain terminal information;
  • the work key is generated by the HSS according to the security parameter and the location identifier;
  • the preset decryption algorithm is a decryption algorithm corresponding to a preset encryption algorithm.
  • the network device learns how to decrypt the terminal information ciphertext by using the identifier of the HSS and the location identifier of the cell currently located by the user terminal, thereby obtaining the terminal information, thereby improving the security of the terminal information transmission.
  • the network device before the network device receives the identifier indication message sent by the user terminal, the network device further includes:
  • the network device sends a terminal information acquisition request to the user terminal, so that the user terminal sends an identifier indication message including the terminal information ciphertext to the network device.
  • the network device obtains and decrypts the terminal information confidentiality according to the identifier of the HSS and the location identifier.
  • the working key of the text including:
  • the network device receives a work key sent by the HSS and a pre-generated security parameter.
  • an embodiment of the present invention provides an encryption protection method, including:
  • the HSS receives a work key application request sent by the network device, where the work key application request carries a location identifier;
  • the HSS generates a work key according to the location identifier, the pre-generated security parameter, and the pre-generated root key according to a key generation algorithm
  • the HSS sends the work key to the network device.
  • the network device may be according to the work.
  • the user terminal that subscribes to the HSS decrypts the terminal information ciphertext encrypted by the location identifier.
  • the HSS can generate a work key for decrypting the terminal information ciphertext according to the location identifier and the security parameter, and then obtain the terminal information by decrypting the network device after receiving the work key, thereby improving the terminal information.
  • Security for terminal information transmission can be generated.
  • the fourth aspect provides a user terminal according to an embodiment of the present invention, including:
  • An obtaining unit configured to acquire a location identifier of a current cell
  • the obtaining unit is further configured to obtain a security parameter generated by the subscribed home subscriber server HSS and an identifier of the HSS;
  • An encryption unit configured to encrypt terminal information of the user terminal according to the location identifier and the security parameter according to a preset encryption algorithm, to generate a terminal information ciphertext
  • a sending unit configured to send an identifier indication message to the network device, where the identifier indication message includes the terminal information ciphertext and the identifier of the HSS, so that the network device acquires and decrypts the terminal information according to the identifier of the HSS.
  • the ciphertext work key.
  • the user terminal provided by the fourth aspect of the present invention is used to perform the cryptographic protection method provided by the first aspect of the present invention.
  • the user terminal provided by the fourth aspect of the present invention is used to perform the cryptographic protection method provided by the first aspect of the present invention.
  • the structure of the user terminal includes a processor and a transceiver for performing the encryption protection method provided by the first aspect of the present invention.
  • a memory may be further included, where the memory is used to store application code that supports a user terminal to execute the above method, and the processor is configured to execute an application stored in the memory.
  • the fifth aspect provides a network device according to an embodiment of the present invention, including:
  • a receiving unit configured to receive an identifier indication message sent by the user terminal, where the identifier indication message includes a terminal information ciphertext and an identifier of the HSS;
  • An acquiring unit configured to acquire a location identifier of a cell where the user terminal is currently located
  • the obtaining unit is further configured to acquire, according to the identifier of the HSS and the location identifier, a work key for decrypting the ciphertext of the terminal information;
  • a decryption unit configured to decrypt the terminal information ciphertext according to the security key generated by the HSS corresponding to the work key and the identifier of the HSS according to a preset decryption algorithm, to obtain terminal information;
  • the work key is generated by the HSS according to the security parameter and the location identifier.
  • the preset decryption algorithm is a decryption algorithm corresponding to a preset encryption algorithm.
  • the network device provided by the fifth aspect of the present invention is used to perform the cryptographic protection method provided by the second aspect of the present invention.
  • the network device provided by the fifth aspect of the present invention is used to perform the cryptographic protection method provided by the second aspect of the present invention.
  • the structure of the network device includes a processor and a transceiver for performing the encryption protection method provided by the second aspect of the present invention.
  • a memory may be further included, where the memory is used to store application code that supports the network device to execute the above method, and the processor is configured to execute an application stored in the memory.
  • the sixth aspect provides a home subscriber server according to an embodiment of the present invention, including:
  • a receiving unit configured to receive a work key application request sent by the network device, where the work key application request carries a location identifier
  • a generating unit configured to generate a work key according to the location identifier, the pre-generated security parameter, and the pre-generated root key according to a key generation algorithm
  • a sending unit configured to send the working key to the network device.
  • the home subscriber server provided by the sixth aspect of the present invention is used to perform the encryption protection method provided by the third aspect of the present invention.
  • the home subscriber server provided by the sixth aspect of the present invention is used to perform the encryption protection method provided by the third aspect of the present invention.
  • the structure of the home subscriber server includes a processor and a transceiver for performing the encryption protection method provided by the third aspect of the present invention.
  • a memory may be further included, where the memory is used to store application code that supports a home subscriber server to perform the above method, and the processor is configured to execute an application stored in the memory.
  • an embodiment of the present invention provides a computer storage medium for storing computer software instructions used by the user terminal, including a program designed to perform the above aspects.
  • an embodiment of the present invention provides a computer storage medium for storing computer software instructions used by the network device, including a program designed to perform the above aspects.
  • an embodiment of the present invention provides a computer storage medium for storing computer software instructions for use by the home subscriber server, including a program designed to perform the above aspects.
  • the names of the user terminal, the network device, and the home user server are not limited to the device itself. In actual implementation, the devices may appear under other names. As long as the functions of the respective devices are similar to the present invention, they are within the scope of the claims and the equivalents thereof.
  • the terminal information of the current cell of the user terminal is obtained, and the security parameters generated by the contracted HSS and the identifier of the HSS are obtained, and the terminal information is encrypted according to the location identifier and the security parameter according to a preset encryption algorithm.
  • the terminal information ciphertext is generated, and the terminal information is protected by the encryption processing of the terminal information.
  • the encrypted ciphertext generated by the location identifier is used to implement different terminal identifier ciphertexts corresponding to different location identifiers.
  • the protection information of the terminal information is enhanced.
  • the identifier indication message sent by the user terminal to the network device includes the ciphertext of the terminal information and the identifier of the HSS. The identifier of the HSS enables the network device to know how to decrypt the ciphertext of the terminal information, thereby obtaining the terminal information. Therefore, the security of terminal information transmission is improved.
  • FIG. 1 is a schematic diagram of a possible network architecture according to an embodiment of the present invention
  • FIG. 2 is a schematic flowchart of a method for encrypting protection according to an embodiment of the present invention
  • FIG. 3 is a schematic flowchart of another encryption protection method according to an embodiment of the present invention.
  • FIG. 4 is a schematic diagram of a modularization of a user terminal according to an embodiment of the present disclosure
  • FIG. 5 is a schematic structural diagram of a user terminal according to an embodiment of the present disclosure.
  • FIG. 6 is a schematic diagram of a modularization of a network device according to an embodiment of the present invention.
  • FIG. 7 is a schematic structural diagram of a network device according to an embodiment of the present disclosure.
  • FIG. 8 is a schematic diagram of a modularization of a home subscriber server according to an embodiment of the present invention.
  • FIG. 9 is a schematic structural diagram of a home subscriber server according to an embodiment of the present invention.
  • the solution provided by the invention can implement the encryption protection of the terminal information, and the network device learns how to decrypt the terminal information ciphertext by transmitting the identifier of the HSS, thereby obtaining the terminal information, thereby improving the security of the terminal information transmission.
  • references to "an embodiment” herein mean that a particular feature, structure, or characteristic described in connection with the embodiments can be included in at least one embodiment of the invention.
  • the appearances of the phrases in various places in the specification are not necessarily referring to the same embodiments, and are not exclusive or alternative embodiments that are mutually exclusive. Those skilled in the art will understand and implicitly understand that the embodiments described herein can be combined with other embodiments.
  • FIG. 1 it is an Evolved Packet System (EPS) network architecture diagram, including a user terminal.
  • E-UTRAN Evolved UMTS Terrestrial Radio Access Network
  • MME Mobility Management Entity
  • SGSN Mobility Management Entity
  • PDN Gateway PDN Gateway
  • S-GW Serving Gateway
  • HSS Home Subscriber Server
  • the EUTRAN is a network composed of multiple evolved NodeBs (eNodeBs), which implements wireless physical layer functions, resource scheduling and radio resource management, radio access control, and mobility management functions.
  • eNodeB is connected to the S-GW through the user plane interface S1-U for transmitting user data.
  • the S1-AP protocol is connected to the MME through the control plane interface, and the radio access bearer control function is implemented by using the S1-AP protocol.
  • the SGSN is connected to the base station controller (BSC) of the GSM/EDGE radio access network (GERAN) through the Gb interface, or the radio network controller of the UMTS radio access network (URAN) via the Iu-PS interface (Radio) Network Controller (RNC) connects to manage mobile data, such as user identification, encryption, and compression.
  • BSC base station controller
  • GERAN GSM/EDGE radio access network
  • URAN UMTS radio access network
  • RNC Radio Network Controller
  • the MME is mainly responsible for all control plane functions of the user, that is, session management, including NAS signaling and security, tracking area management, P-GW and S-GW selection.
  • the S-GW is mainly responsible for data transmission, forwarding, and route switching of the user terminal, and serves as a local mobility anchor point when the user terminal switches between eNodeBs (for each user terminal, only one S-GW is used at each moment) Service).
  • P-GW public data
  • the anchor point of the connection of the Public Data Network (PDN) is responsible for the IP address allocation of the user terminal, the data packet filtering of the user terminal, the rate control, and the generation of the charging information.
  • the HSS contains user profiles, performs user authentication and authorization, and provides information about the user's physical location.
  • the user terminal when the user terminal initially attaches to the LTE network or when the network is in error, the user terminal needs to report the IMSI of the user to the network plaintext, which may reveal the private information of the user.
  • terminal information including the IMSI can be protected. For example, if the terminal information is the terminal identifier of the user terminal, the user terminal acquires the location identifier of the current cell in the process of initially attaching the LTE network or when the network is faulty; the user terminal acquires the security parameters and the security parameters generated by the contracted HSS.
  • the user terminal encrypts the terminal identifier of the user terminal according to the location identifier and the security parameter, and generates a terminal identifier ciphertext according to the preset encryption algorithm; the user terminal sends the identifier to the network device. And an identifier indication message, where the identifier indication message includes the terminal identifier ciphertext and the identifier of the HSS, so that the network device acquires a work key for decrypting the terminal information ciphertext according to the identifier of the HSS.
  • the terminal identifier can be encrypted and protected, and the network device can learn how to decrypt the terminal identifier ciphertext by transmitting the identifier of the HSS, thereby obtaining the terminal identifier, thereby improving the security of the terminal identifier transmission.
  • GSM Global System of Mobile communication
  • CDMA code division multiple access
  • WCDMA Wideband Code Division Multiple Access
  • GPRS General Packet Radio Service
  • LTE Long Term Evolution
  • FDD Frequency Division Duplex
  • TDD Time Division Duplex
  • the user terminal may include, but is not limited to, a terminal, a mobile station (MS), etc., and the user terminal may communicate with one or more core networks via the radio access network, for example,
  • the UE may be a mobile phone (or "cellular" phone), or it may be a portable, pocket, handheld, computer built-in or in-vehicle mobile device (smart bracelet, smart watch, smart glasses, etc.).
  • the network device in the embodiment of the present invention may be an MME or an SGSN.
  • these devices may appear under other names. As long as the functions of the respective devices are similar to the present invention, they are within the scope of the claims and the equivalents thereof.
  • FIG. 2 is a schematic flowchart of an encryption protection method according to an embodiment of the present invention. As shown in FIG. 2, the encryption protection method according to the embodiment of the present invention includes steps 101 to 107.
  • the encryption protection method includes a network device and a user terminal.
  • the user terminal acquires a location identifier of a current cell.
  • the location identifier may include a Location Area Identity (LAI) or a Tracking Area Identity (TAI).
  • LAI Location Area Identity
  • TAI Tracking Area Identity
  • the LAI is proposed for the location management of the user terminal in the second generation mobile communication technology (The 2nd Generation, 2G) and the third generation mobile communication technology (3G)
  • the TAI is the LTE system for the user.
  • the location management of the terminal is proposed. Therefore, in the future mobile communication technology, other identifiers for the location management of the user terminal can be used as the location identifiers involved in the embodiments of the present invention.
  • the user terminal receives a system message sent by the network device, where the system message carries a location identifier of a cell where the user terminal is currently located. Then, the user terminal acquires a location identifier of the current cell.
  • the network device is a device that manages a cell in which the user terminal is currently located. Further, optionally, the cell managed by the network device is not limited to the current location of the user terminal. Community.
  • the system message of the location identifier of the cell in which the user terminal is currently located which is sent by the network device of the Guangdong province, may be received; when the user terminal is located, In Shanghai, the system message of the location identifier of the current cell of the current user terminal sent by the network device in Shanghai may be received, and the location identifier of the current cell is obtained.
  • the user terminal may actively obtain a location identifier of a current cell, for example, after the user terminal starts, in the process of initially attaching to the network, the user terminal may actively obtain the location of the current cell.
  • the user terminal may perform the step of acquiring the location identifier of the current cell after receiving the terminal information acquisition request sent by the network device.
  • the user terminal may obtain the location identifier of the current cell by using other methods, which is not limited in this embodiment of the present invention.
  • the user terminal acquires a security parameter generated by the contracted HSS and an identifier of the HSS.
  • the security parameter is generated by an HSS contracted by the user terminal.
  • the user terminal If the user terminal is contracted with the HSS, the user terminal stores the security parameters pre-generated by the HSS and the identifier of the HSS.
  • the HSS presets the security parameter to a Subscriber Identify Module (SIM) or a UMTS Subscriber Identify Module (USIM) of the user terminal.
  • SIM Subscriber Identify Module
  • USIM UMTS Subscriber Identify Module
  • the HSS may preset the security parameter in the user terminal by installing software in the user terminal. And the HSS informs the user terminal of the identity of the HSS.
  • the security parameters generated by the HSSs of different core networks are different, which increases the difficulty of stealing the security parameters generated by the network devices such as the pseudo base stations and the HSSs, thereby further enhancing the protection of the terminal information.
  • step 101 and step 102 is not limited in the embodiment of the present invention.
  • the user terminal encrypts terminal information of the user terminal according to the location identifier and the security parameter according to a preset encryption algorithm to generate a terminal information ciphertext.
  • the preset encryption algorithm may be an Identity Based Encryption (IBE) algorithm.
  • the terminal information is encrypted and decrypted by using an asymmetric key system.
  • the public key is a location identifier and a security parameter.
  • the terminal information may be any terminal information reported by the user terminal to the network device, for example, information that may leak the privacy of the terminal, including a terminal identifier or a terminal capability, where the terminal identifier may include a TMSI, The IMSI, the IMEI, and the like; the terminal capability may include, but is not limited to, at least one of a security capability of the terminal, a supported transmission mode, a supported terminal capability level, and whether to support intra-frequency inter-frequency handover.
  • the user terminal sends an identifier indication message to the network device, where the identifier indication message includes the terminal information ciphertext and the identifier of the HSS, so that the network device acquires and decrypts the terminal according to the identifier of the HSS.
  • the working key of the ciphertext of the message is the identifier indication message.
  • the identifier of the HSS in the identifier indication message is used to indicate, to the network device, the HSS that is subscribed by the user terminal, so that the network device acquires and decrypts the terminal information according to the identifier of the HSS.
  • the ciphertext work key is used to indicate, to the network device, the HSS that is subscribed by the user terminal, so that the network device acquires and decrypts the terminal information according to the identifier of the HSS.
  • the network device receives the identifier indication message sent by the user terminal.
  • the network device acquires a location identifier of a cell where the user terminal is currently located.
  • the identifier indication message received by the network device is used by the user terminal.
  • the base station of the current cell is transmitted, and then the cell where the user terminal is currently located may be determined, and the location identifier of the cell is determined.
  • the Tracking Area TA function is to implement management of the location of the user terminal.
  • the UE informs the current TAI of the network device by using the tracking area registration, so that the network device can know the current TAI of the user terminal.
  • the network device acquires a work key for decrypting the terminal information ciphertext according to the identifier of the HSS and the location identifier.
  • the network device searches whether a work key corresponding to the identifier of the HSS and the location identifier is stored.
  • the work key is also the HSS corresponding to the identifier of the HSS by the network device.
  • the specific acquisition process may refer to the detailed description of the work key corresponding to the identifier of the HSS and the location identifier.
  • the working key is equivalent to decrypting the private key of the ciphertext, and the network device needs to apply to the HSS to obtain the information, and it can be understood that the network device is In the process of the HSS application, the HSS authenticates the network device, and if the authentication succeeds, the work key is sent to the network device, so that the security of the work key is secured, and further Can better protect the terminal information.
  • the network device decrypts the terminal information ciphertext according to the security parameter generated by the HSS corresponding to the work key and the identifier of the HSS according to a preset decryption algorithm, to obtain terminal information.
  • the preset decryption algorithm is a decryption algorithm corresponding to a preset encryption algorithm.
  • the location identifier of the cell where the user terminal is currently located is obtained, and the location identifier is obtained.
  • the security parameters generated by the contracted HSS and the identifier of the HSS are obtained, and the terminal information is encrypted according to the location identifier and the security parameter according to the preset encryption algorithm to generate the terminal information ciphertext; thus, the terminal information is encrypted and the terminal is implemented.
  • the protection function of the information in addition, the encrypted ciphertext generated by the location identifier is different, and the ciphertext of the terminal information corresponding to the different location identifiers is different, and the protection of the terminal information can be enhanced; further, the identifier indication sent by the user terminal to the network device
  • the message includes the ciphertext of the terminal information and the identifier of the HSS.
  • the identifier of the HSS enables the network device to know how to decrypt the ciphertext of the terminal information, thereby obtaining the terminal information, thereby improving the security of the terminal information transmission.
  • FIG. 3 is a schematic flowchart of an encryption protection method according to an embodiment of the present invention.
  • the encryption protection method in the embodiment of the present invention includes steps 201 to 211.
  • the encryption protection method includes a network device, an HSS, and a user terminal, and the HSS is a home subscriber server that is subscribed to by the user terminal.
  • the HSS presets a security parameter in the user terminal.
  • the security parameter is pre-generated by the HSS.
  • the HSS also generates a root key in advance, and the security parameter may be shared with a user terminal or a network device; the root key is saved by the HSS and is not shared, and the security parameter and the root key are used to generate The work key for decrypting the terminal information ciphertext.
  • the HSS presets the security parameter in a SIM card or a USIM card of the user terminal.
  • the HSS may preset the security parameter in the user terminal by installing software in a user terminal.
  • the security parameters generated by different HSSs are different from the root key.
  • the network device sends a terminal information acquisition request to the user terminal.
  • the terminal information may be any terminal information reported by the user terminal to the network device, for example, information that may leak the privacy of the terminal, including a terminal identifier or a terminal capability, where the terminal identifier may include a TMSI, The IMSI, the IMEI, and the like; the terminal capability may include, but is not limited to, at least one of a security capability of the terminal, a supported transmission mode, a supported terminal capability level, and whether to support intra-frequency inter-frequency handover.
  • the user terminal acquires a location identifier of a current cell.
  • the location identifier may include LAI or TAI, and the like. Understandably, LAI is at 2G And proposed in the 3G for the location management of the user terminal, the TAI is proposed by the LTE system for the location management of the user terminal. Therefore, in the future mobile communication technology, other identifiers for the location management of the user terminal can be used as The location identifier involved in the embodiment of the present invention.
  • the user terminal receives a system message sent by the network device, where the system message carries a location identifier of a cell where the user terminal is currently located. Then, the user terminal acquires a location identifier of the current cell.
  • the network device is a device that manages a cell in which the user terminal is currently located. Further, optionally, the cell managed by the network device is not limited to the current location of the user terminal. Community.
  • the system message of the location identifier of the cell in which the user terminal is currently located which is sent by the network device of the Guangdong province, may be received; when the user terminal is located, In Shanghai, it can receive a system message sent by a network device in Shanghai that carries the location identifier of the current cell of the current user terminal. Then, the location identifier of the current cell is obtained.
  • the user terminal acquires a security parameter generated by the contracted HSS and an identifier of the HSS.
  • the security parameter is generated by an HSS contracted by the user terminal.
  • the user terminal if the user terminal is contracted with the HSS, the user terminal stores the security parameters pre-generated by the HSS and the identifier of the HSS.
  • step 203 and step 204 is not limited in the embodiment of the present invention.
  • the user terminal encrypts terminal information of the user terminal according to the location identifier and the security parameter according to a preset encryption algorithm to generate a terminal information ciphertext.
  • the preset encryption algorithm may be an IBE algorithm.
  • the terminal information is encrypted and decrypted by using an asymmetric key system.
  • the public key is a location identifier and a security parameter.
  • the user terminal sends an identifier indication message to the network device, where the identifier indication message includes the terminal information ciphertext and the identifier of the HSS, so that the network device acquires and decrypts the terminal according to the identifier of the HSS.
  • the working key of the ciphertext of the message is the identifier indication message.
  • the identifier of the HSS in the identifier indication message is used to indicate to the network device that the HSS subscribed by the user terminal, so that the network device acquires and decrypts the terminal according to the identifier of the HSS.
  • the working key of the ciphertext of the message is used to indicate to the network device that the HSS subscribed by the user terminal, so that the network device acquires and decrypts the terminal according to the identifier of the HSS.
  • the network device receives the identifier indication message sent by the user terminal.
  • the network device acquires a location identifier of a cell where the user terminal is currently located.
  • the identifier indication message received by the network device is transmitted by the base station of the cell where the user terminal is currently located, and then the cell where the user terminal is currently located may be determined, and the location identifier of the cell is determined. .
  • the Tracking Area TA function is to implement management of the location of the user terminal.
  • the UE informs the current TAI of the network device by using the tracking area registration, so that the network device can know the current TAI of the user terminal.
  • the network device sends a work key request request to the HSS corresponding to the identifier of the HSS, where the work key application request carries the location identifier.
  • the network device may save the identifier of the HSS, the location identifier, and the work key. If the network device does not save the work key corresponding to the identifier and the location identifier of the HSS, the network device sends a work key request to the HSS corresponding to the identifier of the HSS after receiving the identifier indication message sent by the user terminal. request.
  • the network device may be a network device of the user terminal in a roaming environment, and when the user terminal is in a roaming environment, the network device in the current roaming environment subscribes to the user terminal.
  • the HSS corresponding to the HSS identifier sends a work key request request.
  • the HSS receives a work key request request sent by the network device.
  • the HSS generates a work key according to the location identifier, the pre-generated security parameter, and the pre-generated root key according to a key generation algorithm.
  • the key generation algorithm may include, but is not limited to, a Ken-gen algorithm.
  • the generation is generated according to the location identifier, the security parameter pre-generated by the HSS, and a pre-generated root key.
  • the work key corresponds to the location identifier and the identity of the HSS.
  • the working key is equivalent to decrypting the private key of the ciphertext, and the network device needs to apply to the HSS to obtain the information, and it can be understood that the network device is In the process of the HSS application, the HSS authenticates the network device, and if the authentication succeeds, the work key is sent to the network device, so that the security of the work key is secured, and further Can better protect the terminal information.
  • the HSS sends the work key to the network device.
  • the network device receives the work key sent by the HSS and the pre-generated security parameter.
  • the network device may apply for a work key to the HSS corresponding to the identifier of the HSS in advance, that is, the step 208 to the step 210 may also be performed before step 206.
  • This embodiment of the present invention does not limit this.
  • the network device decrypts the terminal information ciphertext according to the working key and the security parameter according to a preset decryption algorithm, to obtain terminal information.
  • the preset decryption algorithm is a decryption algorithm corresponding to a preset encryption algorithm.
  • the terminal information of the current cell of the user terminal is obtained, and the security parameters generated by the contracted HSS and the identifier of the HSS are obtained, and the terminal information is encrypted according to the location identifier and the security parameter according to a preset encryption algorithm.
  • the terminal information ciphertext is generated, and the terminal information is protected by the encryption processing of the terminal information.
  • the encrypted ciphertext generated by the location identifier is used to implement different terminal identifier ciphertexts corresponding to different location identifiers.
  • the protection information of the terminal information is enhanced.
  • the identifier indication message sent by the user terminal to the network device includes the ciphertext of the terminal information and the identifier of the HSS. The identifier of the HSS enables the network device to know how to decrypt the ciphertext of the terminal information, thereby obtaining the terminal information. Therefore, the security of terminal information transmission is improved.
  • each device such as a user terminal, a network device, a home user server, etc.
  • each device such as a user terminal, a network device, a home user server, etc.
  • each device includes hardware structures and/or software modules corresponding to the execution of the respective functions.
  • the present invention can be implemented in a combination of hardware or hardware and computer software in combination with the elements and algorithm steps of the various examples described in the embodiments disclosed herein. Whether a function is implemented in hardware or computer software to drive hardware depends on the specific application and design constraints of the solution. A person skilled in the art can use different methods for implementing the described functions for each particular application, but such implementation should not be considered to be beyond the scope of the present invention.
  • the embodiment of the present invention may perform functional unit division on a user terminal, a network device, a home user server, and the like according to the foregoing method example.
  • each functional unit may be divided according to each function, or two or more functions may be integrated in the function.
  • a processing unit In a processing unit.
  • the above integrated unit can be implemented in the form of hardware or in the form of a software functional unit. It should be noted that the division of the unit in the embodiment of the present invention is schematic, and only a logical function division is performed. There are now other ways of dividing.
  • FIG. 4 is a schematic diagram of a modularization of a user terminal according to an embodiment of the present invention.
  • the user terminal in the embodiment of the present invention may be the user terminal provided in any of the embodiments in FIG. 2 to FIG.
  • the user terminal 1 of the embodiment of the present invention may include: an obtaining unit 11, an encrypting unit 12, and a sending unit 13.
  • the user terminal 1 may further include a receiving unit 14 and/or a storage unit 15.
  • the obtaining unit 11 is configured to acquire a location identifier of a current cell.
  • the obtaining unit 11 is further configured to obtain a security parameter generated by the subscribed home subscriber server HSS and an identifier of the HSS;
  • the encryption unit 12 is configured to encrypt the terminal information of the user terminal according to the location identifier and the security parameter according to a preset encryption algorithm, to generate a terminal information ciphertext;
  • the sending unit 13 is configured to send an identifier indication message to the network device, where the identifier indication message includes the terminal information ciphertext and the identifier of the HSS, so that the network device acquires and decrypts the terminal according to the identifier of the HSS.
  • the working key of the ciphertext of the message is configured to send an identifier indication message to the network device, where the identifier indication message includes the terminal information ciphertext and the identifier of the HSS, so that the network device acquires and decrypts the terminal according to the identifier of the HSS.
  • the working key of the ciphertext of the message is configured to send an identifier indication message to the network device, where the identifier indication message includes the terminal information ciphertext and the identifier of the HSS, so that the network device acquires and decrypts the terminal according to the identifier of the HSS.
  • the working key of the ciphertext of the message is configured to send an identifier indication message to the network device, where
  • the user terminal further includes:
  • the receiving unit 14 is configured to receive a terminal information acquisition request sent by the network device.
  • the obtaining unit 11 is configured to receive a system message sent by the network device, where the system message carries a location identifier of the currently located cell.
  • the user terminal further includes:
  • the storage unit 15 is configured to store the security parameters pre-generated by the HSS and the identifier of the HSS if the user terminal subscribes to the HSS.
  • the terminal information includes a terminal identifier or a terminal capability.
  • the user terminal in the embodiment shown in FIG. 4 can be implemented by the user terminal shown in FIG. 5, as shown in FIG. 5, which is a schematic structural diagram of a user terminal according to an embodiment of the present invention.
  • the user terminal 1000 shown in FIG. The system includes a power source 1001, a user interface 1002, a communication module 1003, a processor 1004, a display system 1005, a sensing system 1006, an audio system 1007, and a memory 1008.
  • Figure 5 shows The structure of the terminal does not constitute a limitation of the embodiment of the present invention.
  • the power supply 1001 provides power guarantee for implementing various functions of the user terminal 1000.
  • the user interface 1002 is used for the user terminal 1000 to be connected to other devices or devices to enable communication or data transmission of other devices or devices with the user terminal 1000.
  • the communication module 1003 is configured to implement communication or data transmission between the user terminal 1000 and a base station, a satellite, and the like, and is also used to implement communication or data transmission between the user terminal 1000 and other user terminals.
  • the processor 1004 can implement or perform various illustrative logical blocks, modules and circuits described in connection with the present disclosure.
  • Display system 1005 is used for output display of information and for receiving user input operations.
  • Sensing system 1006 includes various sensors, such as temperature sensors, distance sensors, and the like.
  • Audio system 1007 is used for the output of audio signals.
  • the memory 1008 is used to store data of the user terminal 1000 or to store application code for executing the inventive scheme, and is controlled by the processor 1004 for execution.
  • the processor 1004 is configured to execute the application code stored in the memory 1008 to implement the actions of the user terminal provided by any of the embodiments shown in FIG. 2 to FIG. 3.
  • the processor 1004 is used in the embodiment of the present invention to implement the functions of the obtaining unit 11, the cryptographic unit 12 and the storage unit 15 in FIG. 4, and the communication module 1003 is used in the embodiment of the present invention to implement the receiving unit 14 and send The function of unit 13.
  • a computer storage medium for storing computer software instructions used by the user terminal, which includes a program designed to execute the above aspects for the user terminal, to implement FIG. 2 to FIG. 3 .
  • the action of the user terminal in any of the illustrated embodiments.
  • FIG. 6 is a schematic diagram of a modularization of a network device according to an embodiment of the present invention.
  • the network device in the embodiment of the present invention may be the network device provided in any of the embodiments shown in FIG. 2 to FIG.
  • the network device 2 of the embodiment of the present invention may include: a receiving unit 21, an obtaining unit 22, and a decrypting unit 23.
  • the network device 2 may further include a sending unit 24.
  • the receiving unit 21 is configured to receive an identifier indication message sent by the user terminal, where the identifier indication message includes a terminal information ciphertext and an identifier of the HSS;
  • the obtaining unit 22 is configured to acquire a location identifier of a cell where the user terminal is currently located;
  • the obtaining unit 22 is further configured to acquire, according to the identifier of the HSS and the location identifier, a work key for decrypting the ciphertext of the terminal information;
  • the decryption unit 23 is configured to decrypt the terminal information ciphertext according to the security key generated by the HSS corresponding to the working key and the identifier of the HSS according to a preset decryption algorithm, to obtain a terminal. information;
  • the work key is generated by the HSS according to the security parameter and the location identifier;
  • the preset decryption algorithm is a decryption algorithm corresponding to a preset encryption algorithm.
  • the network device further includes:
  • the sending unit 24 is configured to send a terminal information acquisition request to the user terminal.
  • the acquiring unit 22 is specifically configured to:
  • FIG. 7 is a schematic structural diagram of a network device according to an embodiment of the present invention.
  • the network device 2000 shown in FIG. 7 includes: a processor 2001 and a transceiver 2004.
  • the processor 2001 is connected to the transceiver 2004, such as through the bus 2002.
  • the network device 2000 may further include a memory 2003.
  • the transceiver 2004 is not limited to two, and the structure of the network device 2000 does not constitute a limitation on the embodiment of the present invention.
  • the processor 2001 is applied to the embodiment of the present invention for implementing the functions of the obtaining unit 22 and the decrypting unit 23 shown in FIG. 6.
  • the transceiver 2004 includes a receiver and a transmitter, and the transceiver 2004 is applied to the embodiment of the present invention for implementing the functions of the receiving unit 21 and the transmitting unit 24 shown in FIG.
  • the processor 2001 can be a central processing unit (CPU), a general-purpose processor, a digital signal processing (DSP), an application specific integrated circuit (ASIC), and a field programmable logic gate array (Field). - Programmable Gate Array, FPGA) or other programmable logic device, transistor logic device, hardware component, or any combination thereof. It is possible to implement or carry out the various illustrative logical blocks, modules and circuits described in connection with the present disclosure.
  • the processor 2001 can also be a combination of computing functions, such as one or more microprocessor combinations, a combination of a DSP and a microprocessor, and the like.
  • Bus 2002 can include a path for communicating information between the above components.
  • the bus 2002 can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus.
  • PCI Peripheral Component Interconnect
  • EISA Extended Industry Standard Architecture
  • the bus 2002 can be divided into an address bus, a data bus, a control bus, and the like. For ease of representation, only one thick line is shown in Figure 7, but it does not mean that there is only one bus or one type of bus.
  • the memory 2003 can be a read-only memory (ROM) or other type of static storage device that can store static information and instructions, a random access memory (RAM) or other type that can store information and instructions.
  • the dynamic storage device can also be an Electrically Erasable Programmable Read-Only Memory (EEPROM), a Compact Disc Read-Only Memory (CD-ROM) or other optical disc storage, and a disc storage device. (including compact discs, laser discs, optical discs, digital versatile discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or can be used to carry or store desired program code in the form of instructions or data structures and can be Any other media accessed, but not limited to this.
  • EEPROM Electrically Erasable Programmable Read-Only Memory
  • CD-ROM Compact Disc Read-Only Memory
  • CD-ROM Compact Disc Read-Only Memory
  • disc storage device including compact discs, laser discs, optical discs, digital versatile discs, Blu-ray discs, etc.
  • the memory 2003 is used to store application code for executing the solution of the present invention, and is controlled by the processor 2001 for execution.
  • the processor 2001 is configured to execute the application code stored in the memory 2003 to implement the actions of the network device provided by any of the embodiments shown in FIG. 2 to FIG. 3.
  • Also provided in the embodiment of the present invention is a computer storage medium for storing computer software instructions for use in the network device, which includes a program designed to perform the above aspects for a network device.
  • FIG. 8 is a schematic diagram of a modularization of a home subscriber server according to an embodiment of the present invention.
  • the home subscriber server in the embodiment of the present invention may be the home subscriber server provided in any of the embodiments shown in FIG. 2 to FIG. 3.
  • the home subscriber server 3 of the embodiment of the present invention may include: a receiving unit 31, a generating unit 32, and a sending unit 33.
  • the receiving unit 31 is configured to receive a work key application request sent by the network device, where the work key application request carries a location identifier;
  • the generating unit 32 is configured to generate a work key according to the location identifier, the pre-generated security parameter, and the pre-generated root key according to the key generation algorithm;
  • the sending unit 33 is configured to send the working key to the network device.
  • the home subscriber server shown in the embodiment of the present invention may be used to perform the action or the step of the home subscriber server in any embodiment of the present embodiment, and the specific implementation manner of each functional unit in the home subscriber server and For the technical effects, refer to the detailed description of the corresponding method embodiments, and details are not described herein again.
  • the home subscriber server in the embodiment shown in FIG. 8 can be implemented by the home subscriber server shown in FIG. As shown in FIG. 9, a schematic diagram of a structure of a home subscriber server is provided in the embodiment of the present invention.
  • the home subscriber server 3000 shown in FIG. 9 includes: a processor 3001 and a transceiver 3004.
  • the processor 3001 is connected to the transceiver 3004, such as through the bus 3002.
  • the home subscriber server 3000 may further include a memory 3003.
  • the transceiver 3004 is not limited to two, and the structure of the home subscriber server 3000 does not constitute a limitation on the embodiment of the present invention.
  • the processor 3001 is used in the embodiment of the present invention to implement the function of the generating unit 32 shown in FIG. 8.
  • the transceiver 3004 includes a receiver and a transmitter, and the transceiver 3004 is used in the embodiment of the present invention to implement the functions of the receiving unit 31 and the transmitting unit 33 shown in FIG.
  • the processor 3001 can be a CPU, a general purpose processor, a DSP, an ASIC, an FPGA or other programmable logic device, a transistor logic device, a hardware component, or any combination thereof. It is possible to implement or carry out the various illustrative logical blocks, modules and circuits described in connection with the present disclosure.
  • the processor 3001 can also be a combination of computing functions, for example, including one or more microprocessor combinations, a combination of a DSP and a microprocessor, and the like.
  • Bus 3002 can include a path for communicating information between the components described above.
  • the bus 3002 may be a PCI bus or an EISA bus or the like.
  • the bus 3002 can be divided into an address bus, a data bus, a control bus, and the like. For ease of representation, only one thick line is shown in Figure 9, but it does not mean that there is only one bus or one type of bus.
  • the memory 3003 can be a ROM or other type of static storage device that can store static information and instructions, RAM or other types of dynamic storage devices that can store information and instructions, or can be an EEPROM, CD-ROM or other optical disk storage, optical disk. Storage (including compact discs, laser discs, optical discs, digital versatile discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or can be used to carry or store desired program code in the form of instructions or data structures and can be Any other medium accessed by the computer, but is not limited to this.
  • the memory 3003 is configured to store application code for executing the solution of the present invention, and
  • the processor 3001 controls execution.
  • the processor 3001 is configured to execute the application code stored in the memory 3003 to implement the action of the home subscriber server in any of the embodiments shown in FIG.
  • Also provided in the embodiment of the present invention is a computer storage medium for storing computer software instructions for use by the home subscriber server, including a program designed to perform the above aspects as a home subscriber server.
  • Computer readable media includes both computer storage media and communication media including any medium that facilitates transfer of a computer program from one location to another.
  • a storage medium may be any available media that can be accessed by a computer.
  • the computer readable medium may include a random access memory (RAM), a read-only memory (ROM), and an electrically erasable programmable read-only memory (Electrically Erasable Programmable).
  • EEPROM Electrically Error Read-Only Memory
  • CD-ROM Compact Disc Read-Only Memory
  • Any connection can be a suitable computer Readable media.
  • coaxial cable, fiber optic cable, twisted pair, Digital Subscriber Line (DSL), or wireless technologies such as infrared, radio, and microwave
  • coaxial cable, fiber optic cable, twisted pair, DSL or wireless technologies such as infrared, wireless and microwave are included in the fixing of the associated medium.
  • a disk and a disc include a compact disc (CD), a laser disc, a compact disc, a digital versatile disc (DVD), a floppy disk, and a Blu-ray disc, wherein the disc is usually magnetically copied, and the disc is The laser is used to optically replicate the data. Combinations of the above should also be included within the scope of the computer readable media.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

一种加密保护方法及相关设备，其中方法包括如下步骤：用户终端获取当前所在小区的位置标识；所述用户终端获取签约的HSS生成的安全参数和所述HSS的标识；所述用户终端按照预设加密算法，根据所述位置标识和所述安全参数对所述用户终端的终端信息进行加密，生成终端信息密文；所述用户终端向网络设备发送标识指示消息，所述标识指示消息包括所述终端信息密文和所述HSS的标识，以使所述网络设备根据所述HSS的标识获取解密所述终端信息密文的工作密钥。采用本发明，能够实现对终端信息进行加密保护，并通过传输HSS的标识使得网络设备获知如何解密终端信息密文，进而获得终端信息，因此提高了对终端信息传输的安全性。

Description

一种加密保护方法及相关设备 技术领域
本发明实施例涉及通信技术领域，尤其涉及一种加密保护方法及相关设备。
背景技术
在现有的移动通信系统中，用户终端在网络中的身份可以由国际移动用户识别码(International Mobile Subscriber Identification Number，IMSI)、国际移动设备标识(International Mobile Equipment Identity，IMEI)等标识实现唯一确定。由于在移动通信系统中，支持明文获取用户终端的标识。例如，对于用户终端接入长期演进(Long Term Evolution，LTE)网络的情况而言，在初始附着LTE网络的过程中或当网络出错的场景中，都需要用户终端向网络明文报告用户的IMSI，否则，网络设备无法确定该用户终端所对应的用户。
由于用户标识属于用户的隐私，若被伪基站等设备获取，会泄露用户的私密信息，例如，伪基站可以通过获取IMSI知晓用户的当前位置等信息。而现在技术中，虽然通过采用临时分配的临时识别码(Temporary Mobile Subscriber Identity，TMSI)代替IMSI来保护用户的身份，但在某些情况下网络设备无法通过TMSI来确定用户的身份，如：当用户在网络中进行初始注册的时候，或者当网络不能由用户终端的TMSI检索出IMSI的时候，网络设备仍要求用户终端提供IMSI，此时，用户终端将以明文形式的IMSI进行反馈，仍然存在用户标识被泄露的风险，降低了用户标识传输的安全性。
发明内容
本发明实施例提供了一种加密保护方法及相关设备，能够实现对终端信息进行加密保护，并通过传输HSS的标识使得网络设备获知如何解密终端信息密文，进而获得终端信息，因此提高了对终端信息传输的安全性。
第一方面，本发明实施例提供了一种加密保护方法，包括：
用户终端获取当前所在小区的位置标识；
所述用户终端获取签约的归属用户服务器HSS生成的安全参数和所述HSS的标识；
所述用户终端按照预设加密算法，根据所述位置标识和所述安全参数对所述用户终端的终端信息进行加密，生成终端信息密文；
所述用户终端向网络设备发送标识指示消息，所述标识指示消息包括所述终端信息密文和所述HSS的标识，以使所述网络设备根据所述HSS的标识获取解密所述终端信息密文的工作密钥。
可选的，所述终端信息可以是所述用户终端向网络设备上报的任何终端信息，例如，有可能泄露终端隐私的信息，包括终端标识或终端能力，其中，所述终端标识可以包括TMSI、IMSI、IMEI等；所述终端能力可以包括但不限定于终端的安全能力、支持的传输模式、支持的终端能力等级和是否支持同频异频切换等中的至少一个。
在本发明实施例第一方面中，通过加密的方式实现了对终端信息的保护作用，进一步，通过HSS的标识能够让网络设备获知如何解密终端信息密文，进而获得终端信息，因此提高了对终端信息传输的安全性。
结合第一方面，在第一方面的第一种实现方式中，所述用户终端获取当前所在小区的位置标识之前，还包括：
所述用户终端接收所述网络设备发送的终端信息获取请求。这样用户终端除了可以自主发送终端信息密文的情况，还可以在接收到终端信息获取请求之后发送终端信息密文。
结合第一方面或第一方面的第一种实现方式，在第一方面的第二种实现方式中，所述用户终端获取当前所在小区的位置标识，包括：
所述用户终端接收网络设备发送的系统消息，所述系统消息携带所述用户终端当前所在小区的位置标识。可选的，所述用户终端可以在接入当前所在的小区之后，接收网络设备发送的系统消息。
结合第一方面、第一方面的第一种实现方式或第一方面的第二种实现方式，在第一方面的第三种实现方式中，所述用户终端获取当前所在小区的位置标识之前，还包括：
若所述用户终端与所述HSS签约，则所述用户终端存储所述HSS预先生成的安全参数和所述HSS的标识。
其中，所述用户终端的存储安全参数和HSS的标识可以用于对终端信息进行加密的场景。
第二方面，本发明实施例提供了一种加密保护方法，包括：
网络设备接收用户终端发送的标识指示消息，所述标识指示消息包括终端信息密文和HSS的标识；
所述网络设备获取所述用户终端当前所在小区的位置标识；
所述网络设备根据所述HSS的标识和所述位置标识，获取解密所述终端信息密文的工作密钥；
所述网络设备按照预设解密算法，根据所述工作密钥和所述HSS的标识对应的HSS生成的安全参数，对所述终端信息密文进行解密，获得终端信息；
其中，所述工作密钥由所述HSS根据所述安全参数和所述位置标识生成的；所述预设解密算法为与预设加密算法对应的解密算法。
在本发明实施例第二方面中，网络设备通过HSS的标识和该用户终端当前所在小区的位置标识获知如何解密终端信息密文，进而获得终端信息，因此提高了对终端信息传输的安全性。
结合第二方面，在第二方面的第一种实现方式中，所述网络设备接收用户终端发送的标识指示消息之前，还包括：
网络设备向用户终端发送终端信息获取请求，以使所述用户终端向所述网络设备发送包含终端信息密文的标识指示消息。
结合第二方面或第二方面的第一种实现方式，在第二方面的第二种实现方式中，所述网络设备根据所述HSS的标识和所述位置标识，获取解密所述终端信息密文的工作密钥，包括：
所述网络设备向所述HSS的标识对应的HSS发送工作密钥申请请求，所述工作密钥申请请求携带所述位置标识；
所述网络设备接收所述HSS发送的工作密钥和预先生成的安全参数。
第三方面，本发明实施例提供了一种加密保护方法，包括：
HSS接收网络设备发送的工作密钥申请请求，所述工作密钥申请请求携带位置标识；
所述HSS按照密钥生成算法，根据所述位置标识、预先生成的安全参数和预先生成的根密钥生成工作密钥；
所述HSS将所述工作密钥发送至所述网络设备。
可以理解的是，在所述网络设备接收到所述工作密钥之后可以根据所述工 作密钥，对签约所述HSS的用户终端利用所述位置标识加密的终端信息密文进行解密。
在本发明实施例第三方面中，HSS能够根据位置标识和安全参数生成用于解密终端信息密文的工作密钥，进而让网络设备接收到工作密钥之后通过解密获得终端信息，这样提高了对终端信息传输的安全性。
第四方面为本发明实施例提供了一种用户终端，包括：
获取单元，用于获取当前所在小区的位置标识；
所述获取单元，还用于获取签约的归属用户服务器HSS生成的安全参数和所述HSS的标识；
加密单元，用于按照预设加密算法，根据所述位置标识和所述安全参数对所述用户终端的终端信息进行加密，生成终端信息密文；
发送单元，用于向网络设备发送标识指示消息，所述标识指示消息包括所述终端信息密文和所述HSS的标识，以使所述网络设备根据所述HSS的标识获取解密所述终端信息密文的工作密钥。
本发明实施例第四方面提供的用户终端用于执行本发明第一方面提供的加密保护方法，具体的可参见本发明实施例第一方面的描述，在此不再赘述。
在一个可能的设计中，用户终端的结构中包括处理器和收发器，所述处理器用于执行本发明第一方面提供的加密保护方法。可选的，还可以包括存储器，所述存储器用于存储支持用户终端执行上述方法的应用程序代码，所述处理器被配置为用于执行所述存储器中存储的应用程序。
第五方面为本发明实施例提供了一种网络设备，包括：
接收单元，用于接收用户终端发送的标识指示消息，所述标识指示消息包括终端信息密文和HSS的标识；
获取单元，用于获取所述用户终端当前所在小区的位置标识；
所述获取单元，还用于根据所述HSS的标识和所述位置标识，获取解密所述终端信息密文的工作密钥；
解密单元，用于按照预设解密算法，根据所述工作密钥和所述HSS的标识对应的HSS生成的安全参数，对所述终端信息密文进行解密，获得终端信息；
其中，所述工作密钥由所述HSS根据所述安全参数和所述位置标识生成 的；所述预设解密算法为与预设加密算法对应的解密算法。
本发明实施例第五方面提供的网络设备用于执行本发明第二方面提供的加密保护方法，具体的可参见本发明实施例第二方面的描述，在此不再赘述。
在一个可能的设计中，网络设备的结构中包括处理器和收发器，所述处理器用于执行本发明第二方面提供的加密保护方法。可选的，还可以包括存储器，所述存储器用于存储支持网络设备执行上述方法的应用程序代码，所述处理器被配置为用于执行所述存储器中存储的应用程序。
第六方面为本发明实施例提供了一种归属用户服务器，包括：
接收单元，用于接收网络设备发送的工作密钥申请请求，所述工作密钥申请请求中携带位置标识；
生成单元，用于按照密钥生成算法，根据所述位置标识、预先生成的安全参数和预先生成的根密钥生成工作密钥；
发送单元，用于将所述工作密钥发送至所述网络设备。
本发明实施例第六方面提供的归属用户服务器用于执行本发明第三方面提供的加密保护方法，具体的可参见本发明实施例第三方面的描述，在此不再赘述。
在一个可能的设计中，归属用户服务器的结构中包括处理器和收发器，所述处理器用于执行本发明第三方面提供的加密保护方法。可选的，还可以包括存储器，所述存储器用于存储支持归属用户服务器执行上述方法的应用程序代码，所述处理器被配置为用于执行所述存储器中存储的应用程序。
第七方面，本发明实施例提供了一种计算机存储介质，用于储存为上述用户终端所用的计算机软件指令，其包含用于执行上述方面所设计的程序。
第八方面，本发明实施例提供了一种计算机存储介质，用于储存为上述网络设备所用的计算机软件指令，其包含用于执行上述方面所设计的程序。
第九方面，本发明实施例提供了一种计算机存储介质，用于储存为上述归属用户服务器所用的计算机软件指令，其包含用于执行上述方面所设计的程序。
本发明实施例中，用户终端、网络设备、归属用户服务器的名字对设备本身不构成限定，在实际实现中，这些设备可以以其他名称出现。只要各个设备的功能和本发明类似，属于本发明权利要求及其等同技术的范围之内。
在本发明实施例中，通过获取用户终端当前所在小区的位置标识，以及获取签约的HSS生成的安全参数和HSS的标识，按照预设加密算法，根据位置标识和安全参数对终端信息进行加密，生成终端信息密文；这样通过对终端信息进行加密处理，实现了对终端信息的保护作用；再者，结合位置标识生成的加密密文，实现了不同位置标识对应的终端信息密文不同，能够增强对终端信息的保护作用；进一步，用户终端向网络设备发送的标识指示消息包括终端信息密文和HSS的标识，通过HSS的标识能够让网络设备获知如何解密终端信息密文，进而获得终端信息，因此提高了对终端信息传输的安全性。
附图说明
图1为本发明实施例的一种可能的网络架构图；
图2为本发明实施例提供的一种加密保护方法的流程示意图；
图3为本发明实施例提供的另一种加密保护方法的流程示意图；
图4为本发明实施例提供的一种用户终端的模块化示意图；
图5为本发明实施例提供的一种用户终端的结构示意图；
图6为本发明实施例提供的一种网络设备的模块化示意图；
图7为本发明实施例提供的一种网络设备的结构示意图；
图8为本发明实施例提供的一种归属用户服务器的模块化示意图；
图9为本发明实施例提供的一种归属用户服务器的结构示意图。
具体实施方式
本发明提供的方案能够实现对终端信息进行加密保护，并通过传输HSS的标识使得网络设备获知如何解密终端信息密文，进而获得终端信息，因此提高了对终端信息传输的安全性。
为了使本技术领域的人员更好地理解本发明方案，下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚地描述，显然，所描述的实施例仅仅是本发明一部分的实施例，而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都应当属于本发明保护的范围。
本发明的说明书和权利要求书及所述附图中的术语“第一”、“第二”、“第三”和“第四”等是用于区别不同对象，而不是用于描述特定顺序。此外，术语“包括”和“具有”以及它们任何变形，意图在于覆盖不排他的包含。例如包含了一系列步骤或单元的过程、方法、系统、产品或设备没有限定于已列出的步骤或单元，而是可选地还包括没有列出的步骤或单元，或可选地还包括对于这些过程、方法、产品或设备固有的其它步骤或单元。
在本文中提及“实施例”意味着，结合实施例描述的特定特征、结构或特性可以包含在本发明的至少一个实施例中。在说明书中的各个位置出现该短语并不一定均是指相同的实施例，也不是与其它实施例互斥的独立的或备选的实施例。本领域技术人员显式地和隐式地理解的是，本文所描述的实施例可以与其它实施例相结合。
为了便于理解本发明，下面先介绍下本发明实施例适用的一种可能的网络架构图，如图1所示，是一个演进分组系统(Evolved Packet System，EPS)网络架构图，包括用户终端、演进的UMTS陆地无线接入网(Evolved UMTS Terrestrial Radio Access Network，E-UTRAN)、移动性管理实体(Mobility Management Entity，MME)、GPRS服务支持节点(Serving GPRS Support Node，SGSN)、PDN网关(PDN Gateway，P-GW)、服务网关(S-GW，Serving Gateway)、归属签约用户服务器(Home Subscriber Server，HSS)、服务器(Service)。
其中，EUTRAN由多个演进型NodeB(eNodeB)组成的网络，实现无线物理层功能、资源调度和无线资源管理、无线接入控制以及移动性管理功能。eNodeB通过用户面接口S1-U和S-GW相连，用于传送用户数据；通过控制面接口S1-MME和MME相连，采用S1-AP协议实现无线接入承载控制等功能。SGSN通过Gb接口与GSM/EDGE无线接入网(GERAN)的基站控制器(Base Station Controller，BSC)连接，或通过Iu-PS接口与UMTS无线接入网(URAN)的无线网络控制器(Radio Network Controller，RNC)连接，进行移动数据的管理，如用户身份识别，加密，压缩等功能。MME主要负责用户即会话管理的所有控制平面功能，包括NAS信令及安全、跟踪区的管理、P-GW与S-GW的选择等。S-GW主要负责用户终端的数据传输、转发以及路由切换等，并作为用户终端在eNodeB之间切换时的本地移动性锚定点(对于每一个用户终端，每个时刻仅有一个S-GW为之服务)。P-GW作为公用数据 网(Public Data Network，PDN)连接的锚定点，负责用户终端的IP地址分配，用户终端的数据报文过滤、速率控制、生成计费信息等。HSS包含用户配置文件，执行用户的身份验证和授权，并可提供有关用户物理位置的信息。
在图1所示的网络架构中，用户终端在初始附着LTE网络的过程中或当网络出错时，需要用户终端向网络明文报告用户的IMSI，这样会泄露用户的私密信息。而在本发明实施例中，能够对包括IMSI在内的终端信息进行保护。例如，若终端信息为用户终端的终端标识，在初始附着LTE网络的过程中或当网络出错时，用户终端获取当前所在小区的位置标识；所述用户终端获取签约的HSS生成的安全参数和所述HSS的标识；所述用户终端按照预设加密算法，根据所述位置标识和所述安全参数对所述用户终端的终端标识进行加密，生成终端标识密文；所述用户终端向网络设备发送标识指示消息，所述标识指示消息包括所述终端标识密文和所述HSS的标识，以使所述网络设备根据所述HSS的标识获取解密所述终端信息密文的工作密钥。这样能够实现对终端标识进行加密保护，并通过传输HSS的标识使得网络设备获知如何解密终端标识密文，进而获得终端标识，因此提高了对终端标识传输的安全性。
本发明实施例，除了可以应用于EPS系统，也可应用于其它支持多终端共享号码的通信系统中，例如：全球移动通讯(Global System of Mobile communication，GSM)系统、码分多址(Code Division Multiple Access，CDMA)系统、宽带码分多址(Wideband Code Division Multiple Access，WCDMA)系统、通用分组无线业务(General Packet Radio Service，GPRS)、长期演进(Long Term Evolution，LTE)系统、LTE频分双工(Frequency Division Duplex，FDD)系统、LTE时分双工(Time Division Duplex，TDD)等。
在本发明实施例中，用户终端可以包括但不限定于终端(Terminal)、移动台(Mobile Station，MS)等，用户终端可以经无线接入网与一个或多个核心网进行通信，例如，UE可以是移动电话(或称为“蜂窝”电话)，还可以是便携式、袖珍式、手持式、计算机内置的或者车载的移动装置(智能手环、智能手表、智能眼镜等)。
基于图1所示的网络架构，本发明实施例中的网络设备可以为MME或SGSN。另外，在实际实现中，这些设备可以以其他名称出现。只要各个设备的功能和本发明类似，属于本发明权利要求及其等同技术的范围之内。
请参见图2，为本发明实施例提供了一种加密保护方法的流程示意图，如图2所示，本发明实施例的加密保护方法包括步骤101至步骤107。该加密保护方法中包括网络设备和用户终端。
101，用户终端获取当前所在小区的位置标识。
其中，所述位置标识可以包括位置区识别码(Location Area Identity，LAI)或跟踪区识别码(Tracking Area identity，TAI)等。可以理解是，LAI是在第二代移动通信技术(The 2nd Generation，2G)以及第三代移动通信技术(3rd Generation，3G)中为用户终端的位置管理所提出的，TAI是LTE系统为用户终端的位置管理所提出的，因此，在未来的移动通信技术中，用于用户终端的位置管理的其他标识都可作为本发明实施例中所涉及的位置标识。
可选的，所述用户终端接收网络设备发送的系统消息，所述系统消息携带所述用户终端当前所在小区的位置标识。进而所述用户终端获取到当前所在小区的位置标识。在本发明实施例中，所述网络设备为管理所述用户终端当前所在的小区的设备，进一步，可选的，所述网络设备所管理的小区并不仅仅限定于所述用户终端当前所在的小区。
举例来说，若用户终端的签约归属地为广东省，当用户终端位于广东时，可以接收广东省的网络设备发送的携带所述用户终端当前所在小区的位置标识的系统消息；当用户终端位于上海时，可以接收上海的网络设备发送的携带当前所述用户终端当前所在小区的位置标识的系统消息，进而获取到当前所在小区的位置标识。
可选的，一种可行的方案中，所述用户终端可以主动获取当前所在小区的位置标识，例如，用户终端在开始之后，初始附着网络的过程中，用户终端可以主动获取当前所在小区的位置标识，在另一种可行的方案中，所述用户终端可以在接收到网络设备发送的终端信息获取请求之后，执行获取当前所在小区的位置标识的步骤。
需要说明的是，所述用户终端还可以通过其他途径获取当前所在小区的位置标识，本发明实施例对此不做限定。
102，所述用户终端获取签约的HSS生成的安全参数和所述HSS的标识。
其中，所述安全参数由所述用户终端签约的HSS生成的。可行的方案中， 若所述用户终端与HSS签约，则所述用户终端存储所述HSS预先生成的安全参数和所述HSS的标识。
可选的，所述HSS在所述用户终端签约时，将所述安全参数预置在所述用户终端的用户识别卡(Subscriber Identify Module，SIM)或全球用户识别卡(UMTS Subscriber Identify Module，USIM)中；或者，所述HSS可通过在用户终端中安装软件的形式，将所述安全参数预置在所述用户终端中。并且所述HSS告知用户终端所述HSS的标识。
可选的，不同核心网的HSS所生成的安全参数不同，这样将增加伪基站等网络设备窃取到各个HSS所生成的安全参数的难度，进而更加能增强对终端信息的保护作用。
需要说明的是，本发明实施例对步骤101和步骤102的先后顺序不做限定。
103，所述用户终端按照预设加密算法，根据所述位置标识和所述安全参数对所述用户终端的终端信息进行加密，生成终端信息密文。
其中，预设加密算法可以为基于身份的加密(Identity Based Encryption，IBE)算法。采用非对称密钥体制对终端信息进行加解密。依据上述描述，在本发明实施例中，公钥为位置标识和安全参数。
可选的，所述终端信息可以是所述用户终端向网络设备上报的任何终端信息，例如，有可能泄露终端隐私的信息，包括终端标识或终端能力，其中，所述终端标识可以包括TMSI、IMSI、IMEI等；所述终端能力可以包括但不限定于终端的安全能力、支持的传输模式、支持的终端能力等级和是否支持同频异频切换等中的至少一个。
104，所述用户终端向网络设备发送标识指示消息，所述标识指示消息包括所述终端信息密文和所述HSS的标识，以使所述网络设备根据所述HSS的标识获取解密所述终端信息密文的工作密钥。
其中，所述标识指示消息中的所述HSS的标识用于向所述网络设备指示所述用户终端签约的所述HSS，以使所述网络设备根据所述HSS的标识获取解密所述终端信息密文的工作密钥。
相应地，所述网络设备接收用户终端发送的标识指示消息。
105，所述网络设备获取所述用户终端当前所在小区的位置标识。
可选的，由于所述网络设备接收到的所述标识指示消息是由所述用户终端 当前所在小区的基站传输的，进而可以确定所述用户终端当前所在的小区，并确定该小区的位置标识。
举例来说，在LTE系统中，跟踪区(Tracking Area)TA功能为实现对用户终端位置的管理。UE通过跟踪区注册告知网络设备当前的TAI，这样网络设备能够获知所述用户终端当前的TAI。
106，所述网络设备根据所述HSS的标识和所述位置标识，获取解密所述终端信息密文的工作密钥。
可行的方案中，所述网络设备查找是否存储有与所述HSS的标识和所述位置标识对应的工作密钥。
若查找到，则确定为解密所述终端信息密文的工作密钥。
若未查找到，则向所述HSS的标识对应的HSS发送工作密钥申请请求，所述工作密钥申请请求携带所述位置标识；相应地，所述HSS接收网络设备发送的工作密钥申请请求，并按照密钥生成算法，根据所述位置标识、预先生成的安全参数和预先生成的根密钥生成工作密钥；所述HSS将所述工作密钥发送至所述网络设备。
可以理解是，对于所述网络设备查找到存储的与所述HSS的标识和所述位置标识对应的工作密钥的情况，该工作密钥也是所述网络设备向所述HSS的标识对应的HSS通过发送工作密钥申请请求获取的，具体的获取过程可参见所述网络设备未查找到与所述HSS的标识和所述位置标识对应的工作密钥的详细说明。
对于非对称密钥体制来说，所述工作密钥相当于解密密文的私钥，所述网络设备需要向所述HSS申请才能获取得到，可以理解的是，在所述网络设备向所述HSS申请的过程中，所述HSS会对所述网络设备进行鉴权，如果鉴权成功，则将所述工作密钥发送给所述网络设备，这样保证了工作密钥获取的安全性，进而能够对终端信息进行更好的保护。
107，所述网络设备按照预设解密算法，根据所述工作密钥和所述HSS的标识对应的HSS生成的安全参数，对所述终端信息密文进行解密，获得终端信息。
其中，所述预设解密算法为与预设加密算法对应的解密算法。
在本发明实施例中，通过获取用户终端当前所在小区的位置标识，以及获 取签约的HSS生成的安全参数和HSS的标识，按照预设加密算法，根据位置标识和安全参数对终端信息进行加密，生成终端信息密文；这样通过对终端信息进行加密处理，实现了对终端信息的保护作用；再者，结合位置标识生成的加密密文，实现了不同位置标识对应的终端信息密文不同，能够增强对终端信息的保护作用；进一步，用户终端向网络设备发送的标识指示消息包括终端信息密文和HSS的标识，通过HSS的标识能够让网络设备获知如何解密终端信息密文，进而获得终端信息，因此提高了对终端信息传输的安全性。
请参见图3，为本发明实施例提供了一种加密保护方法的流程示意图，如图3所示，本发明实施例的所述加密保护方法包括步骤201至步骤211。该加密保护方法中包括网络设备、HSS和用户终端，所述HSS为所述用户终端签约的归属用户服务器。
201，HSS在用户终端中预置安全参数。
其中，所述安全参数是所述HSS预先生成的。所述HSS还预先生成根密钥，所述安全参数可以向用户终端或网络设备共享；所述根密钥由所述HSS保存且不共享，所述安全参数和所述根密钥用于生成解密终端信息密文的工作密钥。
可选的，所述HSS在所述用户终端签约时，将所述安全参数预置在所述用户终端的SIM卡或USIM卡中。
可选的，所述HSS可通过在用户终端中安装软件的形式，将所述安全参数预置在所述用户终端中。
可选的，不同HSS生成的安全参数和根密钥不同。
202，网络设备向用户终端发送终端信息获取请求。
可选的，所述终端信息可以是所述用户终端向网络设备上报的任何终端信息，例如，有可能泄露终端隐私的信息，包括终端标识或终端能力，其中，所述终端标识可以包括TMSI、IMSI、IMEI等；所述终端能力可以包括但不限定于终端的安全能力、支持的传输模式、支持的终端能力等级和是否支持同频异频切换等中的至少一个。
203，用户终端获取当前所在小区的位置标识。
其中，所述位置标识可以包括LAI或TAI等。可以理解是，LAI是在2G 以及3G中为用户终端的位置管理所提出的，TAI是LTE系统为用户终端的位置管理所提出的，因此，在未来的移动通信技术中，用于用户终端的位置管理的其他标识都可作为本发明实施例中所涉及的位置标识。
可选的，所述用户终端接收网络设备发送的系统消息，所述系统消息携带所述用户终端当前所在小区的位置标识。进而所述用户终端获取到当前所在小区的位置标识。在本发明实施例中，所述网络设备为管理所述用户终端当前所在的小区的设备，进一步，可选的，所述网络设备所管理的小区并不仅仅限定于所述用户终端当前所在的小区。
举例来说，若用户终端的签约归属地为广东省，当用户终端位于广东时，可以接收广东省的网络设备发送的携带所述用户终端当前所在小区的位置标识的系统消息；当用户终端位于上海时，可以接收上海的网络设备发送的携带当前所述用户终端当前所在小区的位置标识的系统消息。进而获取到当前所在小区的位置标识。
204，所述用户终端获取签约的HSS生成的安全参数和所述HSS的标识。
其中，所述安全参数由所述用户终端签约的HSS生成的。可行的方案中，若所述用户终端与HSS签约，则所述用户终端存储所述HSS预先生成的安全参数和所述HSS的标识。
需要说明的是，本发明实施例对步骤203和步骤204的先后顺序不做限定。
205，所述用户终端按照预设加密算法，根据所述位置标识和所述安全参数对所述用户终端的终端信息进行加密，生成终端信息密文。
其中，预设加密算法可以为IBE算法。采用非对称密钥体制对终端信息进行加解密。依据上述描述，在本发明实施例中，公钥为位置标识和安全参数。
206，所述用户终端向网络设备发送标识指示消息，所述标识指示消息包括所述终端信息密文和所述HSS的标识，以使所述网络设备根据所述HSS的标识获取解密所述终端信息密文的工作密钥。
其中，所述标识指示消息中的所述HSS的标识用于向所述网络设备指示所述用户终端签约的所述HSS，以使所述网络设备向根据所述HSS的标识获取解密所述终端信息密文的工作密钥。
相应地，所述网络设备接收用户终端发送的标识指示消息。
207，所述网络设备获取所述用户终端当前所在小区的位置标识。
可选的，由于所述网络设备接收到的所述标识指示消息是由所述用户终端当前所在小区的基站传输的，进而可以确定所述用户终端当前所在的小区，并确定该小区的位置标识。
举例来说，在LTE系统中，跟踪区(Tracking Area)TA功能为实现对用户终端位置的管理。UE通过跟踪区注册告知网络设备当前的TAI，这样网络设备能够获知所述用户终端当前的TAI。
208，所述网络设备向所述HSS的标识对应的HSS发送工作密钥申请请求，所述工作密钥申请请求携带所述位置标识。
可选的，若所述工作密钥是所述HSS标识对应的HSS根据所述位置标识和所述HSS预先生成的安全参数生成的，则确定所述功率密钥与HSS的标识、位置标识是相对应的，所述网络设备可以将HSS的标识、位置标识和工作密钥对应保存。若所述网络设备未保存与HSS的标识和位置标识对应的工作密钥时，所述网络设备接收到用户终端发送的标识指示消息之后，向所述HSS的标识对应的HSS发送工作密钥申请请求。
可以理解的是，所述网络设备可以是所述用户终端在漫游环境下的网络设备，当所述用户终端在漫游环境下时，当前漫游环境下的网络设备向所述用户终端签约的所述HSS的标识对应的HSS发送工作密钥申请请求。
相应地，所述HSS接收网络设备发送的工作密钥申请请求。
209，所述HSS按照密钥生成算法，根据所述位置标识、预先生成的安全参数和预先生成的根密钥生成工作密钥。
其中，所述密钥生成算法可以包括但不限定于Ken-gen算法。
进一步，在不同HSS生成不同安全参数和根密钥的情况下，由于所述工作密钥是根据所述位置标识、该HSS预先生成的安全参数和预先生成的根密钥生成的，所述生成的所述工作密钥与所述位置标识和所述HSS的标识相对应。
对于非对称密钥体制来说，所述工作密钥相当于解密密文的私钥，所述网络设备需要向所述HSS申请才能获取得到，可以理解的是，在所述网络设备向所述HSS申请的过程中，所述HSS会对所述网络设备进行鉴权，如果鉴权成功，则将所述工作密钥发送给所述网络设备，这样保证了工作密钥获取的安全性，进而能够对终端信息进行更好的保护。
210，所述HSS将所述工作密钥发送至所述网络设备。
相应地，所述网络设备接收所述HSS发送的工作密钥和预先生成的安全参数。
需要说明的是，在本发明实施例中，所述网络设备可以提前向所述HSS的标识对应的所述HSS申请工作密钥，即所述步骤208至步骤210还可以在步骤206之前执行，本发明实施例对此不做限定。
211，所述网络设备按照预设解密算法，根据所述工作密钥和安全参数，对所述终端信息密文进行解密，获得终端信息。
其中，所述预设解密算法为与预设加密算法对应的解密算法。
在本发明实施例中，通过获取用户终端当前所在小区的位置标识，以及获取签约的HSS生成的安全参数和HSS的标识，按照预设加密算法，根据位置标识和安全参数对终端信息进行加密，生成终端信息密文；这样通过对终端信息进行加密处理，实现了对终端信息的保护作用；再者，结合位置标识生成的加密密文，实现了不同位置标识对应的终端信息密文不同，能够增强对终端信息的保护作用；进一步，用户终端向网络设备发送的标识指示消息包括终端信息密文和HSS的标识，通过HSS的标识能够让网络设备获知如何解密终端信息密文，进而获得终端信息，因此提高了对终端信息传输的安全性。
上述主要从各个设备之间交互的角度对本发明实施例的方案进行了介绍。可以理解的是，各个设备，例如用户终端、网络设备、归属用户服务器等为了实现上述功能，其包含了执行各个功能相应的硬件结构和/或软件模块。本领域技术人员应该很容易意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，本发明能够以硬件或硬件和计算机软件的结合形式来实现。某个功能究竟以硬件还是计算机软件驱动硬件的方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本发明的范围。
本发明实施例可以根据上述方法示例对用户终端、网络设备、归属用户服务器等进行功能单元的划分，例如，可以对应各个功能划分各个功能单元，也可以将两个或两个以上的功能集成在一个处理单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。需要说明的是，本发明实施例中对单元的划分是示意性的，仅仅为一种逻辑功能划分，实际实 现时可以有另外的划分方式。
图4为本发明实施例提供了一种用户终端的模块化示意图。本发明实施例中的用户终端可以是图2-图3中任一实施例提供的用户终端。如图4所示，本发明实施例的用户终端1可以包括：获取单元11、加密单元12和发送单元13。可选的，所述用户终端1还可以包括接收单元14和/或存储单元15。
获取单元11，用于获取当前所在小区的位置标识；
所述获取单元11，还用于获取签约的归属用户服务器HSS生成的安全参数和所述HSS的标识；
加密单元12，用于按照预设加密算法，根据所述位置标识和所述安全参数对所述用户终端的终端信息进行加密，生成终端信息密文；
发送单元13，用于向网络设备发送标识指示消息，所述标识指示消息包括所述终端信息密文和所述HSS的标识，以使所述网络设备根据所述HSS的标识获取解密所述终端信息密文的工作密钥。
可选的，所述用户终端还包括：
接收单元14，用于接收所述网络设备发送的终端信息获取请求。
可选的，在所述获取当前所在小区的位置标识方面，所述获取单元11具体用于接收所述网络设备发送的系统消息，所述系统消息中携带所述当前所在的小区的位置标识。
可选的，所述用户终端还包括：
存储单元15，用于若所述用户终端与HSS签约，则存储所述HSS预先生成的安全参数和所述HSS的标识。
可选的，所述终端信息包括终端标识或终端能力。
需要说明的是，在图4所示实施例的用户终端中，各功能单元的具体实现方式以及带来的技术效果参见图2至图3中相应方法实施例的具体描述，在此不再赘述。
图4所示实施例中的用户终端可以以图5所示的用户终端实现，如图5所示，为本发明实施例提供了一种用户终端的结构示意图，图5所示的用户终端1000包括：电源1001、用户接口1002、通信模块1003、处理器1004、显示系统1005、传感系统1006、音频系统1007和存储器1008。图5所示的用 户终端的结构并不构成对本发明实施例的限定。
其中，电源1001为用户终端1000各项功能的实现提供电力保障。用户接口1002用于用户终端1000与其它设备或装置相连接，实现其它设备或装置与用户终端1000的通信或数据传输。通信模块1003用于实现用户终端1000与基站、卫星等设备之间的通信或数据传输，还用于实现用户终端1000与其它用户终端之间的通信或数据传输。处理器1004可以实现或执行结合本发明公开内容所描述的各种示例性的逻辑方框，模块和电路。显示系统1005用于信息的输出显示以及接收用户输入的操作。传感系统1006包括各种传感器，例如温度传感器、距离传感器等。音频系统1007用于音频信号的输出。存储器1008用于存储用户终端1000的数据或者存储执行本发明方案的应用程序代码，并由处理器1004来控制执行。处理器1004用于执行存储器1008中存储的应用程序代码，以实现图2-图3所示任一实施例提供的用户终端的动作。
处理器1004应用于本发明实施例中，用于实现图4中获取单元11、加密单元12和存储单元15的功能，通信模块1003应用于本发明实施例中，用于实现接收单元14和发送单元13的功能。
在本发明实施例中还提供了一种计算机存储介质，用于储存为上述用户终端所用的计算机软件指令，其包含用于执行上述方面为用户终端所设计的程序，以实现图2至图3所示任一实施例中用户终端的动作。
图6为本发明实施例提供了一种网络设备的模块化示意图。本发明实施例中的网络设备可以是图2-图3所示任一实施例提供的网络设备。
如图6所示，本发明实施例的网络设备2可以包括：接收单元21、获取单元22和解密单元23。可选的，所述网络设备2还可以包括发送单元24。
接收单元21，用于接收用户终端发送的标识指示消息，所述标识指示消息包括终端信息密文和HSS的标识；
获取单元22，用于获取所述用户终端当前所在小区的位置标识；
所述获取单元22，还用于根据所述HSS的标识和所述位置标识，获取解密所述终端信息密文的工作密钥；
解密单元23，用于按照预设解密算法，根据所述工作密钥和所述HSS的标识对应的HSS生成的安全参数，对所述终端信息密文进行解密，获得终端 信息；
其中，所述工作密钥由所述HSS根据所述安全参数和所述位置标识生成的；所述预设解密算法为与预设加密算法对应的解密算法。
可选的，所述网络设备还包括：
发送单元24，用于向所述用户终端发送终端信息获取请求。
可选的，在所述根据所述HSS的标识和所述位置标识，获取解密所述终端信息密文的工作密钥方面，所述获取单元22具体用于：
向所述HSS的标识对应的HSS发送工作密钥申请请求，所述工作密钥申请请求携带所述位置标识；
接收所述HSS发送的工作密钥和预先生成的安全参数。
需要说明的是，在图6所示实施例的网络设备中，各功能单元的具体实现方式以及带来的技术效果参见图2至图3中相应方法实施例的具体描述，在此不再赘述。
图6所示实施例中的网络设备可以以图7所示的网络设备实现。如图7所示，为本发明实施例提供了一种网络设备的结构示意图，图7所示的网络设备2000包括：处理器2001和收发器2004。其中，处理器2001和收发器2004相连，如通过总线2002相连。可选的，所述网络设备2000还可以包括存储器2003。需要说明的是，实际应用中收发器2004不限于两个，该网络设备2000的结构并不构成对本发明实施例的限定。
其中，处理器2001应用于本发明实施例中，用于实现图6所示的获取单元22和解密单元23的功能。收发器2004包括接收机和发射机，收发器2004应用于本发明实施例中，用于实现图6所示的接收单元21和发送单元24的功能。
处理器2001可以是中央处理器(Central Processing Unit，CPU)，通用处理器，数字信号处理(Digital Signal Processing，DSP)，集成电路(Application Specific Integrated Circuit，ASIC)，现场可编程逻辑门阵列(Field-Programmable Gate Array，FPGA)或者其他可编程逻辑器件、晶体管逻辑器件、硬件部件或者其任意组合。其可以实现或执行结合本发明公开内容所描述的各种示例性的逻辑方框，模块和电路。处理器2001也可以是实现计算功能的组合，例如包含一个或多个微处理器组合，DSP和微处理器的组合等等。
总线2002可包括一通路，在上述组件之间传送信息。总线2002可以是外设部件互连标准(Peripheral Component Interconnect，PCI)总线或扩展工业标准结构(Extended Industry Standard Architecture，EISA)总线等。总线2002可以分为地址总线、数据总线、控制总线等。为便于表示，图7中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。
存储器2003可以是只读存储器(read-only memory，ROM)或可存储静态信息和指令的其他类型的静态存储设备，随机存取存储器(random access memory，RAM)或者可存储信息和指令的其他类型的动态存储设备，也可以是电可擦可编程只读存储器(Electrically Erasable Programmable Read-Only Memory，EEPROM)、只读光盘(Compact Disc Read-Only Memory，CD-ROM)或其他光盘存储、光碟存储(包括压缩光碟、激光碟、光碟、数字通用光碟、蓝光光碟等)、磁盘存储介质或者其他磁存储设备、或者能够用于携带或存储具有指令或数据结构形式的期望的程序代码并能够由计算机存取的任何其他介质，但不限于此。
可选的，存储器2003用于存储执行本发明方案的应用程序代码，并由处理器2001来控制执行。处理器2001用于执行存储器2003中存储的应用程序代码，以实现图2-图3所示任一实施例提供的网络设备的动作。
在本发明实施例中还提供了一种计算机存储介质，用于储存为上述网络设备所用的计算机软件指令，其包含用于执行上述方面为网络设备所设计的程序。
图8为本发明实施例提供了一种归属用户服务器的模块化示意图。本发明实施例中的归属用户服务器可以是图2-图3所示任一实施例提供的归属用户服务器。如图8所示，本发明实施例的归属用户服务器3可以包括：接收单元31、生成单元32和发送单元33。
接收单元31，用于接收网络设备发送的工作密钥申请请求，所述工作密钥申请请求中携带位置标识；
生成单元32，用于按照密钥生成算法，根据所述位置标识、预先生成的安全参数和预先生成的根密钥生成工作密钥；
发送单元33，用于将所述工作密钥发送至所述网络设备。
需要说明的是，本发明实施例中所示的归属用户服务器可以用于执行图3所示任一实施例中归属用户服务器的动作或步骤，该归属用户服务器中各功能单元的具体实现方式以及带来的技术效果参见相应方法实施例的具体描述，在此不再赘述。
图8所示实施例中的归属用户服务器可以以图9所示的归属用户服务器实现。如图9所示，为本发明实施例提供了一种归属用户服务器的结构示意图，图9所示的归属用户服务器3000包括：处理器3001和收发器3004。
其中，处理器3001和收发器3004相连，如通过总线3002相连。可选的，所述归属用户服务器3000还可以包括存储器3003。
需要说明的是，实际应用中收发器3004不限于两个，该归属用户服务器3000的结构并不构成对本发明实施例的限定。
其中，处理器3001应用于本发明实施例中，用于实现图8所示的生成单元32的功能。收发器3004包括接收机和发射机，收发器3004用于本发明实施例中，用于实现图8所示的接收单元31和发送单元33的功能。
处理器3001可以是CPU，通用处理器，DSP，ASIC，FPGA或者其他可编程逻辑器件、晶体管逻辑器件、硬件部件或者其任意组合。其可以实现或执行结合本发明公开内容所描述的各种示例性的逻辑方框，模块和电路。处理器3001也可以是实现计算功能的组合，例如包含一个或多个微处理器组合，DSP和微处理器的组合等等。
总线3002可包括一通路，在上述组件之间传送信息。总线3002可以是PCI总线或EISA总线等。总线3002可以分为地址总线、数据总线、控制总线等。为便于表示，图9中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。
存储器3003可以是ROM或可存储静态信息和指令的其他类型的静态存储设备，RAM或者可存储信息和指令的其他类型的动态存储设备，也可以是电EEPROM、CD-ROM或其他光盘存储、光碟存储(包括压缩光碟、激光碟、光碟、数字通用光碟、蓝光光碟等)、磁盘存储介质或者其他磁存储设备、或者能够用于携带或存储具有指令或数据结构形式的期望的程序代码并能够由计算机存取的任何其他介质，但不限于此。
可选的，存储器3003用于存储执行本发明方案的应用程序代码，并由处 理器3001来控制执行。处理器3001用于执行存储器3003中存储的应用程序代码，以实现图3所示任一实施例中归属用户服务器的动作。
在本发明实施例中还提供了一种计算机存储介质，用于储存为上述归属用户服务器所用的计算机软件指令，其包含用于执行上述方面为归属用户服务器所设计的程序。
需要说明的是，对于前述的各方法实施例，为了简单描述，故将其都表述为一系列的动作组合，但是本领域技术人员应该知悉，本发明并不受所描述的动作顺序的限制，因为根据本发明，某些步骤可以采用其他顺序或者同时进行。其次，本领域技术人员也应该知悉，说明书中所描述的实施例均属于优选实施例，所涉及的动作和模块并不一定是本发明所必须的。
在上述实施例中，对各个实施例的描述都各有侧重，某个实施例中没有详述的部分，可以参见其他实施例的相关描述。
本发明实施例方法中的步骤可以根据实际需要进行顺序调整、合并和删减。
本发明实施例装置中的单元可以根据实际需要进行合并、划分和删减。本领域的技术人员可以将本说明书中描述的不同实施例以及不同实施例的特征进行结合或组合。
通过以上的实施方式的描述，所属领域的技术人员可以清楚地了解到本发明可以用硬件实现，或固件实现，或它们的组合方式来实现。当使用软件实现时，可以将上述功能存储在计算机可读介质中或作为计算机可读介质上的一个或多个指令或代码进行传输。计算机可读介质包括计算机存储介质和通信介质，其中通信介质包括便于从一个地方向另一个地方传送计算机程序的任何介质。存储介质可以是计算机能够存取的任何可用介质。以此为例但不限于：计算机可读介质可以包括随机存取存储器(Random Access Memory，RAM)、只读存储器(Read-Only Memory，ROM)、电可擦可编程只读存储器(Electrically Erasable Programmable Read-Only Memory，EEPROM)、只读光盘(Compact Disc Read-Only Memory，CD-ROM)或其他光盘存储、磁盘存储介质或者其他磁存储设备、或者能够用于携带或存储具有指令或数据结构形式的期望的程序代码并能够由计算机存取的任何其他介质。此外。任何连接可以适当的成为计算机 可读介质。例如，如果软件是使用同轴电缆、光纤光缆、双绞线、数字用户线(Digital Subscriber Line，DSL)或者诸如红外线、无线电和微波之类的无线技术从网站、服务器或者其他远程源传输的，那么同轴电缆、光纤光缆、双绞线、DSL或者诸如红外线、无线和微波之类的无线技术包括在所属介质的定影中。如本发明所使用的，盘(Disk)和碟(disc)包括压缩光碟(CD)、激光碟、光碟、数字通用光碟(DVD)、软盘和蓝光光碟，其中盘通常磁性的复制数据，而碟则用激光来光学的复制数据。上面的组合也应当包括在计算机可读介质的保护范围之内。
总之，以上所述仅为本发明技术方案的较佳实施例而已，并非用于限定本发明的保护范围。凡在本发明的精神和原则之内，所作的任何修改、等同替换、改进等，均应包含在本发明的保护范围之内。

Claims (18)

  1. 一种加密保护方法，其特征在于，包括：
    用户终端获取当前所在小区的位置标识；
    所述用户终端获取签约的归属用户服务器HSS生成的安全参数和所述HSS的标识；
    所述用户终端按照预设加密算法，根据所述位置标识和所述安全参数对所述用户终端的终端信息进行加密，生成终端信息密文；
    所述用户终端向网络设备发送标识指示消息，所述标识指示消息包括所述终端信息密文和所述HSS的标识，以使所述网络设备根据所述HSS的标识获取解密所述终端信息密文的工作密钥。
  2. 根据权利要求1所述的方法，其特征在于，所述用户终端获取当前所在小区的位置标识之前，还包括：
    所述用户终端接收所述网络设备发送的终端信息获取请求。
  3. 根据权利要求1或2所述的方法，其特征在于，所述用户终端获取当前所在小区的位置标识，包括：
    所述用户终端接收所述网络设备发送的系统消息，所述系统消息携带所述用户终端当前所在小区的位置标识。
  4. 根据权利要求1-3任一项所述的方法，其特征在于，所述用户终端获取当前所在小区的位置标识之前，还包括：
    若所述用户终端与所述HSS签约，则所述用户终端存储所述HSS预先生成的安全参数和所述HSS的标识。
  5. 根据权利要求1-4任一项所述的方法，其特征在于，所述终端信息包括终端标识或终端能力信息。
  6. 一种加密保护方法，其特征在于，包括：
    网络设备接收用户终端发送的标识指示消息，所述标识指示消息包括终端信息密文和HSS的标识；
    所述网络设备获取所述用户终端当前所在小区的位置标识；
    所述网络设备根据所述HSS的标识和所述位置标识，获取解密所述终端信息密文的工作密钥；
    所述网络设备按照预设解密算法，根据所述工作密钥和所述HSS的标识对应的HSS生成的安全参数，对所述终端信息密文进行解密，获得终端信息；
    其中，所述工作密钥由所述HSS根据所述安全参数和所述位置标识生成的；所述预设解密算法为与预设加密算法对应的解密算法。
  7. 根据权利要求6所述的方法，其特征在于，所述网络设备接收用户终端发送的标识指示消息之前，还包括：
    所述网络设备向所述用户终端发送终端信息获取请求。
  8. 根据权利要求6或7所述的方法，其特征在于，所述网络设备根据所述HSS的标识和所述位置标识，获取解密所述终端信息密文的工作密钥，包括：
    所述网络设备向所述HSS的标识对应的HSS发送工作密钥申请请求，所述工作密钥申请请求携带所述位置标识；
    所述网络设备接收所述HSS发送的工作密钥和预先生成的安全参数。
  9. 一种加密保护方法，其特征在于，包括：
    HSS接收网络设备发送的工作密钥申请请求，所述工作密钥申请请求携带位置标识；
    所述HSS按照密钥生成算法，根据所述位置标识、预先生成的安全参数和预先生成的根密钥生成工作密钥；
    所述HSS将所述工作密钥发送至所述网络设备。
  10. 一种用户终端，其特征在于，包括：
    获取单元，用于获取当前所在小区的位置标识；
    所述获取单元，还用于获取签约的归属用户服务器HSS生成的安全参数和所述HSS的标识；
    加密单元，用于按照预设加密算法，根据所述位置标识和所述安全参数对所述用户终端的终端信息进行加密，生成终端信息密文；
    发送单元，用于向网络设备发送标识指示消息，所述标识指示消息包括所述终端信息密文和所述HSS的标识，以使所述网络设备根据所述HSS的标识获取解密所述终端信息密文的工作密钥。
  11. 根据权利要求10所述的用户终端，其特征在于，所述用户终端还包括：
    接收单元，用于接收所述网络设备发送的终端信息获取请求。
  12. 根据权利要求10或11所述的用户终端，其特征在于，在所述获取当前所在小区的位置标识方面，所述获取单元具体用于接收所述网络设备发送的系统消息，所述系统消息中携带所述当前所在的小区的位置标识。
  13. 根据权利要求10-12任一项所述的用户终端，其特征在于，所述用户终端还包括：
    存储单元，用于若所述用户终端与所述HSS签约，则存储所述HSS预先生成的安全参数和所述HSS的标识。
  14. 根据权利要求10-13任一项所述的用户终端，其特征在于，所述终端信息包括终端标识或终端能力。
  15. 一种网络设备，其特征在于，包括：
    接收单元，用于接收用户终端发送的标识指示消息，所述标识指示消息包括终端信息密文和HSS的标识；
    获取单元，用于获取所述用户终端当前所在小区的位置标识；
    所述获取单元，还用于根据所述HSS的标识和所述位置标识，获取解密 所述终端信息密文的工作密钥；
    解密单元，用于按照预设解密算法，根据所述工作密钥和所述HSS的标识对应的HSS生成的安全参数，对所述终端信息密文进行解密，获得终端信息；
    其中，所述工作密钥由所述HSS根据所述安全参数和所述位置标识生成的；所述预设解密算法为与预设加密算法对应的解密算法。
  16. 根据权利要求15所述的网络设备，其特征在于，所述网络设备还包括：
    发送单元，用于向所述用户终端发送终端信息获取请求。
  17. 根据权利要求15或16所述的网络设备，其特征在于，在所述根据所述HSS的标识和所述位置标识，获取解密所述终端信息密文的工作密钥方面，所述获取单元具体用于：
    向所述HSS的标识对应的HSS发送工作密钥申请请求，所述工作密钥申请请求携带所述位置标识；
    接收所述HSS发送的工作密钥和预先生成的安全参数。
  18. 一种归属用户服务器，其特征在于，包括：
    接收单元，用于接收网络设备发送的工作密钥申请请求，所述工作密钥申请请求中携带位置标识；
    生成单元，用于按照密钥生成算法，根据所述位置标识、预先生成的安全参数和预先生成的根密钥生成工作密钥；
    发送单元，用于将所述工作密钥发送至所述网络设备。
PCT/CN2016/099869 2016-09-23 2016-09-23 一种加密保护方法及相关设备 WO2018053804A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
PCT/CN2016/099869 WO2018053804A1 (zh) 2016-09-23 2016-09-23 一种加密保护方法及相关设备

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2016/099869 WO2018053804A1 (zh) 2016-09-23 2016-09-23 一种加密保护方法及相关设备

Publications (1)

Publication Number Publication Date
WO2018053804A1 true WO2018053804A1 (zh) 2018-03-29

Family

ID=61690744

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/099869 WO2018053804A1 (zh) 2016-09-23 2016-09-23 一种加密保护方法及相关设备

Country Status (1)

Country Link
WO (1) WO2018053804A1 (zh)

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112039901A (zh) * 2020-09-02 2020-12-04 联仁健康医疗大数据科技股份有限公司 一种数据传输的方法、装置及系统
CN112218343A (zh) * 2019-07-12 2021-01-12 中国移动通信集团吉林有限公司 小区异频切换方法、装置和计算机设备
CN112437466A (zh) * 2020-10-15 2021-03-02 珠海云洲智能科技股份有限公司 数据传输方法、数据处理单元、接收单元及无人设备
CN114268658A (zh) * 2018-10-31 2022-04-01 创新先进技术有限公司 设备绑定方法、装置和系统
US11528137B2 (en) * 2018-11-01 2022-12-13 Qualcomm Incorporated Identity-based encryption of a message associated with a connection procedure

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2008047195A1 (en) * 2006-10-16 2008-04-24 Nokia Corporation Identifiers in a communication system
CN101699890A (zh) * 2009-10-30 2010-04-28 天津工业大学 一种3g-wlan认证方法
CN101771992A (zh) * 2009-01-04 2010-07-07 中国移动通信集团公司 国际移动用户标识符imsi机密性保护的方法、设备及系统
CN104219650A (zh) * 2014-09-22 2014-12-17 北京电子科技学院 发送用户身份认证信息的方法及用户设备

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2008047195A1 (en) * 2006-10-16 2008-04-24 Nokia Corporation Identifiers in a communication system
CN101771992A (zh) * 2009-01-04 2010-07-07 中国移动通信集团公司 国际移动用户标识符imsi机密性保护的方法、设备及系统
CN101699890A (zh) * 2009-10-30 2010-04-28 天津工业大学 一种3g-wlan认证方法
CN104219650A (zh) * 2014-09-22 2014-12-17 北京电子科技学院 发送用户身份认证信息的方法及用户设备

Cited By (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114268658A (zh) * 2018-10-31 2022-04-01 创新先进技术有限公司 设备绑定方法、装置和系统
CN114268658B (zh) * 2018-10-31 2023-06-09 创新先进技术有限公司 设备绑定方法、装置和系统
US11528137B2 (en) * 2018-11-01 2022-12-13 Qualcomm Incorporated Identity-based encryption of a message associated with a connection procedure
CN112218343A (zh) * 2019-07-12 2021-01-12 中国移动通信集团吉林有限公司 小区异频切换方法、装置和计算机设备
CN112218343B (zh) * 2019-07-12 2023-09-05 中国移动通信集团吉林有限公司 小区异频切换方法、装置和计算机设备
CN112039901A (zh) * 2020-09-02 2020-12-04 联仁健康医疗大数据科技股份有限公司 一种数据传输的方法、装置及系统
CN112039901B (zh) * 2020-09-02 2023-06-13 联仁健康医疗大数据科技股份有限公司 一种数据传输的方法、装置及系统
CN112437466A (zh) * 2020-10-15 2021-03-02 珠海云洲智能科技股份有限公司 数据传输方法、数据处理单元、接收单元及无人设备
CN112437466B (zh) * 2020-10-15 2023-02-10 珠海云洲智能科技股份有限公司 数据传输方法、数据处理单元、接收单元及无人设备

Similar Documents

Publication Publication Date Title
US11329969B2 (en) Network security architecture
US11172357B2 (en) Network architecture and security with encrypted client device contexts
CN107852600B (zh) 针对具有简化移动性过程的网络架构和安全的方法和装置
US11582602B2 (en) Key obtaining method and device, and communications system
US11510052B2 (en) Identity information processing method, device, and system
US10687213B2 (en) Secure establishment method, system and device of wireless local area network
WO2018053804A1 (zh) 一种加密保护方法及相关设备
EP3691316B1 (en) Parameter protection method, device and system
CN109922474B (zh) 触发网络鉴权的方法及相关设备
TWI726890B (zh) 具有加密的網路可達性上下文的網路架構和安全
JP2022517202A (ja) セキュリティのための方法および装置
WO2019214351A1 (zh) 消息处理方法及装置
US20190014472A1 (en) Secure Communication Method and Core Network Node
CN111448814A (zh) 指示用于远程单元的网络
EP3637815A1 (en) Data transmission method, and device and system related thereto
CN111480377A (zh) 指示用于远程单元的网络
EP3146742B1 (en) Exception handling in cellular authentication
CN115412909A (zh) 一种通信方法及装置
CN110169128B (zh) 一种通信方法、装置和系统

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16916543

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 16916543

Country of ref document: EP

Kind code of ref document: A1