WO2018137617A1 - 移动网络小数据的安全传输方法及装置 - Google Patents

移动网络小数据的安全传输方法及装置 Download PDF

Info

Publication number
WO2018137617A1
WO2018137617A1 PCT/CN2018/073830 CN2018073830W WO2018137617A1 WO 2018137617 A1 WO2018137617 A1 WO 2018137617A1 CN 2018073830 W CN2018073830 W CN 2018073830W WO 2018137617 A1 WO2018137617 A1 WO 2018137617A1
Authority
WO
WIPO (PCT)
Prior art keywords
key
base station
key material
encrypted data
context
Prior art date
Application number
PCT/CN2018/073830
Other languages
English (en)
French (fr)
Inventor
谢振华
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2018137617A1 publication Critical patent/WO2018137617A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/02—Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/03—Protecting confidentiality, e.g. by encryption
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/041—Key generation or derivation
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security

Definitions

  • the present disclosure relates to the field of communications, for example, to a secure transmission method and apparatus for mobile network small data.
  • the 3rd Generation Partnership Project (3GPP) proposes a secure transmission method for small data, as shown in Figure 1:
  • Step 101 The connection between the user equipment UE and the network is suspended by the source base station, and the UE and the source base station reserve the context of the UE, including security related information.
  • Step 102 The user equipment UE has data to be sent at a certain moment after the connection is suspended, and then selects the base station to be accessed, the target base station, and sends a random access request to the target base station, for example, initiates a random access preamble (random Access preamble) message.
  • a random access preamble random Access preamble
  • Step 103 The target base station sends a random access response to the UE, for example, sends a random access response (random access response) message.
  • Step 104 The UE sends a connection recovery request to the target base station, for example, a Radio Resource Control (RRC) Connection Resume Request message, and the UE uses the existing key in the context to perform the content in the message.
  • RRC Radio Resource Control
  • the signature operation obtains the signature 1, and the message carries the identification information of the UE and the signature 1.
  • the UE and the network have not been enabled for security, so the message is not encrypted.
  • Step 105 The target base station finds the source base station of the UE according to the identifier information of the UE, and sends a UE context request to the source base station, for example, sends a X2 Retrieve UE Context Request message, carrying the identifier information of the UE and the signature 1.
  • Step 106 The source base station verifies the signature 1, determines that the message is legal, and then derives a new key material 1, such as K eNB * and an optional next-hop chain count, using the security-related information in the UE context. NCC), then send a UE context response to the target base station, such as sending a X2 Retrieve UE Context Response message carrying the key material 1.
  • a new key material such as K eNB * and an optional next-hop chain count
  • Step 107 The target base station generates a new key according to the key material 1, and then sends a connection recovery message to the UE, for example, sends a RRC connection recovery (Connection Resume) message, and the message is signed by the new key to generate a signature 2, and the message carries a signature. 2. It is also possible to carry key material 2, which is from key material 1, such as NCC, at which time the UE and the network have not been enabled for security, so the message is not encrypted.
  • key material 1 such as NCC
  • Step 108 The UE generates a new key according to the security related information in the context and the received key material 2, the new key is the same as the new key used by the network, and then sends a connection recovery complete message to the target base station, for example, sending RRC.
  • the Connection Resume Complete message carries the data to be sent.
  • the UE and the network are enabled for security, so the message is signed and encrypted with the new key.
  • Step 109 The UE and the target base station implement bidirectional secure transmission of data using the new key.
  • the UE needs to perform the interaction of five wireless messages (between the UE and the base station), and the resource consumption of the UE is relatively large.
  • the present disclosure provides a secure transmission method and apparatus for mobile network small data, which can solve the above problems in the related art.
  • the present disclosure provides a secure transmission method for mobile network small data, which is applied to a first base station, and the method includes:
  • the first encrypted data is encrypted on the UE side according to the first key, and the first key is generated on the UE side according to the first key material, and the first key material is in the UE.
  • the side is generated according to the context;
  • the first signature information is generated according to a context on the UE side
  • the first base station performs one of the following operations:
  • the second key material is generated on the second base station side according to the context of the UE;
  • the second signature information is generated on the second base station side according to the second key, and the second key is generated on the second base station side according to the third key material, and the third key material is in the The second base station side is generated according to the context of the UE;
  • the second encrypted data is encrypted according to the third key on the second base station side, and the third key is generated on the second base station side according to the third key material;
  • the third signature information is generated according to the fourth key, the fourth key is generated according to the second key material, and the second key material is generated on the first base station side according to the context of the UE. ;
  • the fourth key material is used in the context of the UE on the first base station side, and the fourth key material is used to generate a fifth key material on the UE side, the fifth key material And configured to generate a fifth key on the UE side;
  • the third encrypted data is encrypted according to a sixth key, the sixth key is generated based on a sixth key material, the sixth key material is from the second base station, and is based on the second base station side Context generation of the UE, or the sixth key material is generated on the first base station side according to the context of the UE.
  • the second key material is used to generate the sixth key on the first base station side
  • the sixth key is used to decrypt the first encrypted data.
  • the second key material is used to generate a seventh key, the seventh key being used to decrypt the first encrypted data.
  • the method before the receiving, by the first base station, the second signature information or the second encrypted data from the second base station, the method further includes:
  • the first base station forwards the first encrypted data or the first signature information to the second base station.
  • the method further includes:
  • the eighth key material is used to generate an eighth key on the UE side, where the eighth key is used to check the second signature information on the UE side. Or the third signature information.
  • the method further includes:
  • the first base station Before the first base station receives the first message from the UE, sending the second encrypted data or the third encrypted data to the UE.
  • the first key material is used to generate an eighth key on the UE side, and the eighth key is used to check the second signature information on the UE side. Or the third signature information.
  • the present disclosure also provides a secure transmission method for mobile network small data, which is applied to a second base station, and the method includes:
  • the first encrypted data is received by the user equipment UE by the first base station, and the first encrypted data is encrypted according to the first key on the UE side, and the first key is used by the UE side.
  • the first signature information is received by the first base station from the UE, and the first signature information is generated according to a context on the UE side;
  • the second signature information is used to be forwarded by the first base station to the UE, the second signature information is generated according to a second key, and the second key is generated based on a third key material, where the The three key material is generated based on the context of the UE;
  • the second key material is used for forwarding by the first base station to the UE;
  • the second encrypted data is used for forwarding by the first base station to the UE, the second encrypted data is encrypted according to a third key, and the third key is generated based on the third key material;
  • the second base station receives the message from the first base station, and sends a fourth key material to the first base station, where the fourth key material is used to generate a fourth key and a fifth on the first base station side.
  • a key the fifth key is used to decrypt the first encrypted data on the first base station side, where the first encrypted data is received by the first base station side from the user equipment UE.
  • the method further includes:
  • the second base station encrypts the data sent to the UE by using the third key, and forwards the data to the UE by using the first base station;
  • the second base station decrypts the received encrypted data from the UE that is forwarded by the first base station.
  • the present disclosure also provides a secure transmission method for mobile network small data, which is applied to a user equipment UE, and the method includes one of the following:
  • the user equipment UE carries the first encrypted data in the first message or the second message sent to the first base station, where the first encrypted data is encrypted according to the first key, and the first key is based on the first secret Key material generation, the first key material being generated based on a context;
  • the user equipment UE sends the first signature information and the first encrypted data to the first base station, where the first encrypted data is encrypted according to the first key, and the first key is generated according to the first key material, where the A key material is generated based on a context, and the first signature information is generated based on the context;
  • the user equipment UE sends the first signature information to the first base station, where the first signature information is generated based on the context;
  • the UE receives second encrypted data from the first base station, the second encrypted data is decrypted according to the second key, and the second key is generated according to the second key material.
  • the UE receives second encrypted data from the first base station, and the second encrypted data is carried in a second message sent by the first base station to the UE.
  • the method further includes:
  • the second key is the same as the first key, and the second key material is the same as the first key material.
  • the method further includes:
  • the third key material is used to generate a fourth key material
  • the fourth key material is used to generate a third key
  • the second key is the same as the third key
  • the second key material is the same as the fourth key material.
  • the method further includes:
  • the UE receives second signature information from the first base station, the second signature information is used by the UE to verify according to a fourth key, and the fourth key is generated based on the fourth key material.
  • the method further includes:
  • the UE receives second signature information from the first base station, the second signature information is used by the UE to verify according to a fourth key, and the fourth key is generated based on the first key material.
  • the disclosure also provides a secure transmission device for mobile network small data, which is applied to the first base station, and includes:
  • a receiving module configured to receive a first message from the user equipment UE, where the first message carries at least one of the first encrypted data and the third signature information;
  • the first encrypted data is encrypted on the UE side according to the first key, and the first key is generated on the UE side according to the first key material, and the first key material is in the UE.
  • the side is generated according to the context;
  • the first signature information is generated according to a context on the UE side
  • the processing module is configured to receive at least one of the second key material, the second signature information, and the second encrypted data from the second base station, and forward the message to the UE;
  • the second key material is generated on the second base station side according to the context of the UE;
  • the second signature information is generated on the second base station side according to the second key, and the second key is generated on the second base station side according to the third key material, and the third key material is in the The second base station side is generated according to the context of the UE;
  • the second encrypted data is encrypted according to the third key on the second base station side, and the third key is generated on the second base station side according to the third key material;
  • a sending module configured to send at least one of the third signature information, the fourth key material, and the third encrypted data to the UE;
  • the third signature information is generated according to the fourth key, the fourth key is generated according to the second key material, and the second key material is generated on the first base station side according to the context of the UE. ;
  • the fourth key material is used in the context of the UE on the first base station side, and the fourth key material is used to generate a fifth key material on the UE side, the fifth key material And configured to generate a fifth key on the UE side;
  • the third encrypted data is encrypted according to a sixth key, the sixth key is generated based on a sixth key material, the sixth key material is from the second base station, and is based on the second base station side Context generation of the UE, or the sixth key material is generated on the first base station side according to the context of the UE.
  • the present disclosure also provides a secure transmission apparatus for mobile network small data, which is applied to a user equipment UE, including one of the following:
  • the processing module is configured to carry the first encrypted data in the first message sent to the first base station or in the second message, where the first encrypted data is encrypted according to the first key, and the first key is based on the first a key material generation, the first key material being generated based on a context;
  • the sending module is configured to send at least one of the first signature information and the first encrypted data to the first base station, where the first encrypted data is encrypted according to the first key, and the first key is based on the first secret Key material generation, the first key material is generated based on a context, and the first signature information is generated based on the context;
  • the receiving module is configured to receive second encrypted data from the first base station, the second encrypted data is decrypted according to the second key, and the second key is generated according to the second key material.
  • the present disclosure also provides a computer program product comprising a computer program stored on a non-transitory computer readable storage medium, the computer program comprising program instructions, when the program instructions are executed by a computer, Having the computer perform any of the methods described above.
  • a computer storage medium which may store execution instructions for performing a secure transmission method of mobile network small data in the above embodiments.
  • the UE transmits data from the suspended state with a minimum of only 2 wireless messages, and requires at most 4 wireless messages, so that the resource consumption of the UE is reduced, and the data is also guaranteed. Safe transmission.
  • FIG. 1 is a schematic diagram of a secure transmission process of small data of the related art.
  • FIG. 2 is a schematic diagram (1) of a secure transmission flow of small data in the first embodiment.
  • FIG. 3 is a schematic diagram (2) of a secure transmission process of small data in the second embodiment.
  • FIG. 4 is a schematic diagram (3) of a secure transmission flow of small data in the third embodiment.
  • FIG. 5 is a schematic diagram (4) of a secure transmission process of small data in the fourth embodiment.
  • FIG. 6 is a schematic diagram (5) of a secure transmission process of small data in the fifth embodiment.
  • FIG. 7 is a schematic diagram (6) of a secure transmission process of small data in the sixth embodiment.
  • FIG. 8 is a schematic diagram (7) of the secure transmission process of the small data of the seventh embodiment.
  • FIG. 9 is a schematic diagram of the secure transmission process of the small data of the eighth embodiment (8).
  • FIG. 10 is a schematic diagram (9) of a secure transmission process of small data according to Embodiment 9.
  • FIG. 11 is a schematic diagram (10) of the secure transmission process of the small data of the tenth embodiment.
  • FIG. 12 is a flowchart of a method for securely transmitting small data of a mobile network according to an embodiment.
  • FIG. 13 is a structural block diagram of a secure transmission apparatus for mobile network small data according to an embodiment.
  • FIG. 14 is a structural block diagram of another secure transmission apparatus for mobile network small data according to an embodiment.
  • FIG. 2 is a schematic diagram (1) of a secure transmission process of small data according to Embodiment 1 of the present application, where the process includes:
  • Step 201 The connection between the user equipment UE and the network is suspended by the source base station, and the UE and the source base station reserve the context of the UE, including security-related information.
  • Step 202 The user equipment UE has data to be sent at a certain moment after the connection is suspended.
  • the identifier or other information of the UE (the UE is to be transmitted to the base station, or the UE and the base station are both some) a signing operation to generate a signature
  • secondly selects a base station to be accessed - the target base station and generates a new key material (such as K eNB *) in the context of safety-related information (such as K eNB), using the new
  • K eNB * a new key material
  • the key material updates the key material information (such as K eNB ) in the UE context, and then generates a new signature key i and the encryption/decryption key a based on the new key material, and encrypts the data to be transmitted using the key a.
  • Data A finally sends a random access request to the target base station, for example, initiates a random access preamble message, carries the identity information of the UE, the signature 1, and the encrypted data A.
  • the target base station for example, initiates a random access preamble message, carries the identity information of the UE, the signature 1, and the encrypted data A.
  • the UE and the network have not been enabled for security, so the message is not encrypted.
  • Step 203 The target base station finds the source base station of the UE according to the identifier information of the UE, and sends a forwarding request to the source base station, for example, sending an X2 Forward Request message, carrying the identifier information of the UE and the encrypted data A, and carrying the signature 1.
  • Step 204 The source base station finds the context of the UE according to the identifier of the UE, verifies the signature 1 by using the existing key in the UE context, determines that the message is legal, and then derives a new key material (such as K) by using security related information in the context of the UE. eNB *), using the new key material to update key material information (such as K eNB ) in the UE context, and then generating a new signature key i and encryption/decryption key a based on the new key material, and using the key a decrypts data A.
  • K key material
  • Step 205 The source base station sends a forwarding response to the target base station, for example, sending an X2 Forward Response message, and signing the message content by using the key i to obtain a signature 2, where the message can carry the signature 2. If the source base station has data to send to the UE, the The data is encrypted using the key a to obtain the data B, and the message carries the data B.
  • Step 206 The target base station sends a random access response to the UE, for example, sends a random access response message, and the message can carry the signature 2, and can carry the encrypted data B.
  • the UE and the network have not been enabled with security, so the message is not encrypted.
  • Step 207 The UE verifies the signature 2 using the key i, and decrypts the received data B using the key a.
  • Step 208 The UE and the source base station implement bidirectional secure transmission of data by using the new key a through forwarding of the target base station.
  • FIG. 3 is a schematic diagram (2) of a secure transmission process of small data according to Embodiment 2 of the present application, where the process includes:
  • Step 301 The connection between the user equipment UE and the network is suspended by the source base station, and the UE and the source base station reserve the context of the UE, including security related information.
  • Step 302 The user equipment UE has data to be sent at a certain moment after the connection is suspended, firstly according to the existing key to the UE's identity or other information in the context (the UE is to be transmitted to the base station, or the UE and the base station are both some) a signing operation to generate a signature, secondly selects a base station to be accessed - the target base station, and generates a new key material (such as K eNB * 2) based on the context of safety-related information (such as K eNB), using the The new key material updates key material information (such as K eNB ) in the UE context, and then generates a new signature key i and an encryption/decryption key a based on the new key material, and encrypts the data to be transmitted using the key a.
  • a signing operation to generate a signature
  • Data A finally sends a random access request to the target base station, for example, initiates a random access preamble message, carries the identity information of the UE, the signature 1, and the encrypted data A.
  • the target base station for example, initiates a random access preamble message, carries the identity information of the UE, the signature 1, and the encrypted data A.
  • the UE and the network have not been enabled for security, so the message is not encrypted.
  • Step 303 The target base station finds the source base station of the UE according to the identifier information of the UE, and sends a UE context request to the source base station, for example, sends an X2 Retrieve UE Context Request message, and carries the identifier information of the UE and the signature 1.
  • Step 304 The source base station finds the context of the UE according to the identifier of the UE, verifies the signature 1 by using the existing key in the UE context, determines that the message is legal, and then derives a new key material 1 by using security related information in the context of the UE (for example, Use K eNB to derive K eNB *2, if there is NCC, use KNC to derive K eNB *1, key material 1 contains K eNB *2, possibly K eNB *1 and NCC), use the new key material 1 keying material update UE context information (such as K eNB * 1 without updating the K eNB using K eNB * 2, there is K eNB using K eNB * 1 * 1 K eNB update), then sends a UE context to the target base station The response, such as sending an X2 Retrieve UE Context Response message, carries the key material 1.
  • security related information in the context of the UE for example, Use K eNB to derive K eNB *2,
  • Step 305 The target base station generates a new encryption/decryption key a using information in the key material 1 (such as K eNB *2), decrypts the data A using the key a, and uses the K eNB *1 in the key material 1 to use K eNB *2 generates a new signature key i, and if there is K eNB *1, generates a new signature key i and an encryption/decryption key b using K eNB *1, and replaces the key a with the key b.
  • the key material 1 such as K eNB *2
  • Step 306 The target base station sends a random access response to the UE, for example, sends a random access response message, and the message uses the key i signature to obtain the signature 2, and the message can carry the signature 2. If the target base station has data to send, the key b is encrypted. The data gets the data B, and the message can carry the data B. If there is an NCC in the key material 1, the message also carries the key material 2, and the key material 2 (such as NCC) comes from the key material 1, and the UE and the network are not yet enabled. Security, so the message is not encrypted.
  • Step 307 If the UE receives the key material 2, use the key material 2 to generate a new key material (such as K eNB *1), and update the key material in the UE context with the new key material (such as with K eNB) *1 Update K eNB ), then generate a new signature key k and a new encryption/decryption key b with a new key material (such as K eNB *1), replace the key i with the key k, and replace the key with the key b a, the UE verifies the signature 2 using the key i, and decrypts the received data B using the key a.
  • a new key material such as K eNB *1
  • Step 308 The UE and the target base station implement bidirectional secure transmission of data by using the new key.
  • FIG. 4 is a schematic diagram (3) of a secure transmission process of small data according to Embodiment 3 of the present application, where the process includes:
  • Step 401 The connection between the user equipment UE and the network is suspended by the source base station, and the UE and the source base station reserve the context of the UE, including security related information.
  • Step 402 The user equipment UE has data to be sent at a certain moment after the connection is suspended, and then selects the base station to be accessed, the target base station, and sends a random access request to the target base station, for example, initiates a random access preamble message, and the message
  • the identifier of the UE may be carried, and the UE may perform signature operation on the identifier of the UE or other information (the UE is to be transmitted to the base station, or both the UE and the base station) according to the existing key in the context, and generate a signature 1 in the message. Carry the signature 1.
  • Step 403 The target base station sends a random access response to the UE, for example, sends a random access response message.
  • Step 404 The UE may first generate a signature 1 according to the existing key of the UE, such as the identifier of the UE or other information (the UE is to be transmitted to the base station, or both the UE and the base station), and secondly according to the security in the context. Relevant information (such as K eNB ) generates a new key material (such as K eNB *2), uses the new key material to update key material information (such as K eNB ) in the UE context, and then generates a new signature based on the new key material.
  • K eNB a new key material
  • K eNB *2 uses the new key material to update key material information (such as K eNB ) in the UE context, and then generates a new signature based on the new key material.
  • the key i and the encryption/decryption key a are encrypted by the key a to obtain the data A, and finally the connection recovery request is sent to the target base station, for example, the RRC Connection Resume Request message is sent, and the message may carry the identification information of the UE. It can carry the signature 1 and carry the encrypted data A. At this time, the UE and the network have not been enabled for security, so the message is not encrypted.
  • Step 405 The target base station finds the source base station of the UE according to the identifier information of the UE, and sends a UE context request to the source base station, for example, sends an X2 Retrieve UE Context Request message, and carries the identifier information of the UE and the signature 1.
  • Step 406 The source base station finds the context of the UE according to the identifier of the UE, verifies the signature 1 by using the existing key in the UE context, determines that the message is legal, and then derives a new key material 1 by using security related information in the context of the UE (for example Use K eNB to derive K eNB *2, if there is NCC, use KNC to derive K eNB *1, key material 1 contains K eNB *2, possibly K eNB *1 and NCC), use the new key material 1 keying material update UE context information (such as K eNB * 1 without updating the K eNB using K eNB * 2, there is K eNB using K eNB * 1 * 1 K eNB update), then sends a UE context to the target base station The response, such as sending an X2 Retrieve UE Context Response message, carries the key material 1.
  • security related information in the context of the UE for example Use K eNB to derive K eNB *2, if there
  • Step 407 The target base station generates a new encryption/decryption key a using information in the key material 1 (such as K eNB *2), and decrypts the data A using the key a. If there is no K eNB *1 in the key material 1, the target base station uses K eNB *2 generates a new signature key i, and if there is K eNB *1, generates a new signature key i and an encryption/decryption key b using K eNB *1, and replaces the key a with the key b.
  • K eNB *2 such as K eNB *2
  • Step 408 The target base station sends a connection recovery message to the UE, for example, sends an RRC Connection Resume message, and the message uses the key i signature to obtain the signature 2, and the message can carry the signature 2. If the target base station has data to send, the key b is used to encrypt the data. Obtaining data B, the message can carry data B. If there is NCC in the key material 1, the message also carries the key material 2, and the key material 2 (such as NCC) comes from the key material 1, and the UE and the network have not been enabled yet. , so the message is not encrypted.
  • Step 409 If the UE receives the key material 2, use the key material 2 to generate a new key material (such as K eNB *1), and update the key material in the UE context with the new key material (such as with K eNB) *1 Update K eNB ), then generate a new signature key k and a new encryption/decryption key b with a new key material (such as K eNB *1), replace the key i with the key k, and replace the key with the key b a, the UE verifies the signature 2 using the key i, and decrypts the received data B using the key a.
  • a new key material such as K eNB *1
  • Step 410 The UE and the target base station implement bidirectional secure transmission of data by using a new key.
  • FIG. 5 is a schematic diagram (4) of a secure transmission process of small data according to Embodiment 4 of the present application, where the process includes:
  • Step 501 The connection between the user equipment UE and the network is suspended by the base station, and the UE and the base station reserve the context of the UE, including security related information.
  • Step 502 The user equipment UE has data to be sent at a certain moment after the connection is suspended.
  • the identifier or other information of the UE (the UE is to be transmitted to the base station, or the UE and the base station are both
  • the signature operation is performed to generate the signature 1, and then the base station to be accessed is selected - the base station in step 501, and a new key material (such as K eNB *) is generated according to security related information (such as K eNB ) in the context.
  • Step 503 The base station finds the context of the UE according to the identifier of the UE, verifies the signature 1 by using the existing key in the UE context, determines that the message is legal, and then derives a new key material (such as K eNB) by using security related information in the context of the UE. *), using the new key material to update key material information (such as K eNB ) in the UE context, and then generating a new signature key i and encryption/decryption key a based on the new key material (such as K eNB *) And decrypt the data A using the key a.
  • a new key material such as K eNB
  • Step 504 The base station sends a random access response to the UE, for example, sends a random access response message, and uses the key i to sign the message content to obtain a signature 2, and the message can carry the signature 2. If the base station has data to send to the UE, the message carries The data, the data is encrypted using the key a to obtain the data B. At this time, the UE and the network have not been enabled for security, so the message is not encrypted.
  • Step 505 The UE verifies the signature 2 using the key i, and decrypts the received data B using the key a.
  • Step 506 The UE and the base station implement bidirectional secure transmission of data using the new key a.
  • FIG. 6 is a schematic diagram (5) of a secure transmission process of small data according to Embodiment 5 of the present application, where the process includes:
  • Step 601 The connection between the user equipment UE and the network is suspended by the base station, and the UE and the base station reserve the context of the UE, including security related information.
  • Step 602 The user equipment UE has data to be sent at a certain moment after the connection is suspended.
  • the identifier or other information of the UE (the UE is to be transmitted to the base station, or the UE and the base station are both
  • the signature operation is performed to generate the signature 1, and then the base station to be accessed is selected - the base station in step 601, and a new key material (such as K eNB *2) is generated according to security related information (such as K eNB ) in the context.
  • Step 603 The base station finds the context of the UE according to the identifier of the UE, verifies the signature 1 by using the existing key in the UE context, determines that the message is legal, and then derives a new key material 1 by using security related information in the context of the UE (for example, using K eNB derives K eNB *2, if there is NCC, K eNB *1 is derived using NCC, and key material 1 contains K eNB *2, possibly including K eNB *1 and NCC), using the new key material 1 keying material update UE context information (such as no use K eNB * 1 K eNB * 2 updated K eNB, K eNB * 1 have use K eNB * 1 update K eNB), and then use the key material 1
  • the information (such as K eNB *2) generates a new encryption/decryption key a, decrypts the data A using the key a, and if there is no K eNB *1 in the key material 1, generates
  • Step 604 The base station sends a random access response to the UE, for example, sends a random access response message, and the message uses the key i signature to obtain the signature 2, and the message can carry the signature 2. If the base station has data to send, the key b is used to encrypt the data. Data B, the message may carry data B. If there is an NCC in the key material 1, the message also carries the key material 2, and the key material 2 (such as NCC) comes from the key material 1, and the UE and the network have not been enabled yet. Therefore the message is not encrypted.
  • Step 605 If the UE receives the key material 2, use the key material 2 to generate a new key material (such as K eNB *1), and update the key material in the UE context with the new key material (such as with K eNB) *1 Update K eNB ), then generate a new signature key k and a new encryption/decryption key b with a new key material (such as K eNB *1), replace the key i with the key k, and replace the key with the key b a, the UE verifies the signature 2 using the key i, and decrypts the received data B using the key a.
  • a new key material such as K eNB *1
  • Step 606 The UE and the base station implement bidirectional secure transmission of data by using a new key.
  • FIG. 7 is a schematic diagram (S) of a secure transmission process of small data according to Embodiment 6 of the present application, where the process includes:
  • Step 701 The connection between the user equipment UE and the network is suspended by the base station, and the UE and the base station reserve the context of the UE, including security related information.
  • Step 702 The user equipment UE has data to be sent at a certain moment after the connection is suspended, and then selects the base station to be accessed, the base station in step 701, and sends a random access request to the base station, for example, initiates a random access preamble message. .
  • Step 703 The base station sends a random access response to the UE, for example, sends a random access response message.
  • Step 704 The UE first performs signature operation on the identifier of the UE or other information (the UE is to be transmitted to the base station, or both the UE and the base station) according to the existing key in the context, and then generates a signature according to the security in the context.
  • Information such as K eNB
  • K eNB * 2 uses the new key material to update key material information (such as K eNB ) in the UE context, and then generates a new signature based on the new key material.
  • the key i and the encryption/decryption key a are encrypted by using the key a to obtain the data A, and finally send a connection recovery request to the target base station, for example, sending an RRC Connection Resume Request message, carrying the identification information of the UE, and signing 1, And encrypted data A, at this time the UE and the network have not been enabled for security, so the message is not encrypted.
  • Step 705 The base station finds the context of the UE according to the identifier of the UE, verifies the signature 1 by using the existing key in the UE context, determines that the message is legal, and then derives a new key material 1 by using security related information in the context of the UE (for example, using K eNB derives K eNB *2, if there is NCC, K eNB *1 is derived using NCC, and key material 1 contains K eNB *2, possibly including K eNB *1 and NCC), using the new key material 1 keying material update UE context information (such as no use K eNB * 1 K eNB * 2 updated K eNB, K eNB * 1 have use K eNB * 1 update K eNB), and then use the key material 1
  • the information (such as K eNB *2) generates a new encryption/decryption key a, decrypts the data A using the key a, and if there is no K eNB *1 in the key material 1, generates
  • Step 706 The base station sends a connection recovery message to the UE, for example, sending an RRC Connection Resume message, the message is signed by the key i, and the message can carry the signature 2. If the base station has data to send, the data is encrypted by using the key b. B, the message can carry the data B. If there is an NCC in the key material 1, the message also carries the key material 2, and the key material 2 (such as NCC) comes from the key material 1, and the UE and the network have not been enabled yet, so The message is not encrypted.
  • Step 707 If the UE receives the key material 2, use the key material 2 to generate a new key material (such as K eNB *1), and update the key material in the UE context with the new key material (such as with K eNB) *1 Update K eNB ), then generate a new signature key k and a new encryption/decryption key b with a new key material (such as K eNB *1), replace the key i with the key k, and replace the key with the key b a, the UE verifies the signature 2 using the key i, and decrypts the received data B using the key a.
  • a new key material such as K eNB *1
  • Step 708 The UE and the base station implement bidirectional secure transmission of data using the new key.
  • FIG. 8 is a schematic diagram (7) of a secure transmission process of small data according to Embodiment 7 of the present application, where the process includes:
  • Step 801 The connection between the user equipment UE and the network is suspended by the source base station, and the UE and the source base station reserve the context of the UE, including security related information.
  • Step 802 The user equipment UE has data to be sent at a certain moment after the connection is suspended.
  • the identifier or other information of the UE (the UE is to be transmitted to the base station, or the UE and the base station are both some) a signing operation to generate a signature
  • secondly selects a base station to be accessed - the target base station and generates a new key material (such as K eNB *) in the context of safety-related information (such as K eNB), using the new
  • K eNB * a new key material
  • the key material updates the key material information (such as K eNB ) in the UE context, and then generates a new signature key i and the encryption/decryption key a based on the new key material, and encrypts the data to be transmitted using the key a.
  • Data A finally sends a random access request to the target base station, for example, initiates a random access preamble message, carries the identity information of the UE, the signature 1, and the encrypted data A.
  • the target base station for example, initiates a random access preamble message, carries the identity information of the UE, the signature 1, and the encrypted data A.
  • the UE and the network have not been enabled for security, so the message is not encrypted.
  • Step 803 The target base station finds the source base station of the UE according to the identifier information of the UE, and sends a forwarding request to the source base station, for example, sending an X2 Forward Request message, carrying the identifier information of the UE and the encrypted data A, and carrying the signature 1.
  • Step 804 The source base station finds the context of the UE according to the identifier of the UE, verifies the signature 1 by using the existing key in the UE context, determines that the message is legal, and then derives a new key material 1 by using security related information in the context of the UE (for example, Use K eNB to derive K eNB *2, if there is NCC, use KNC to derive K eNB *1, key material 1 contains K eNB *2, possibly K eNB *1 and NCC), use the new key material 1 keying material update UE context information (such as K eNB * 1 without updating the K eNB using K eNB * 2, there is K eNB using K eNB * 1 * 1 K eNB update), then use the key material 1
  • the information (such as K eNB *2) generates a new encryption/decryption key a, decrypts the data A using the key a, and if there is no K eNB *1 in the key material 1, generates a
  • Step 805 The source base station sends a forwarding response to the target base station, for example, sending an X2 Forward Response message. If there is an NCC in the key material 1, the message also carries the key material 2, and the key material 2 (such as NCC) is from the key material 1 The message i is signed by the key i to obtain the signature 2, and the message can carry the signature 2. If the source base station has data to send to the UE, the data is encrypted using the key b to obtain the data B, and the message carries the data B.
  • Step 806 The target base station sends a random access response to the UE, for example, sends a random access response message, the message carries the key material 2, can carry the signature 2, and can carry the encrypted data B.
  • the UE and the network have not enabled security, so the message No encryption protection.
  • Step 807 If the UE receives the key material 2, use the key material 2 to generate a new key material (such as K eNB *1), and use the new key material to update the key material in the UE context (such as with K eNB) *1 Update K eNB ), then generate a new signature key k and a new encryption/decryption key b with a new key material (such as K eNB *1), replace the key i with the key k, and replace the key with the key b a, the UE verifies the signature 2 using the key i, and decrypts the received data B using the key a.
  • a new key material such as K eNB *1
  • Step 808 The UE and the source base station implement bidirectional secure transmission of data by using the new key a through forwarding of the target base station.
  • FIG. 9 is a schematic diagram (8) of a secure transmission process of small data according to Embodiment 8 of the present application, where the process includes:
  • Step 901 The connection between the user equipment UE and the network is suspended by the source base station, and the UE and the source base station reserve the context of the UE, including security related information.
  • Step 902 The source base station receives the data to be sent to the UE, and sends a paging message to the UE through the target base station, for example, sending a Paging message, and the message passes through the target base station.
  • Step 903 The target base station forwards the paging message to the UE.
  • Step 904 The user equipment UE performs signature operation on the identifier of the UE or other information (the UE is to be transmitted to the base station or both the UE and the base station) according to the existing key in the context, and generates a signature 1 to send a random connection to the target base station.
  • the incoming request for example, initiates a random access preamble message, carries the identity information of the UE, and signature 1, and the UE and the network have not yet enabled security, so the message is not encrypted.
  • Step 905 The target base station finds the source base station of the UE according to the identifier information of the UE, and sends a UE context request to the source base station, for example, sends an X2 Retrieve UE Context Request message, and carries the identifier information of the UE and the signature 1.
  • Step 906 The source base station finds the context of the UE according to the identifier of the UE, verifies the signature 1 by using the existing key in the UE context, determines that the message is legal, and then derives a new key material 1 by using security related information in the context of the UE (for example If there is no NCC, K eNB is used to derive K eNB *1. If there is NCC, K eNB *1 is derived using NCC, and key material 1 contains K eNB *1, possibly including NCC), and the new key material is used.
  • Step 907 The source base station forwards data to be sent to the UE to the target base station.
  • Step 908 The target base station generates a new encryption/decryption key b and a new signature key i using information in the key material 1 (such as K eNB *1).
  • Step 909 The target base station sends a random access response to the UE, for example, sends a random access response message, uses the key i to sign the message content to obtain the signature 2, the message can carry the signature 2, and the key b is used to encrypt the data to obtain the data B, and the message can be carried.
  • Data B if there is an NCC in the key material 1, the message also carries the key material 2, and the key material 2 (such as NCC) comes from the key material 1, and the UE and the network have not yet enabled security, so the message is not encrypted.
  • Step 910 If the UE receives the key material 2, use the key material 2 to generate a new key material (such as K eNB *1), and use the new key material to update the key material in the UE context (such as with K eNB) *1 Update K eNB ), and then generate a new signature key i and a new encryption/decryption key b with a new key material (such as K eNB *1), the UE verifies the signature 2 using the key i, and decrypts the received using the key b Data B.
  • a new key material such as K eNB *1
  • Step 911 The UE and the target base station implement bidirectional secure transmission of data using the new key.
  • FIG. 10 is a schematic diagram (9) of a secure transmission process of small data according to Embodiment 9 of the present application, where the process includes:
  • Step 1001 The connection between the user equipment UE and the network is suspended by the source base station, and the UE and the source base station reserve the context of the UE, including security related information.
  • Step 1002 The source base station receives the data to be sent to the UE, and sends a paging message to the UE through the target base station, for example, sending a Paging message, and the message passes through the target base station;
  • Step 1003 The target base station forwards the paging message to the UE.
  • Step 1004 The user equipment UE performs signature operation on the identifier of the UE or other information (the UE is to be transmitted to the base station, or both the UE and the base station) according to the existing key in the context, and generates a signature 1 to send a random connection to the target base station.
  • the incoming request for example, initiates a random access preamble message, carries the identity information of the UE, and signature 1, and the UE and the network have not yet enabled security, so the message is not encrypted.
  • Step 1005 The target base station finds the source base station of the UE according to the identifier information of the UE, and sends a forwarding request to the source base station, for example, sending an X2 Forward Request message, carrying the identifier information of the UE, and carrying the signature 1.
  • Step 1006 The source base station finds the context of the UE according to the identifier of the UE, verifies the signature 1 by using the existing key in the UE context, determines that the message is legal, and then derives a new key material 1 by using security related information in the context of the UE (for example, If there is no NCC, K eNB *1 is derived using K eNB , if there is NCC, K eNB *1 is derived using NCC, and key material 1 contains K eNB *2, possibly including NCC), and the new key is used.
  • security related information for example, If there is no NCC, K eNB *1 is derived using K eNB , if there is NCC, K eNB *1 is derived using NCC, and key material 1 contains K eNB *2, possibly including NCC
  • Material 1 updates the key material information in the UE context (such as updating K eNB using K eNB *1), and then uses the information in key material 1 (such as K eNB *1) to generate a new encryption/decryption key b and a new signature secret.
  • K eNB *1 K eNB *1
  • Step 1007 The source base station sends a forwarding response to the target base station, for example, sending an X2 Forward Response message. If there is an NCC in the key material 1, the message carries the key material 2, and the key material 2 (such as NCC) is from the key material 1. The message content is signed by the key i to obtain the signature 2, the message can carry the signature 2, the data is encrypted using the key b to obtain the data B, and the message carries the data B.
  • NCC NCC
  • Step 1008 The target base station sends a random access response to the UE, for example, sends a random access response message, the message carries the key material 2, can carry the signature 2, and can carry the encrypted data B.
  • the UE and the network have not been enabled for security, so The message is not encrypted.
  • Step 1009 If the UE receives the key material 2, use the key material 2 to generate a new key material (such as K eNB *1), and use the new key material to update the key material in the UE context (such as with K eNB) *1 Update K eNB ), and then generate a new signature key i and a new encryption/decryption key b with a new key material (such as K eNB *1), the UE verifies the signature 2 using the key i, and decrypts the received using the key b Data B.
  • a new key material such as K eNB *1
  • Step 1010 The UE and the source base station implement bidirectional secure transmission of data by using the new key b by forwarding of the target base station.
  • FIG. 11 is a schematic diagram (10) of a secure transmission process of small data according to Embodiment 10 of the present application, where the process includes:
  • Step 1101 The connection between the user equipment UE and the network is suspended by the source base station, and the UE and the source base station reserve the context of the UE, including security related information.
  • Step 1102 The user equipment UE has data to send, and then generates a signature 1 by performing a signature operation on the identifier of the UE or other information (the UE is to be transmitted to the base station, or both the UE and the base station) according to the existing key in the context.
  • Sending a random access request to the target base station for example, initiating a random access preamble message, carrying the identity information of the UE, and signing 1, and the UE and the network have not been enabled for security, so the message is not encrypted.
  • Step 1103 The target base station finds the source base station of the UE according to the identifier information of the UE, and sends a forwarding request to the source base station, for example, sending an X2 Forward Request message, carrying the identifier information of the UE, and carrying the signature 1.
  • Step 1104 The source base station finds the context of the UE according to the identifier of the UE, verifies the signature 1 by using the existing key in the UE context, determines that the message is legal, and then derives a new key material 1 by using security related information in the context of the UE (for example, If there is no NCC, K eNB *1 is derived using K eNB , if there is NCC, K eNB *1 is derived using NCC, and key material 1 contains K eNB *2, possibly including NCC), and the new key is used.
  • security related information for example, If there is no NCC, K eNB *1 is derived using K eNB , if there is NCC, K eNB *1 is derived using NCC, and key material 1 contains K eNB *2, possibly including NCC
  • Material 1 updates the key material information in the UE context (such as updating K eNB using K eNB *1), and then uses the information in key material 1 (such as K eNB *1) to generate a new encryption/decryption key b and a new signature secret.
  • K eNB *1 K eNB *1
  • Step 1105 The source base station sends a forwarding response to the target base station, for example, sending an X2 Forward Response message. If there is an NCC in the key material 1, the message carries the key material 2, and the key material 2 (such as NCC) is from the key material 1, Signing the message content using the key i to obtain the signature 2, the message can carry the signature 2;
  • Step 1106 The target base station sends a random access response to the UE, for example, sends a random access response message, and the message carries the key material 2, which can carry the signature 2. At this time, the UE and the network have not been enabled with security, so the message is not encrypted.
  • Step 1107 If the UE receives the key material 2, use the key material 2 to generate a new key material (such as K eNB *1), and update the key material in the UE context with the new key material (such as with K eNB) *1 Update K eNB ), and then generate a new signature key i and a new encryption/decryption key b with a new key material (such as K eNB *1), and the UE verifies the signature 2 using the key i.
  • a new key material such as K eNB *1
  • Step 1108 The UE and the source base station use the new key b to implement bidirectional secure transmission of data through the forwarding of the target base station. It may be that the UE only uploads data, or the base station only transmits data or may transmit in both directions.
  • FIG. 12 is a flowchart of a method for securely transmitting small data of a mobile network according to an embodiment of the present application. As shown in FIG. 12, the foregoing method includes:
  • Step 1202 The first base station receives a first message from the user equipment UE, where the first message carries at least one of the first encrypted data and the first signature information.
  • the first base station receiving the first message from the user equipment UE includes: receiving the first encrypted data and the third signature information from the user equipment UE, or the first base station receives the first or second a message from the user equipment UE, where the third identifier information is carried, or the first base station receives a second message from the user equipment UE, where the first encrypted data is carried;
  • the first encrypted data is encrypted on the UE side according to the first key, and the first key is generated on the UE side according to the first key material, and the first key material is in the UE.
  • the side is generated according to the context;
  • the first signature information is generated according to a context on the UE side
  • Step 1204 The first base station performs one of the following operations:
  • receiving at least one of the second key material, the second signature information, and the second encrypted data from the second base station and forwarding to the UE comprises: receiving the second key material from the second base station Or receiving the second signature information from the second base station, or receiving the second encrypted data from the second base station and forwarding the data to the UE;
  • the second key material is generated on the second base station side according to the context of the UE;
  • the second signature information is generated on the second base station side according to the second key, and the second key is generated on the second base station side according to the third key material, and the third key material is in the The second base station side is generated according to the context of the UE;
  • the second encrypted data is encrypted according to the third key on the second base station side, and the third key is generated on the second base station side according to the third key material;
  • the second signature information is generated according to the fourth key, the fourth key is generated according to the second key material, and the second key material is generated on the first base station side according to the context of the UE;
  • the fourth key material is used in the context of the UE on the first base station side, and the fourth key material is used to generate a fifth key material on the UE side, the fifth key material And configured to generate a fifth key on the UE side;
  • the third encrypted data is encrypted according to a sixth key, the sixth key is generated based on a sixth key material, the sixth key material is from the second base station, and is based on the second base station side Context generation of the UE, or the sixth key material is generated on the first base station side according to the context of the UE.
  • the UE only needs 2 wireless messages to transmit data from the suspended state, and requires at most 4 wireless messages, so that the resource consumption of the UE is reduced, and the secure transmission of data is also ensured.
  • the method further includes:
  • the second key material is configured to generate the sixth key on the first base station side
  • the method further includes:
  • the sixth key is used to decrypt the first encrypted data.
  • the method further includes:
  • the second key material is used to generate a seventh key, and the seventh key is used to decrypt the first encrypted data.
  • the method before the receiving, by the first base station, the second signature information from the second base station, or the second encrypted data, the method further includes:
  • the first base station forwards the first encrypted data or the first signature information to the second base station.
  • the method further includes:
  • the method further includes:
  • the eighth key material is configured to generate an eighth key on the UE side, where the eighth key is used to check the second signature information or the third signature information on the UE side.
  • the method further includes:
  • the first base station receives the second message from the UE, and the first base station sends the second encrypted data or the location to the UE before receiving the third message from the UE.
  • the third encrypted data is described.
  • the method further includes:
  • the first key material is used to generate an eighth key on the UE side, where the eighth key is used to check the second signature information or the third signature information on the UE side.
  • a secure transmission method for another mobile network small data including the following steps:
  • Step 1 The second base station receives a message carrying the first encrypted data or the first signature information from the first base station;
  • the first encrypted data is received by the user equipment UE by the first base station, and the first encrypted data is encrypted according to the first key on the UE side, and the first key is first according to the UE side.
  • Key material generation the first key material being generated on the UE side based on a context;
  • the first signature information is received by the first base station from the UE, and the first signature information is generated according to a context on the UE side;
  • Step 2 The second base station sends at least one of the second signature information, the second key material, and the second encrypted data to the first base station.
  • the second signature information is used to be forwarded by the first base station to the UE, the second signature information is calculated according to a second key, and the second key is generated based on a fifth key material, where the The five-three key material is generated based on the context of the UE;
  • the second key material is used for forwarding by the first base station to the UE;
  • the second encrypted data is used for forwarding by the first base station to the UE, the second encrypted data is encrypted according to a third key, and the third key is generated based on the third key material;
  • the second base station receives the message from the first base station, and sends a fourth key material to the first base station, where the fourth key material is used to generate a fourth key and a fifth on the first base station side.
  • a key the fifth key is used to decrypt the first encrypted data on the first base station side, where the first encrypted data is received by the first base station side from the user equipment UE.
  • the method further includes:
  • the second base station encrypts the data sent to the UE by using the third key, and forwards the data to the UE by using the first base station;
  • the second base station decrypts the received encrypted data from the UE that is forwarded by the first base station.
  • the embodiment of the present application provides a secure transmission method for mobile network small data applied to a user equipment side, where the method includes the following steps:
  • Step S1 The user equipment UE carries the first encrypted data in the first message or the second message sent to the first base station, where the first encrypted data is encrypted according to the first key, and the first key is based on Generating a first key material, the first key material being generated based on a context;
  • the user equipment UE sends the first signature information and the first encrypted data to the first base station, where the first encrypted data is encrypted according to the first key, and the first key is generated according to the first key material, where the A key material is generated based on a context, and the first signature information is generated based on the context;
  • the user equipment UE sends the first signature information to the first base station, where the first signature information is generated based on the context;
  • Step S2 The UE receives second encrypted data from the first base station, the second encrypted data is decrypted according to the second key, and the second key is generated according to the second key material.
  • the method further includes:
  • the UE receives the second encrypted data from the first base station, and the second encrypted data is carried in a second message sent by the first base station to the UE.
  • the method further includes:
  • the second key is the same as the first key, and the second key material is the same as the first key material.
  • the method further includes:
  • the third key material is used to generate a fourth key material
  • the fourth key material is used to generate a third key
  • the second key is the same as the third key
  • the second key material is the same as the fourth key material.
  • the method further includes:
  • the UE receives second signature information from the first base station, the second signature information is used by the UE to verify according to a fourth key, and the fourth key is generated based on the fourth key material.
  • the method further includes:
  • the UE receives second signature information from the first base station, the second signature information is used by the UE to verify according to a fourth key, and the fourth key is generated based on the first key material.
  • the method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course, by hardware, but in many cases, the former is A better implementation.
  • the essential or contributing portion of the technical solution of the embodiments of the present application may be embodied in the form of a software product stored in a storage medium (such as a ROM/RAM, a disk, or a CD).
  • a storage medium such as a ROM/RAM, a disk, or a CD.
  • a secure transmission device for mobile network small data is also provided, which is applied to the first base station, and the device is used to implement the foregoing embodiments and preferred embodiments, and details are not described herein.
  • the term “module” may implement a combination of software and/or hardware of a predetermined function.
  • the devices described in the following embodiments may be implemented in software, hardware, or a combination of software and hardware, is also possible and contemplated.
  • FIG. 13 is a structural block diagram of a secure transmission apparatus for mobile network small data according to an embodiment of the present application. As shown in FIG. 13, the method includes:
  • the receiving module 1302 is configured to receive a first message from the user equipment UE, where the first message carries at least one of the first encrypted data and the first signature information.
  • receiving the first message from the user equipment UE comprises: receiving first encrypted data and third signature information from the user equipment UE, or the first base station receives the first or second one from the user equipment UE The message carrying the third signature information, or the first base station receives the second message from the user equipment UE, where the first encrypted data is carried;
  • the first encrypted data is encrypted on the UE side according to the first key, and the first key is generated on the UE side according to the first key material, and the first key material is in the UE.
  • the side is generated according to the context;
  • the first signature information is generated according to a context on the UE side
  • the processing module 1304 is configured to receive at least one of the second key material, the second signature information, and the second encrypted data from the second base station, and forward the message to the UE;
  • the second key material is generated on the second base station side according to the context of the UE;
  • the second signature information is generated on the second base station side according to the second key, and the second key is generated on the second base station side according to the third key material, and the third key material is in the The second base station side is generated according to the context of the UE;
  • the second encrypted data is encrypted according to the third key on the second base station side, and the third key is generated on the second base station side according to the third key material;
  • the sending module 1306 is configured to send at least one of the third signature information, the fourth key material, and the third encrypted data to the UE;
  • the third signature information is generated according to the fourth key, the fourth key is generated according to the second key material, and the second key material is generated on the first base station side according to the context of the UE;
  • the fourth key material is used in the context of the UE on the first base station side, and the fourth key material is used to generate a fifth key material on the UE side, the fifth key material And configured to generate a fifth key on the UE side;
  • the third encrypted data is encrypted according to a sixth key, the sixth key is generated based on a sixth key material, the sixth key material is from the second base station, and is based on the second base station side Context generation of the UE, or the sixth key material is generated on the first base station side according to the context of the UE.
  • the embodiment of the present application further provides a secure transmission device 14 for mobile network small data, which is applied to a user equipment UE, and the device 14 includes:
  • the processing module 1401 is configured to carry the first encrypted data in the first message sent to the first base station or in the second message, where the first encrypted data is encrypted according to the first key, and the first key is based on Generating a first key material, the first key material being generated based on a context;
  • the sending module 1402 is connected to the processing module, and configured to send at least one of the first signature information and the first encrypted data to the first base station, where the first encrypted data is encrypted according to the first key,
  • the first key is generated according to the first key material, the first key material is generated based on a context, and the first signature information is generated based on the context;
  • the receiving module 1403 is connected to the sending module 1402, configured to receive second encrypted data from the first base station, the second encrypted data is decrypted according to the second key, and the second key is based on the second key Material generation.
  • a secure transmission device for mobile network small data is further provided, which is applied to the second base station, and includes the following modules:
  • the first receiving module is configured to receive a message that carries the first encrypted data or the first signature information from the first base station;
  • the first encrypted data is received by the user equipment UE by the first base station, and the first encrypted data is encrypted according to the first key on the UE side, and the first key is first according to the UE side.
  • Key material generation the first key material being generated on the UE side based on a context;
  • the first signature information is received by the first base station from the UE, and the first signature information is generated according to a context on the UE side;
  • a sending module configured to send second signature information, or a second key material, or second encrypted data to the first base station
  • the second signature information is used to be forwarded by the first base station to the UE, the second signature information is generated according to a second key, and the second key is generated based on a third key material, where the The three key material is generated based on the context of the UE;
  • the second key material is used for forwarding by the first base station to the UE;
  • the second encrypted data is used for forwarding by the first base station to the UE, the second encrypted data is encrypted according to a third key, and the third key is generated based on the third key material;
  • a second receiving module configured to receive a message from the first base station, and send a fourth key material to the first base station, where the fourth key material is used to generate a fourth key and on the first base station side And a fifth key, where the fifth key is used to decrypt the first encrypted data on the first base station side, where the first encrypted data is received by the first base station side from the user equipment UE.
  • the embodiment of the present application also provides a storage medium.
  • the foregoing storage medium may be used to save the program code executed by the secure transmission method of the mobile network small data provided in the first embodiment.
  • the foregoing storage medium may be located in any one of the computer user equipment groups in the computer network, or in any one of the mobile user equipment groups. .
  • the disclosed technical contents may be implemented in other manners.
  • the device embodiments described above are only schematic.
  • the division of the unit is only a logical function division.
  • there may be another division manner for example, multiple units or components may be combined or may be Integrate into another system, or some features can be ignored or not executed.
  • the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, unit or module, and may be electrical or otherwise.
  • the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to implement the solution of the embodiments of the present application.
  • a plurality of functional units in various embodiments of the present application may be integrated into one processing unit, or one unit may exist physically separately, or two or more units may be integrated into one unit.
  • the above integrated unit can be implemented in the form of hardware or in the form of a software functional unit.
  • the integrated unit if implemented in the form of a software functional unit and sold or used as a standalone product, may be stored in a computer readable storage medium.
  • the technical solution of the present invention which is essential or contributes to the prior art, or all or part of the technical solution, may be embodied in the form of a software product stored in a storage medium.
  • a number of instructions are included to cause a computer device (which may be a personal computer, server or network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present invention.
  • the foregoing storage medium includes a medium that can store program codes, such as a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk, or an optical disk.
  • the method and device for securely transmitting mobile network small data provided by the present disclosure reduce resource consumption of user equipment.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

一种移动网络小数据的安全传输方法及装置，其中，所述方法包括：第一基站接收来自用户设备UE的第一消息，所述第一消息携带第一加密数据和第一签名信息中的至少一者；所述第一基站执行以下之一操作：收到来自第二基站的第二密钥材料第二签名信息和第二加密数据中的至少一者并转发给UE；所述第二密钥材料在所述第二基站侧依据所述UE的上下文生成；或，向所述UE发送第三签名信息，或第四密钥材料，或第三加密数据中的至少一者。

Description

移动网络小数据的安全传输方法及装置 技术领域
本公开涉及通信领域，例如涉及一种移动网络小数据的安全传输方法及装置。
背景技术
第三代合作伙伴计划(3rd Generation Partnership Project，3GPP)提出了一种小数据的安全传输方法，如图1所示：
步骤101：用户设备UE与网络的连接被源基站挂起，UE和源基站保留了UE的上下文，其中包括安全相关的信息。
步骤102：用户设备UE在连接被挂起后的某个时刻有数据要发送，于是选择要接入的基站——目标基站，向目标基站发送随机接入请求，比如发起随机接入前导(random access preamble)消息。
步骤103：目标基站向UE发送随机接入响应，比如发送随机接入响应(random access response)消息。
步骤104：UE向目标基站发送连接恢复请求，比如发送无线资源控制协议(Radio Resource Control，RRC)连接恢复请求(Connection Resume Request)消息，UE使用上下文中已有的密钥对消息中的内容进行签名运算得到签名1，消息携带UE的标识信息和签名1，此时UE和网络尚未启用安全，因此消息没有加密保护。
步骤105：目标基站根据UE的标识信息找到UE的源基站，向源基站发送UE上下文请求，比如发送X2检索用户设备上下文请求(Retrieve UE Context Request)消息，携带UE的标识信息和签名1。
步骤106：源基站验证签名1，判断消息合法，于是使用UE上下文中的安全相关信息派生新的密钥材料1，比如K eNB*以及可选的下一跳链数值(Next-hop Chain Count，NCC)，然后向目标基站发送UE上下文响应，比如发送X2检索用户设备上下文响应(Retrieve UE Context Response)消息，携带密钥材料1。
步骤107：目标基站根据密钥材料1生成新的密钥，然后向UE发送连接恢复消息，比如发送RRC连接恢复(Connection Resume)消息，消息使用新的密钥进行签名生成签名2，消息携带签名2，还可能携带密钥材料2，密钥材料2来自密钥材料1，比如NCC，此时UE和网络尚未启用安全，因此消息没有加密保护。
步骤108：UE根据上下文中的安全相关信息以及接收到的密钥材料2生成新密钥，该新密钥与网络使用的新密钥相同，然后向目标基站发送连接恢复完成消息，比如发送RRC连接恢复完成(Connection Resume Complete)消息，消息携带要发送的数据，此时UE和网络启用安全，因此消息使用新密钥进行了签名和加密。
步骤109：UE和目标基站使用新密钥实现数据的双向安全传输。
可以看出，在相关技术中UE要从挂起状态下发送数据，需要进行5个无线消息(UE和基站间)的交互，对UE的资源消耗比较大。
发明内容
本公开提出一种移动网络小数据的安全传输方法及装置，可以解决相关技术中存在的上述问题。
本公开提供一种移动网络小数据的安全传输方法，应用于第一基站，所述方法包括：
第一基站接收来自用户设备UE的第一消息，所述第一消息携带第一加密数据和第一签名信息中的至少一者；
其中，所述第一加密数据在所述UE侧依据第一密钥加密，所述第一密钥在所述UE侧依据第一密钥材料生成，所述第一密钥材料在所述UE侧依据上下文生成；
所述第一签名信息在所述UE侧依据上下文生成；
所述第一基站执行以下之一操作：
接收来自第二基站的第二密钥材料、第二签名信息和第二加密数据中的至少一者并转发给UE；
其中所述第二密钥材料在所述第二基站侧依据所述UE的上下文生成；
所述第二签名信息在所述第二基站侧依据第二密钥生成，所述第二密钥在所述第二基站侧依据第三密钥材料生成，所述第三密钥材料在所述第二基站侧依据所述UE的上下文生成；
所述第二加密数据在所述第二基站侧依据第三密钥加密，所述第三密钥在所述第二基站侧依据所述第三密钥材料生成；
或，
所述第一基站向所述UE发送第三签名信息、第四密钥材料和第三加密数据中的至少一者；
其中，所述第三签名信息依据第四密钥生成，所述第四密钥依据第二密钥材料生成，所述第二密钥材料在所述第一基站侧依据所述UE的上下文生成；
所述第四密钥材料在所述第一基站侧的所述UE的上下文中，所述第四密钥材料用于在所述UE侧生成第五密钥材料，所述第五密钥材料用于在所述UE侧生成第五密钥；
所述第三加密数据依据第六密钥加密，所述第六密钥基于第六密钥材料生成，所述第六密钥材料来自所述第二基站并在所述第二基站侧基于所述UE的上下文生成，或所述第六密钥材料在所述第一基站侧依据所述UE的上下文生成。
在一可选地实施例中，所述第二密钥材料用于在所述第一基站侧生成所述第六密钥；
在一可选地实施例中，所述第六密钥用于解密所述第一加密数据。
在一可选地实施例中，所述第二密钥材料用于生成第七密钥，所述第七密钥用于解密所述第一加密数据。
在一可选地实施例中，所述第一基站接收来自所述第二基站的所述第二签名信息或所述第二加密数据前，还包括：
所述第一基站向所述第二基站转发所述第一加密数据或所述第一签名信息。
在一可选地实施例中，还包括：
所述第一基站向所述UE发送第七密钥材料，其中，所述第七密钥材料来自所述第二密钥材料，所述第七密钥材料用于在所述UE侧生成第八密钥材料，所 述第八密钥材料用于在所述UE侧生成所述第五密钥。
在一可选地实施例中，所述第八密钥材料用于在所述UE侧生成第八密钥，所述第八密钥用于在所述UE侧校验所述第二签名信息或所述第三签名信息。
在一可选地实施例中，还包括：
所述第一基站接收来自所述UE的所述第一消息前，向所述UE发送所述第二加密数据或所述第三加密数据。
在一可选地实施例中，所述第一密钥材料用于在所述UE侧生成第八密钥，所述第八密钥用于在所述UE侧校验所述第二签名信息或所述第三签名信息。
本公开还提供一种移动网络小数据的安全传输方法，应用于第二基站，所述方法包括：
第二基站接收来自第一基站的携带第一加密数据或第一签名信息的消息；
其中，所述第一加密数据由所述第一基站接收自用户设备UE，所述第一加密数据在所述UE侧依据第一密钥加密，所述第一密钥在所述UE侧依据第一密钥材料生成，所述第一密钥材料在所述UE侧基于上下文生成；
所述第一签名信息由所述第一基站接收自所述UE，所述第一签名信息在所述UE侧依据上下文生成；
所述第二基站向所述第一基站发送第二签名信息、第二密钥材料和第二加密数据中的至少一者；
所述第二签名信息用于由所述第一基站转发给所述UE，所述第二签名信息依据第二密钥生成，所述第二密钥基于第三密钥材料生成，所述第三密钥材料基于所述UE的上下文生成；
所述第二密钥材料用于由所述第一基站转发给所述UE；
所述第二加密数据用于由所述第一基站转发给所述UE，所述第二加密数据依据第三密钥加密，所述第三密钥基于所述第三密钥材料生成；
或，第二基站接收来自第一基站的消息，向所述第一基站发送第四密钥材料，所述第四密钥材料用于在所述第一基站侧生成第四密钥和第五密钥，所述第五密钥用于在所述第一基站侧解密第一加密数据，所述第一加密数据由第一基站侧接收自用户设备UE。
在一可选地实施例中，第二基站接收来自第一基站的携带第一加密数据的消息后，所述方法还包括：
所述第二基站使用所述第三密钥加密发送给所述UE的数据，并通过所述第一基站转发给所述UE；
或者，所述第二基站解密接收的通过所述第一基站转发的来自所述UE的加密数据。
本公开还提供一种移动网络小数据的安全传输方法，应用于用户设备UE，所述方法包括以下之一：
用户设备UE在向第一基站发送的第一条消息中或第二条消息中携带第一加密数据，所述第一加密数据依据第一密钥加密，所述第一密钥基于第一密钥材料生成，所述第一密钥材料基于上下文生成；
或，用户设备UE向第一基站发送第一签名信息和第一加密数据，所述第一加密数据依据第一密钥加密，所述第一密钥依据第一密钥材料生成，所述第一密钥材料基于上下文生成，所述第一签名信息基于所述上下文生成；
或，用户设备UE向第一基站发送第一签名信息，所述第一签名信息基于上下文生成；
所述UE接收来自第一基站的第二加密数据，所述第二加密数据依据第二密钥解密，所述第二密钥依据第二密钥材料生成。
在一可选地实施例中，所述UE接收来自第一基站的第二加密数据，所述第二加密数据在所述第一基站发送给所述UE的第二条消息中携带。
在一可选地实施例中，还包括：
所述第二密钥与所述第一密钥相同，所述第二密钥材料与所述第一密钥材料相同。
在一可选地实施例中，还包括：
所述UE接收来自所述第一基站的第三密钥材料，所述第三密钥材料用于生成第四密钥材料，所述第四密钥材料用于生成第三密钥，所述第二密钥与所述第三密钥相同，所述第二密钥材料与所述第四密钥材料相同。
在一可选地实施例中，还包括：
所述UE接收来自所述第一基站的第二签名信息，所述第二签名信息用于所述UE依据第四密钥验证，所述第四密钥基于所述第四密钥材料生成。
在一可选地实施例中，还包括：
所述UE接收来自所述第一基站的第二签名信息，所述第二签名信息用于所述UE依据第四密钥验证，所述第四密钥基于所述第一密钥材料生成。
本公开还提供一种移动网络小数据的安全传输装置，应用于第一基站，包括：
接收模块，设置为接收到来自用户设备UE的第一消息，所述第一消息携带第一加密数据和第三签名信息中的至少一者；
其中，所述第一加密数据在所述UE侧依据第一密钥加密，所述第一密钥在所述UE侧依据第一密钥材料生成，所述第一密钥材料在所述UE侧依据上下文生成；
所述第一签名信息在所述UE侧依据上下文生成；
处理模块，设置为接收来自第二基站的第二密钥材料、第二签名信息和第二加密数据中的至少一者并转发给UE；
所述第二密钥材料在所述第二基站侧依据所述UE的上下文生成；
所述第二签名信息在所述第二基站侧依据第二密钥生成，所述第二密钥在所述第二基站侧依据第三密钥材料生成，所述第三密钥材料在所述第二基站侧依据所述UE的上下文生成；
所述第二加密数据在所述第二基站侧依据第三密钥加密，所述第三密钥在所述第二基站侧依据所述第三密钥材料生成；
或，
发送模块，设置为向所述UE发送第三签名信息、第四密钥材料和第三加密数据中的至少一者；
其中，所述第三签名信息依据第四密钥生成，所述第四密钥依据第二密钥材料生成，所述第二密钥材料在所述第一基站侧依据所述UE的上下文生成；
所述第四密钥材料在所述第一基站侧的所述UE的上下文中，所述第四密钥材料用于在所述UE侧生成第五密钥材料，所述第五密钥材料用于在所述UE侧生 成第五密钥；
所述第三加密数据依据第六密钥加密，所述第六密钥基于第六密钥材料生成，所述第六密钥材料来自所述第二基站并在所述第二基站侧基于所述UE的上下文生成，或所述第六密钥材料在所述第一基站侧依据所述UE的上下文生成。
本公开还提供一种移动网络小数据的安全传输装置，应用于用户设备UE，包括以下之一：
处理模块，设置为在向第一基站发送的第一条消息中或第二条消息中携带第一加密数据，所述第一加密数据依据第一密钥加密，所述第一密钥基于第一密钥材料生成，所述第一密钥材料基于上下文生成；
或，发送模块，设置为向第一基站发送第一签名信息和第一加密数据中的至少一者，所述第一加密数据依据第一密钥加密，所述第一密钥依据第一密钥材料生成，所述第一密钥材料基于上下文生成，所述第一签名信息基于所述上下文生成；
接收模块，设置为接收来自第一基站的第二加密数据，所述第二加密数据依据第二密钥解密，所述第二密钥依据第二密钥材料生成。
本公开还提供了一种计算机程序产品，所述计算机程序产品包括存储在非暂态计算机可读存储介质上的计算机程序，所述计算机程序包括程序指令，当所述程序指令被计算机执行时，使所述计算机执行上述任意一种方法。
在本公开中，还提供了一种计算机存储介质，该计算机存储介质可以存储有执行指令，该执行指令用于执行上述实施例中的移动网络小数据的安全传输方法。
通过本公开提供的小数据的安全传输方法及装置，UE从挂起状态下传输数据最少只需2条无线消息，最多需要4条无线消息，使得UE的资源消耗减少了，同时还保证了数据的安全传输。
附图说明
图1为相关技术的小数据的安全传输流程示意图。
图2为实施例一的小数据的安全传输流程示意图(一)。
图3为实施例二的小数据的安全传输流程示意图(二)。
图4为实施例三的小数据的安全传输流程示意图(三)。
图5为实施例四的小数据的安全传输流程示意图(四)。
图6为实施例五的小数据的安全传输流程示意图(五)。
图7为实施例六的小数据的安全传输流程示意图(六)。
图8为实施例七的小数据的安全传输流程示意图(七)。
图9为施例八的小数据的安全传输流程示意图(八)。
图10为实施例九的小数据的安全传输流程示意图(九)。
图11为实施例十的小数据的安全传输流程示意图(十)。
图12为一实施例的移动网络小数据的安全传输方法的流程图。
图13为一实施例的移动网络小数据的安全传输装置的结构框图。
图14为一实施例的另一种移动网络小数据的安全传输装置的结构框图。
具体实施方式
下面结合附图和实施例对本申请实施例作进一步说明。需要说明的是，在不冲突的情况下，本申请中的实施例及实施例中的特征可以相互组合。
本申请的说明书和权利要求书及上述附图中的术语“第一”、“第二”等是用于区别类似的对象，而不用于描述特定的顺序或先后次序。应该理解这样使用的数据在适当情况下可以互换，以便这里描述的实施例能够以除了在这里图示或描述的那些以外的顺序实施。此外，术语“包括”和“具有”以及他们的任何变形，意图在于覆盖不排他的包含。
图2是本申请实施例一的小数据的安全传输流程示意图(一)，该流程包括：
步骤201：用户设备UE与网络的连接被源基站挂起，UE和源基站保留了UE的上下文，其中包括安全相关的信息。
步骤202：用户设备UE在连接被挂起后的某个时刻有数据要发送，首先根据上下文中已有的密钥对UE的标识或其他信息(UE要传给基站的，或UE和基站都有的)进行签名操作生成签名1，其次选择要接入的基站——目标基站，并根据上下文中的安全相关信息(比如K eNB)生成新密钥材料(比如K eNB*)，使用该新密钥材料更新UE上下文中的密钥材料信息(比如K eNB)，然后基于新密钥材料生成新的签名密钥i和加解密密钥a，使用密钥a对要发送的数据进行加密得到数据A，最后向目标基站发送随机接入请求，比如发起random access preamble消息，携带UE的标识信息，签名1，和加密的数据A，此时UE和网络尚未启用安全，因此消息没有加密保护。
步骤203：目标基站根据UE的标识信息找到UE的源基站，向源基站发送转发请求，比如发送X2 Forward Request消息，携带UE的标识信息和加密的数据A，可携带签名1。
步骤204：源基站根据UE的标识找到UE的上下文，使用UE上下文中的已有的密钥验证签名1，判断消息合法，于是使用UE上下文中的安全相关信息派生新的密钥材料(比如K eNB*)，使用该新密钥材料更新UE上下文中的密钥材料信息(比如K eNB)，然后基于新的密钥材料生成新的签名密钥i和加解密密钥a，并使用密钥a对数据A进行解密。
步骤205：源基站向目标基站发送转发响应，比如发送X2 Forward Response消息，使用密钥i对消息内容进行签名得到签名2，消息可携带签名2，如果源基站有数据要发送给UE，则该数据使用密钥a进行加密得到数据B，消息携带数据B。
步骤206：目标基站向UE发送随机接入响应，比如发送random access response消息，消息可携带签名2，可携带加密的数据B，此时UE和网络尚未启用安全，因此消息没有加密保护。
步骤207：UE使用密钥i验证签名2，使用密钥a解密收到的数据B。
步骤208：UE和源基站通过目标基站的转发使用新密钥a实现数据的双向安全传输。
图3是本申请实施例二的小数据的安全传输流程示意图(二)，该流程包括：
步骤301：用户设备UE与网络的连接被源基站挂起，UE和源基站保留了UE的上下文，其中包括安全相关的信息。
步骤302：用户设备UE在连接被挂起后的某个时刻有数据要发送，首先根据上下文中已有的密钥对UE的标识或其他信息(UE要传给基站的，或UE和基站都有的)进行签名操作生成签名1，其次选择要接入的基站——目标基站，并根据上下文中的安全相关信息(比如K eNB)生成新密钥材料(比如K eNB*2)，使用 该新密钥材料更新UE上下文中的密钥材料信息(比如K eNB)，然后基于新密钥材料生成新签名密钥i和加解密密钥a，使用密钥a对要发送的数据进行加密得到数据A，最后向目标基站发送随机接入请求，比如发起random access preamble消息，携带UE的标识信息，签名1，和加密的数据A，此时UE和网络尚未启用安全，因此消息没有加密保护。
步骤303：目标基站向根据UE的标识信息找到UE的源基站，向源基站发送UE上下文请求，比如发送X2 Retrieve UE Context Request消息，携带UE的标识信息和签名1。
步骤304：源基站根据UE的标识找到UE的上下文，使用UE上下文中的已有的密钥验证签名1，判断消息合法，于是使用UE上下文中的安全相关信息派生新的密钥材料1(比如使用K eNB派生出K eNB*2，如果有NCC，则使用NCC派生出K eNB*1，密钥材料1包含K eNB*2，可能包含K eNB*1和NCC)，使用该新密钥材料1更新UE上下文中的密钥材料信息(比如没有K eNB*1时使用K eNB*2更新K eNB，有K eNB*1时使用K eNB*1更新K eNB)，然后向目标基站发送UE上下文响应，比如发送X2 Retrieve UE Context Response消息，携带密钥材料1。
步骤305：目标基站使用密钥材料1中的信息(比如K eNB*2)生成新加解密密钥a，使用密钥a解密数据A，如果密钥材料1中没有K eNB*1，则使用K eNB*2生成新签名密钥i，如果有K eNB*1，则使用K eNB*1生成新签名密钥i和加解密密钥b，并用密钥b替换密钥a。
步骤306：目标基站向UE发送随机接入响应，比如发送random access response消息，消息使用密钥i签名得到签名2，消息可携带签名2，如果目标基站有数据要发送，则使用密钥b加密数据得到数据B，消息可携带数据B，如果密钥材料1中有NCC，则消息还携带密钥材料2，密钥材料2(比如NCC)来自密钥材料1，此时UE和网络尚未启用安全，因此消息没有加密保护。
步骤307：如果UE收到密钥材料2，则使用密钥材料2生成新密钥材料(比如K eNB*1)，并使用新密钥材料更新UE上下文中的密钥材料(比如用K eNB*1更新K eNB)，然后用新密钥材料(比如K eNB*1)生成新签名密钥k和新加解密密钥b，并用密钥k替换密钥i，用密钥b替换密钥a，UE使用密钥i验证签名2，使用密钥a解密收到的数据B。
步骤308：UE和目标基站使用新密钥实现数据的双向安全传输。
图4是本申请实施例三的小数据的安全传输流程示意图(三)，该流程包括：
步骤401：用户设备UE与网络的连接被源基站挂起，UE和源基站保留了UE的上下文，其中包括安全相关的信息。
步骤402：用户设备UE在连接被挂起后的某个时刻有数据要发送，于是选择要接入的基站——目标基站，向目标基站发送随机接入请求，比如发起random access preamble消息，消息可携带UE的标识，UE可以根据上下文中已有的密钥对UE的标识或其他信息(UE要传给基站的，或UE和基站都有的)进行签名操作生成签名1，并在消息中携带签名1。
步骤403：目标基站向UE发送随机接入响应，比如发送random access response消息。
步骤404：UE可以首先根据上下文中已有的密钥对UE的标识或其他信息(UE要传给基站的，或UE和基站都有的)进行签名操作生成签名1，其次根据上下 文中的安全相关信息(比如K eNB)生成新密钥材料(比如K eNB*2)，使用该新密钥材料更新UE上下文中的密钥材料信息(比如K eNB)，然后基于新密钥材料生成新签名密钥i和加解密密钥a，使用密钥a对要发送的数据进行加密得到数据A，最后向目标基站发送连接恢复请求，比如发送RRC Connection Resume Request消息，消息可以携带UE的标识信息，可以携带签名1，携带加密的数据A，此时UE和网络尚未启用安全，因此消息没有加密保护。
步骤405：目标基站向根据UE的标识信息找到UE的源基站，向源基站发送UE上下文请求，比如发送X2 Retrieve UE Context Request消息，携带UE的标识信息和签名1。
步骤406：源基站根据UE的标识找到UE的上下文，使用UE上下文中的已有的密钥验证签名1，判断消息合法，于是使用UE上下文中的安全相关信息派生新的密钥材料1(比如使用K eNB派生出K eNB*2，如果有NCC，则使用NCC派生出K eNB*1，密钥材料1包含K eNB*2，可能包含K eNB*1和NCC)，使用该新密钥材料1更新UE上下文中的密钥材料信息(比如没有K eNB*1时使用K eNB*2更新K eNB，有K eNB*1时使用K eNB*1更新K eNB)，然后向目标基站发送UE上下文响应，比如发送X2 Retrieve UE Context Response消息，携带密钥材料1。
步骤407：目标基站使用密钥材料1中的信息(比如K eNB*2)生成新加解密密钥a，使用密钥a解密数据A，如果密钥材料1中没有K eNB*1，则使用K eNB*2生成新签名密钥i，如果有K eNB*1，则使用K eNB*1生成新签名密钥i和加解密密钥b，并用密钥b替换密钥a。
步骤408：目标基站向UE发送连接恢复消息，比如发送RRC Connection Resume消息，消息使用密钥i签名得到签名2，消息可携带签名2，如果目标基站有数据要发送，则使用密钥b加密数据得到数据B，消息可携带数据B，如果密钥材料1中有NCC，则消息还携带密钥材料2，密钥材料2(比如NCC)来自密钥材料1，此时UE和网络尚未启用安全，因此消息没有加密保护。
步骤409：如果UE收到密钥材料2，则使用密钥材料2生成新密钥材料(比如K eNB*1)，并使用新密钥材料更新UE上下文中的密钥材料(比如用K eNB*1更新K eNB)，然后用新密钥材料(比如K eNB*1)生成新签名密钥k和新加解密密钥b，并用密钥k替换密钥i，用密钥b替换密钥a，UE使用密钥i验证签名2，使用密钥a解密收到的数据B。
步骤410：UE和目标基站使用新密钥实现数据的双向安全传输。
图5是本申请实施例四的小数据的安全传输流程示意图(四)，该流程包括：
步骤501：用户设备UE与网络的连接被基站挂起，UE和基站保留了UE的上下文，其中包括安全相关的信息。
步骤502：用户设备UE在连接被挂起后的某个时刻有数据要发送，首先根据上下文中已有的密钥对UE的标识或其他信息(UE要传给基站的，或UE和基站都有的)进行签名操作生成签名1，其次选择要接入的基站——步骤501中的基站，并根据上下文中的安全相关信息(比如K eNB)生成新密钥材料(比如K eNB*)，使用该新密钥材料更新UE上下文中的密钥材料信息(比如K eNB)，然后基于新密钥材料生成新的签名密钥i和加解密密钥a，使用密钥a对要发送的数据进行加密得到数据A，最后向基站发送随机接入请求，比如发起random access preamble消息，携带UE的标识信息，签名1，和加密的数据A，此时UE和网络尚未启用 安全，因此消息没有加密保护。
步骤503：基站根据UE的标识找到UE的上下文，使用UE上下文中的已有的密钥验证签名1，判断消息合法，于是使用UE上下文中的安全相关信息派生新的密钥材料(比如K eNB*)，使用该新密钥材料更新UE上下文中的密钥材料信息(比如K eNB)，然后基于新的密钥材料(比如K eNB*)生成新的签名密钥i和加解密密钥a，并使用密钥a对数据A进行解密。
步骤504：基站向UE发送随机接入响应，比如发送random access response消息，使用密钥i对消息内容进行签名得到签名2，消息可携带签名2，如果基站有数据要发送给UE，则消息携带该数据，数据使用密钥a进行加密得到数据B，此时UE和网络尚未启用安全，因此消息没有加密保护。
步骤505：UE使用密钥i验证签名2，使用密钥a解密收到的数据B。
步骤506：UE和基站使用新密钥a实现数据的双向安全传输。
图6是本申请实施例五的小数据的安全传输流程示意图(五)，该流程包括：
步骤601：用户设备UE与网络的连接被基站挂起，UE和基站保留了UE的上下文，其中包括安全相关的信息。
步骤602：用户设备UE在连接被挂起后的某个时刻有数据要发送，首先根据上下文中已有的密钥对UE的标识或其他信息(UE要传给基站的，或UE和基站都有的)进行签名操作生成签名1，其次选择要接入的基站——步骤601中的基站，并根据上下文中的安全相关信息(比如K eNB)生成新密钥材料(比如K eNB*2)，使用该新密钥材料更新UE上下文中的密钥材料信息(比如K eNB)，然后基于新密钥材料(比如K eNB*)生成新签名密钥i和加解密密钥a，使用密钥a对要发送的数据进行加密得到数据A，最后向目标基站发送随机接入请求，比如发起random access preamble消息，携带UE的标识信息，签名1，和加密的数据A，此时UE和网络尚未启用安全，因此消息没有加密保护。
步骤603：基站根据UE的标识找到UE的上下文，使用UE上下文中的已有的密钥验证签名1，判断消息合法，于是使用UE上下文中的安全相关信息派生新的密钥材料1(比如使用K eNB派生出K eNB*2，如果有NCC，则使用NCC派生出K eNB*1，密钥材料1包含K eNB*2，可能包含K eNB*1和NCC)，使用该新密钥材料1更新UE上下文中的密钥材料信息(比如没有K eNB*1时使用K eNB*2更新K eNB，有K eNB*1时使用K eNB*1更新K eNB)，然后使用密钥材料1中的信息(比如K eNB*2)生成新加解密密钥a，使用密钥a解密数据A，如果密钥材料1中没有K eNB*1，则使用K eNB*2生成新签名密钥i，如果有K eNB*1，则使用K eNB*1生成新签名密钥i和加解密密钥b，并用密钥b替换密钥a。
步骤604：基站向UE发送随机接入响应，比如发送random access response消息，消息使用密钥i签名得到签名2，消息可携带签名2，如果基站有数据要发送，则使用密钥b加密数据得到数据B，消息可携带数据B，如果密钥材料1中有NCC，则消息还携带密钥材料2，密钥材料2(比如NCC)来自密钥材料1，此时UE和网络尚未启用安全，因此消息没有加密保护。
步骤605：如果UE收到密钥材料2，则使用密钥材料2生成新密钥材料(比如K eNB*1)，并使用新密钥材料更新UE上下文中的密钥材料(比如用K eNB*1更新K eNB)，然后用新密钥材料(比如K eNB*1)生成新签名密钥k和新加解密密钥b，并用密钥k替换密钥i，用密钥b替换密钥a，UE使用密钥i验证签名2，使用 密钥a解密收到的数据B。
步骤606：UE和基站使用新密钥实现数据的双向安全传输。
图7是本申请实施例六的小数据的安全传输流程示意图(六)，该流程包括：
步骤701：用户设备UE与网络的连接被基站挂起，UE和基站保留了UE的上下文，其中包括安全相关的信息。
步骤702：用户设备UE在连接被挂起后的某个时刻有数据要发送，于是选择要接入的基站——步骤701中的基站，向基站发送随机接入请求，比如发起random access preamble消息。
步骤703：基站向UE发送随机接入响应，比如发送random access response消息。
步骤704：UE首先根据上下文中已有的密钥对UE的标识或其他信息(UE要传给基站的，或UE和基站都有的)进行签名操作生成签名1，其次根据上下文中的安全相关信息(比如K eNB)生成新密钥材料(比如K eNB*2)，使用该新密钥材料更新UE上下文中的密钥材料信息(比如K eNB)，然后基于新密钥材料生成新签名密钥i和加解密密钥a，使用密钥a对要发送的数据进行加密得到数据A，最后向目标基站发送连接恢复请求，比如发送RRC Connection Resume Request消息，携带UE的标识信息，签名1，和加密的数据A，此时UE和网络尚未启用安全，因此消息没有加密保护。
步骤705：基站根据UE的标识找到UE的上下文，使用UE上下文中的已有的密钥验证签名1，判断消息合法，于是使用UE上下文中的安全相关信息派生新的密钥材料1(比如使用K eNB派生出K eNB*2，如果有NCC，则使用NCC派生出K eNB*1，密钥材料1包含K eNB*2，可能包含K eNB*1和NCC)，使用该新密钥材料1更新UE上下文中的密钥材料信息(比如没有K eNB*1时使用K eNB*2更新K eNB，有K eNB*1时使用K eNB*1更新K eNB)，然后使用密钥材料1中的信息(比如K eNB*2)生成新加解密密钥a，使用密钥a解密数据A，如果密钥材料1中没有K eNB*1，则使用K eNB*2生成新签名密钥i，如果有K eNB*1，则使用K eNB*1生成新签名密钥i和加解密密钥b，并用密钥b替换密钥 a。
步骤706：基站向UE发送连接恢复消息，比如发送RRC Connection Resume消息，消息使用密钥i签名得到签名2，消息可携带签名2，如果基站有数据要发送，则使用密钥b加密数据得到数据B，消息可携带数据B，如果密钥材料1中有NCC，则消息还携带密钥材料2，密钥材料2(比如NCC)来自密钥材料1，此时UE和网络尚未启用安全，因此消息没有加密保护。
步骤707：如果UE收到密钥材料2，则使用密钥材料2生成新密钥材料(比如K eNB*1)，并使用新密钥材料更新UE上下文中的密钥材料(比如用K eNB*1更新K eNB)，然后用新密钥材料(比如K eNB*1)生成新签名密钥k和新加解密密钥b，并用密钥k替换密钥i，用密钥b替换密钥a，UE使用密钥i验证签名2，使用密钥a解密收到的数据B。
步骤708：UE和基站使用新密钥实现数据的双向安全传输。
图8是本申请实施例七的小数据的安全传输流程示意图(七)，该流程包括：
步骤801：用户设备UE与网络的连接被源基站挂起，UE和源基站保留了UE的上下文，其中包括安全相关的信息。
步骤802：用户设备UE在连接被挂起后的某个时刻有数据要发送，首先根 据上下文中已有的密钥对UE的标识或其他信息(UE要传给基站的，或UE和基站都有的)进行签名操作生成签名1，其次选择要接入的基站——目标基站，并根据上下文中的安全相关信息(比如K eNB)生成新密钥材料(比如K eNB*)，使用该新密钥材料更新UE上下文中的密钥材料信息(比如K eNB)，然后基于新密钥材料生成新的签名密钥i和加解密密钥a，使用密钥a对要发送的数据进行加密得到数据A，最后向目标基站发送随机接入请求，比如发起random access preamble消息，携带UE的标识信息，签名1，和加密的数据A，此时UE和网络尚未启用安全，因此消息没有加密保护。
步骤803：目标基站向根据UE的标识信息找到UE的源基站，向源基站发送转发请求，比如发送X2 Forward Request消息，携带UE的标识信息和加密的数据A，可携带签名1。
步骤804：源基站根据UE的标识找到UE的上下文，使用UE上下文中的已有的密钥验证签名1，判断消息合法，于是使用UE上下文中的安全相关信息派生新的密钥材料1(比如使用K eNB派生出K eNB*2，如果有NCC，则使用NCC派生出K eNB*1，密钥材料1包含K eNB*2，可能包含K eNB*1和NCC)，使用该新密钥材料1更新UE上下文中的密钥材料信息(比如没有K eNB*1时使用K eNB*2更新K eNB，有K eNB*1时使用K eNB*1更新K eNB)，然后使用密钥材料1中的信息(比如K eNB*2)生成新加解密密钥a，使用密钥a解密数据A，如果密钥材料1中没有K eNB*1，则使用K eNB*2生成新签名密钥i，如果有K eNB*1，则使用K eNB*1生成新签名密钥i和加解密密钥b，并用密钥b替换密钥a。
步骤805：源基站向目标基站发送转发响应，比如发送X2 Forward Response消息，如果密钥材料1中有NCC，则消息还携带密钥材料2，密钥材料2(比如NCC)来自密钥材料1，使用密钥i对消息内容进行签名得到签名2，消息可携带签名2，如果源基站有数据要发送给UE，则该数据使用密钥b进行加密得到数据B，消息携带数据B。
步骤806：目标基站向UE发送随机接入响应，比如发送random access response消息，消息携带密钥材料2，可携带签名2，可携带加密的数据B，此时UE和网络尚未启用安全，因此消息没有加密保护。
步骤807：如果UE收到密钥材料2，则使用密钥材料2生成新密钥材料(比如K eNB*1)，并使用新密钥材料更新UE上下文中的密钥材料(比如用K eNB*1更新K eNB)，然后用新密钥材料(比如K eNB*1)生成新签名密钥k和新加解密密钥b，并用密钥k替换密钥i，用密钥b替换密钥a，UE使用密钥i验证签名2，使用密钥a解密收到的数据B。
步骤808：UE和源基站通过目标基站的转发使用新密钥a实现数据的双向安全传输。
图9是本申请实施例八的小数据的安全传输流程示意图(八)，该流程包括：
步骤901：用户设备UE与网络的连接被源基站挂起，UE和源基站保留了UE的上下文，其中包括安全相关的信息。
步骤902：源基站收到要发送给UE的数据，通过目标基站向UE发送寻呼消息，比如发送Paging消息，消息途经目标基站；
步骤903：目标基站转发寻呼消息给UE；
步骤904：用户设备UE根据上下文中已有的密钥对UE的标识或其他信息(UE 要传给基站的，或UE和基站都有的)进行签名操作生成签名1，向目标基站发送随机接入请求，比如发起random access preamble消息，携带UE的标识信息，签名1，此时UE和网络尚未启用安全，因此消息没有加密保护。
步骤905：目标基站向根据UE的标识信息找到UE的源基站，向源基站发送UE上下文请求，比如发送X2 Retrieve UE Context Request消息，携带UE的标识信息和签名1。
步骤906：源基站根据UE的标识找到UE的上下文，使用UE上下文中的已有的密钥验证签名1，判断消息合法，于是使用UE上下文中的安全相关信息派生新的密钥材料1(比如，如果没有NCC则使用K eNB派生出K eNB*1，如果有NCC，则使用NCC派生出K eNB*1，密钥材料1包含K eNB*1，可能包含NCC)，使用该新密钥材料1更新UE上下文中的密钥材料信息(比如使用K eNB*1更新K eNB)，然后向目标基站发送UE上下文响应，比如发送X2 Retrieve UE Context Response消息，携带密钥材料1；
步骤907：源基站将要发送给UE的数据转发给目标基站；
步骤908：目标基站使用密钥材料1中的信息(比如K eNB*1)生成新加解密密钥b和新签名密钥i。
步骤909：目标基站向UE发送随机接入响应，比如发送random access response消息，使用密钥i签名消息内容得到签名2，消息可携带签名2，使用密钥b加密数据得到数据B，消息可携带数据B，如果密钥材料1中有NCC，则消息还携带密钥材料2，密钥材料2(比如NCC)来自密钥材料1，此时UE和网络尚未启用安全，因此消息没有加密保护。
步骤910：如果UE收到密钥材料2，则使用密钥材料2生成新密钥材料(比如K eNB*1)，并使用新密钥材料更新UE上下文中的密钥材料(比如用K eNB*1更新K eNB)，然后用新密钥材料(比如K eNB*1)生成新签名密钥i和新加解密密钥b，UE使用密钥i验证签名2，使用密钥b解密收到的数据B。
步骤911：UE和目标基站使用新密钥实现数据的双向安全传输。
图10是本申请实施例九的小数据的安全传输流程示意图(九)，该流程包括：
步骤1001：用户设备UE与网络的连接被源基站挂起，UE和源基站保留了UE的上下文，其中包括安全相关的信息。
步骤1002：源基站收到要发送给UE的数据，通过目标基站向UE发送寻呼消息，比如发送Paging消息，消息途经目标基站；
步骤1003：目标基站转发寻呼消息给UE；
步骤1004：用户设备UE根据上下文中已有的密钥对UE的标识或其他信息(UE要传给基站的，或UE和基站都有的)进行签名操作生成签名1，向目标基站发送随机接入请求，比如发起random access preamble消息，携带UE的标识信息，签名1，此时UE和网络尚未启用安全，因此消息没有加密保护。
步骤1005：目标基站向根据UE的标识信息找到UE的源基站，向源基站发送转发请求，比如发送X2 Forward Request消息，携带UE的标识信息，可携带签名1。
步骤1006：源基站根据UE的标识找到UE的上下文，使用UE上下文中的已有的密钥验证签名1，判断消息合法，于是使用UE上下文中的安全相关信息派 生新的密钥材料1(比如，如果没有NCC，则使用K eNB派生出K eNB*1，如果有NCC，则使用NCC派生出K eNB*1，密钥材料1包含K eNB*2，可能包含NCC)，使用该新密钥材料1更新UE上下文中的密钥材料信息(比如使用K eNB*1更新K eNB)，然后使用密钥材料1中的信息(比如K eNB*1)生成新加解密密钥b和新签名密钥i。
步骤1007：源基站向目标基站发送转发响应，比如发送X2 Forward Response消息，如果密钥材料1中有NCC，则消息携带密钥材料2，密钥材料2(比如NCC)来自密钥材料1，使用密钥i对消息内容进行签名得到签名2，消息可携带签名2，数据使用密钥b进行加密得到数据B，消息携带数据B。
步骤1008：目标基站向UE发送随机接入响应，比如发送random access response消息，消息携带可密钥材料2，可携带签名2，可携带加密的数据B，此时UE和网络尚未启用安全，因此消息没有加密保护。
步骤1009：如果UE收到密钥材料2，则使用密钥材料2生成新密钥材料(比如K eNB*1)，并使用新密钥材料更新UE上下文中的密钥材料(比如用K eNB*1更新K eNB)，然后用新密钥材料(比如K eNB*1)生成新签名密钥i和新加解密密钥b，UE使用密钥i验证签名2，使用密钥b解密收到的数据B。
步骤1010：UE和源基站通过目标基站的转发使用新密钥b实现数据的双向安全传输。
图11是本申请实施例十的小数据的安全传输流程示意图(十)，该流程包括：
步骤1101：用户设备UE与网络的连接被源基站挂起，UE和源基站保留了UE的上下文，其中包括安全相关的信息。
步骤1102：用户设备UE有数据要发送，于是根据上下文中已有的密钥对UE的标识或其他信息(UE要传给基站的，或UE和基站都有的)进行签名操作生成签名1，向目标基站发送随机接入请求，比如发起random access preamble消息，携带UE的标识信息，签名1，此时UE和网络尚未启用安全，因此消息没有加密保护；
步骤1103：目标基站向根据UE的标识信息找到UE的源基站，向源基站发送转发请求，比如发送X2 Forward Request消息，携带UE的标识信息，可携带签名1。
步骤1104：源基站根据UE的标识找到UE的上下文，使用UE上下文中的已有的密钥验证签名1，判断消息合法，于是使用UE上下文中的安全相关信息派生新的密钥材料1(比如，如果没有NCC，则使用K eNB派生出K eNB*1，如果有NCC，则使用NCC派生出K eNB*1，密钥材料1包含K eNB*2，可能包含NCC)，使用该新密钥材料1更新UE上下文中的密钥材料信息(比如使用K eNB*1更新K eNB)，然后使用密钥材料1中的信息(比如K eNB*1)生成新加解密密钥b和新签名密钥i。
步骤1105：源基站向目标基站发送转发响应，比如发送X2 Forward Response消息，如果密钥材料1中有NCC，则消息携带密钥材料2，密钥材料2(比如NCC)来自密钥材料1，使用密钥i对消息内容进行签名得到签名2，消息可携带签名2；
步骤1106：目标基站向UE发送随机接入响应，比如发送random access response消息，消息携带可密钥材料2，可携带签名2，此时UE和网络尚未启用安全，因此消息没有加密保护。
步骤1107：如果UE收到密钥材料2，则使用密钥材料2生成新密钥材料(比如K eNB*1)，并使用新密钥材料更新UE上下文中的密钥材料(比如用K eNB*1更新K eNB)，然后用新密钥材料(比如K eNB*1)生成新签名密钥i和新加解密密钥b，UE使用密钥i验证签名2。
步骤1108：UE和源基站通过目标基站的转发使用新密钥b实现数据的双向安全传输，有可能是UE只上传数据，也可能是基站只下传数据，也可能是双向传输。
图12为本申请实施例的移动网络小数据的安全传输方法的流程图，如图12所示，上述方法包括：
步骤1202：第一基站接收来自用户设备UE的第一消息，所述第一消息携带第一加密数据和第一签名信息中的至少一者。
在一实施例中，第一基站收到来自用户设备UE的第一消息包括：接收来自用户设备UE的第一加密数据和第三签名信息，或第一基站收到第一条或第二条来自用户设备UE的消息，其中携带第三签名信息，或第一基站收到第二条来自用户设备UE的消息，其中携带第一加密数据；
其中，所述第一加密数据在所述UE侧依据第一密钥加密，所述第一密钥在所述UE侧依据第一密钥材料生成，所述第一密钥材料在所述UE侧依据上下文生成；
所述第一签名信息在所述UE侧依据上下文生成；
步骤1204：所述第一基站执行以下之一操作：
接收来自第二基站的第二密钥材料、第二签名信息和第二加密数据中的至少一者并转发给UE；
在一实施例中，接收来自第二基站的第二密钥材料、第二签名信息和第二加密数据中的至少一者并转发给UE包括：收到来自第二基站的第二密钥材料，或收到来自第二基站的第二签名信息，或收到来自第二基站的第二加密数据并转发给UE；
所述第二密钥材料在所述第二基站侧依据所述UE的上下文生成；
所述第二签名信息在所述第二基站侧依据第二密钥生成，所述第二密钥在所述第二基站侧依据第三密钥材料生成，所述第三密钥材料在所述第二基站侧依据所述UE的上下文生成；
所述第二加密数据在所述第二基站侧依据第三密钥加密，所述第三密钥在所述第二基站侧依据所述第三密钥材料生成；
或，
所述第一基站向所述UE发送第三签名信息、第四密钥材料和第三加密数据中的至少一者；
所述第二签名信息依据第四密钥生成，所述第四密钥依据第二密钥材料生成，所述第二密钥材料在所述第一基站侧依据所述UE的上下文生成；
所述第四密钥材料在所述第一基站侧的所述UE的上下文中，所述第四密钥材料用于在所述UE侧生成第五密钥材料，所述第五密钥材料用于在所述UE侧生成第五密钥；
所述第三加密数据依据第六密钥加密，所述第六密钥基于第六密钥材料生成，所述第六密钥材料来自所述第二基站并在所述第二基站侧基于所述UE的上 下文生成，或所述第六密钥材料在所述第一基站侧依据所述UE的上下文生成。
通过上述步骤，UE从挂起状态下传输数据最少只需2条无线消息，最多需要4条无线消息，使得UE的资源消耗减少了，同时还保证了数据的安全传输。在一可选地实施例中，所述方法还包括：
所述第二密钥材料用于在所述第一基站侧生成所述第六密钥；
在一可选地实施例中，所述方法还包括：
所述第六密钥用于解密所述第一加密数据。
在一可选地实施例中，所述方法还包括：
所述第二密钥材料用于生成第七密钥，所述第七密钥用于解密所述第一加密数据。
在一可选地实施例中，所述第一基站接收来自第二基站的所述第二签名信息，或第二加密数据前，还包括：
所述第一基站向所述第二基站转发所述第一加密数据或所述第一签名信息。
在一可选地实施例中，所述方法还包括：
所述第一基站向所述UE发送第七密钥材料，所述第七密钥材料来自所述第二密钥材料，所述第七密钥材料用于在所述UE侧生成第八密钥材料，所述第八密钥材料用于在所述UE侧生成所述第五密钥。
在一可选地实施例中，所述方法还包括：
所述第八密钥材料用于在所述UE侧生成第八密钥，所述第八密钥用于在所述UE侧校验所述第二签名信息或所述第三签名信息。
在一可选地实施例中，所述方法还包括：
所述第一基站接收所述第二条来自所述UE的消息，所述第一基站在收到第三条来自所述UE的消息前，向所述UE发送所述第二加密数据或所述第三加密数据。
在一可选地实施例中，所述方法还包括：
所述第一密钥材料用于在所述UE侧生成第八密钥，所述第八密钥用于在所述UE侧校验所述第二签名信息或所述第三签名信息。
在本申请实施例中，还提供又一移动网络小数据的安全传输方法，包括以下步骤：
步骤一，第二基站接收来自第一基站的携带第一加密数据或第一签名信息的消息；
所述第一加密数据由所述第一基站接收自用户设备UE，所述第一加密数据在所述UE侧依据第一密钥加密，所述第一密钥在所述UE侧依据第一密钥材料生成，所述第一密钥材料在所述UE侧基于上下文生成；
所述第一签名信息由所述第一基站接收自所述UE，所述第一签名信息在所述UE侧依据上下文生成；
步骤二，所述第二基站向所述第一基站发送第二签名信息、第二密钥材料和第二加密数据中的至少一者；
所述第二签名信息用于由所述第一基站转发给所述UE，所述第二签名信息依据第二密钥计算，所述第二密钥基于第五密钥材料生成，所述第五三钥材料基于所述UE的上下文生成；
所述第二密钥材料用于由所述第一基站转发给所述UE；
所述第二加密数据用于由所述第一基站转发给所述UE，所述第二加密数据依据第三密钥加密，所述第三密钥基于所述第三密钥材料生成；
或，第二基站接收来自第一基站的消息，向所述第一基站发送第四密钥材料，所述第四密钥材料用于在所述第一基站侧生成第四密钥和第五密钥，所述第五密钥用于在所述第一基站侧解密第一加密数据，所述第一加密数据由第一基站侧接收自用户设备UE。
在一可选地实施例中，第二基站接收来自第一基站的携带第一加密数据的消息后，所述方法还包括：
所述第二基站使用所述第三密钥加密发送给所述UE的数据，并通过所述第一基站转发给所述UE；
或者，所述第二基站解密接收的通过所述第一基站转发的来自所述UE的加密数据。
本申请实施例提供一种应用于用户设备侧的移动网络小数据的安全传输方法，所述方法包括以下步骤：
步骤S1，用户设备UE在向第一基站发送的第一条消息中或第二条消息中携带第一加密数据，所述第一加密数据依据第一密钥加密，所述第一密钥基于第一密钥材料生成，所述第一密钥材料基于上下文生成；
或，用户设备UE向第一基站发送第一签名信息和第一加密数据，所述第一加密数据依据第一密钥加密，所述第一密钥依据第一密钥材料生成，所述第一密钥材料基于上下文生成，所述第一签名信息基于所述上下文生成；
或，用户设备UE向第一基站发送第一签名信息，所述第一签名信息基于上下文生成；
步骤S2，所述UE接收来自第一基站的第二加密数据，所述第二加密数据依据第二密钥解密，所述第二密钥依据第二密钥材料生成。
在一可选地实施例中，所述方法还包括：
所述UE收到来自第一基站的第二加密数据，所述第二加密数据在所述第一基站发送给所述UE的第二条消息中携带。
在一可选地实施例中，所述方法还包括：
所述第二密钥与所述第一密钥相同，所述第二密钥材料与所述第一密钥材料相同。
在一可选地实施例中，所述方法还包括：
所述UE接收来自所述第一基站的第三密钥材料，所述第三密钥材料用于生成第四密钥材料，所述第四密钥材料用于生成第三密钥，所述第二密钥与所述第三密钥相同，所述第二密钥材料与所述第四密钥材料相同。
在一可选地实施例中，所述方法还包括：
所述UE接收来自所述第一基站的第二签名信息，所述第二签名信息用于所述UE依据第四密钥验证，所述第四密钥基于所述第四密钥材料生成。
在一可选地实施例中，所述方法还包括：
所述UE接收来自所述第一基站的第二签名信息，所述第二签名信息用于所述UE依据第四密钥验证，所述第四密钥基于所述第一密钥材料生成。
通过以上的实施方式的描述，本领域的技术人员可以清楚地了解到根据上 述实施例的方法可借助软件加必需的通用硬件平台的方式来实现，当然也可以通过硬件，但很多情况下前者是更佳的实施方式。基于这样的理解，本申请实施例的技术方案本质上或者说做出贡献的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质(如ROM/RAM、磁碟、光盘)中，包括若干指令用以使得一台用户设备设备(可以是手机，计算机，服务器，或者网络设备等)执行本申请每个实施例的方法。
在本实施例中还提供了一种移动网络小数据的安全传输装置，应用于第一基站，该装置用于实现上述实施例及优选实施方式，已经进行过说明的不再赘述。如以下所使用的，术语“模块”可以实现预定功能的软件和/或硬件的组合。尽管以下实施例所描述的装置可以以软件来实现，但是硬件，或者软件和硬件的组合的实现也是可能并被构想的。
图13是本申请实施例提供的移动网络小数据的安全传输装置的结构框图，如图13所示，包括：
接收模块1302，设置为接收来自用户设备UE的第一消息，所述第一消息携带第一加密数据和第一签名信息中的至少一者。
在一实施例中，接收来自用户设备UE的第一消息包括：接收来自用户设备UE的第一加密数据和第三签名信息，或第一基站收到第一条或第二条来自用户设备UE的消息，其中携带第三签名信息，或第一基站收到第二条来自用户设备UE的消息，其中携带第一加密数据；
其中，所述第一加密数据在所述UE侧依据第一密钥加密，所述第一密钥在所述UE侧依据第一密钥材料生成，所述第一密钥材料在所述UE侧依据上下文生成；
所述第一签名信息在所述UE侧依据上下文生成；
处理模块1304，设置为接收来自第二基站的第二密钥材料、第二签名信息和第二加密数据中的至少一者并转发给UE；
所述第二密钥材料在所述第二基站侧依据所述UE的上下文生成；
所述第二签名信息在所述第二基站侧依据第二密钥生成，所述第二密钥在所述第二基站侧依据第三密钥材料生成，所述第三密钥材料在所述第二基站侧依据所述UE的上下文生成；
所述第二加密数据在所述第二基站侧依据第三密钥加密，所述第三密钥在所述第二基站侧依据所述第三密钥材料生成；
或，
发送模块1306，设置为向所述UE发送第三签名信息、第四密钥材料和第三加密数据中的至少一者；
所述第三签名信息依据第四密钥生成，所述第四密钥依据第二密钥材料生成，所述第二密钥材料在所述第一基站侧依据所述UE的上下文生成；
所述第四密钥材料在所述第一基站侧的所述UE的上下文中，所述第四密钥材料用于在所述UE侧生成第五密钥材料，所述第五密钥材料用于在所述UE侧生成第五密钥；
所述第三加密数据依据第六密钥加密，所述第六密钥基于第六密钥材料生成，所述第六密钥材料来自所述第二基站并在所述第二基站侧基于所述UE的上下文生成，或所述第六密钥材料在所述第一基站侧依据所述UE的上下文生成。
本申请实施例中还提供了一种移动网络小数据的安全传输装置14，应用于用户设备UE，所述装置14包括：
处理模块1401，设置为在向第一基站发送的第一条消息中或第二条消息中携带第一加密数据，所述第一加密数据依据第一密钥加密，所述第一密钥基于第一密钥材料生成，所述第一密钥材料基于上下文生成；
或，发送模块1402，与所述处理模块连接，设置为向第一基站发送第一签名信息和第一加密数据中的至少一者，所述第一加密数据依据第一密钥加密，所述第一密钥依据第一密钥材料生成，所述第一密钥材料基于上下文生成，所述第一签名信息基于所述上下文生成；
接收模块1403，与所述发送模块1402连接，设置为收到来自第一基站的第二加密数据，所述第二加密数据依据第二密钥解密，所述第二密钥依据第二密钥材料生成。
在本申请实施例中，又提供了一移动网络小数据的安全传输装置，应用于第二基站，包括以下模块：
第一接收模块，设置为收到来自第一基站的携带第一加密数据或第一签名信息的消息；
所述第一加密数据由所述第一基站接收自用户设备UE，所述第一加密数据在所述UE侧依据第一密钥加密，所述第一密钥在所述UE侧依据第一密钥材料生成，所述第一密钥材料在所述UE侧基于上下文生成；
所述第一签名信息由所述第一基站接收自所述UE，所述第一签名信息在所述UE侧依据上下文生成；
发送模块，设置为向所述第一基站发送第二签名信息，或第二密钥材料，或第二加密数据；
所述第二签名信息用于由所述第一基站转发给所述UE，所述第二签名信息依据第二密钥生成，所述第二密钥基于第三密钥材料生成，所述第三密钥材料基于所述UE的上下文生成；
所述第二密钥材料用于由所述第一基站转发给所述UE；
所述第二加密数据用于由所述第一基站转发给所述UE，所述第二加密数据依据第三密钥加密，所述第三密钥基于所述第三密钥材料生成；
第二接收模块，设置为接收来自第一基站的消息，向所述第一基站发送第四密钥材料，所述第四密钥材料用于在所述第一基站侧生成第四密钥和第五密钥，所述第五密钥用于在所述第一基站侧解密第一加密数据，所述第一加密数据由第一基站侧接收自用户设备UE。
可见，通过采用上述方案，就能够实现少量的消息交互就能够实现数据的安全传输，减少了UE和网络的信令消耗。
本申请实施例还提供了一种存储介质。在一可选地实施例中，上述存储介质可以用于保存上述实施例一所提供的移动网络小数据的安全传输方法所执行的程序代码。
在一可选地实施例中，在本实施例中，上述存储介质可以位于计算机网络中计算机用户设备群中的任意一个计算机用户设备中，或者位于移动用户设备群中的任意一个移动用户设备中。
上述本申请实施例序号仅仅为了描述，不代表实施例的优劣。
在本申请的上述实施例中，对每个实施例的描述都有侧重，某个实施例中没有详述的部分，可以参见其他实施例的相关描述。
在本申请所提供的几个实施例中，应该理解到，所揭露的技术内容，可通过其它的方式实现。其中，以上所描述的装置实施例仅是示意性的，例如所述单元的划分，仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，单元或模块的间接耦合或通信连接，可以是电性或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本申请实施例的方案。
另外，在本申请各个实施例中的多个功能单元可以集成在一个处理单元中，也可以是一个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
所述集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本发明的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的全部或部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可为个人计算机、服务器或者网络设备等)执行本发明各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、移动硬盘、磁碟或者光盘等可以存储程序代码的介质。
以上所述仅为本发明的优选实施例而已，并不用于限制本发明，对于本领域的技术人员来说，本发明可以有各种更改和变化。
工业实用性
本公开提供的移动网络小数据的安全传输方法及装置，减少了用户设备的资源消耗。

Claims (20)

  1. 一种移动网络小数据的安全传输方法，应用于第一基站，所述方法包括：
    第一基站接收来自用户设备UE的第一消息，所述第一消息携带第一加密数据和第一签名信息中的至少一者；
    其中，所述第一加密数据在所述UE侧依据第一密钥加密，所述第一密钥在所述UE侧依据第一密钥材料生成，所述第一密钥材料在所述UE侧依据上下文生成；
    所述第一签名信息在所述UE侧依据上下文生成；
    所述第一基站执行以下之一操作：
    接收来自第二基站的第二密钥材料、第二签名信息和第二加密数据中的至少一者并转发给UE；
    其中所述第二密钥材料在所述第二基站侧依据所述UE的上下文生成；
    所述第二签名信息在所述第二基站侧依据第二密钥生成，所述第二密钥在所述第二基站侧依据第三密钥材料生成，所述第三密钥材料在所述第二基站侧依据所述UE的上下文生成；
    所述第二加密数据在所述第二基站侧依据第三密钥加密，所述第三密钥在所述第二基站侧依据所述第三密钥材料生成；
    或，
    所述第一基站向所述UE发送第三签名信息、第四密钥材料和第三加密数据中的至少一者；
    其中，所述第三签名信息依据第四密钥生成，所述第四密钥依据第二密钥材料生成，所述第二密钥材料在所述第一基站侧依据所述UE的上下文生成；
    所述第四密钥材料在所述第一基站侧的所述UE的上下文中，所述第四密钥材料用于在所述UE侧生成第五密钥材料，所述第五密钥材料用于在所述UE侧生成第五密钥；
    所述第三加密数据依据第六密钥加密，所述第六密钥基于第六密钥材料生成，所述第六密钥材料来自所述第二基站并在所述第二基站侧基于所述UE的上下文生成，或所述第六密钥材料在所述第一基站侧依据所述UE的上下文生成。
  2. 根据权利要求1所述的方法，其中：
    所述第二密钥材料用于在所述第一基站侧生成所述第六密钥。
  3. 根据权利要求2所述的方法，其中：
    所述第六密钥用于解密所述第一加密数据。
  4. 根据权利要求2所述的方法，其中：
    所述第二密钥材料用于生成第七密钥，所述第七密钥用于解密所述第一加密数据。
  5. 根据权利要求1所述的方法，其中，所述第一基站接收来自所述第二基站的所述第二签名信息或所述第二加密数据前，还包括：
    所述第一基站向所述第二基站转发所述第一加密数据或所述第一签名信息。
  6. 根据权利要求1所述的方法，还包括：
    所述第一基站向所述UE发送第七密钥材料，其中，所述第七密钥材料来自所述第二密钥材料，所述第七密钥材料用于在所述UE侧生成第八密钥材料，所述第八密钥材料用于在所述UE侧生成所述第五密钥。
  7. 根据权利要求6所述的方法，其中：
    所述第八密钥材料用于在所述UE侧生成第八密钥，所述第八密钥用于在所述UE侧校验所述第二签名信息或所述第三签名信息。
  8. 根据权利要求1所述的方法，还包括：
    所述第一基站接收来自所述UE的所述第一消息前，向所述UE发送所述第二加密数据或所述第三加密数据。
  9. 根据权利要求1所述的方法，其中：
    所述第一密钥材料用于在所述UE侧生成第八密钥，所述第八密钥用于在所述UE侧校验所述第二签名信息或所述第三签名信息。
  10. 一种移动网络小数据的安全传输方法，应用于第二基站，所述方法包括：
    第二基站接收来自第一基站的携带第一加密数据或第一签名信息的消息；
    其中，所述第一加密数据由所述第一基站接收自用户设备UE，所述第一加密数据在所述UE侧依据第一密钥加密，所述第一密钥在所述UE侧依据第一密钥材料生成，所述第一密钥材料在所述UE侧基于上下文生成；
    所述第一签名信息由所述第一基站接收自所述UE，所述第一签名信息在所述UE侧依据上下文生成；
    所述第二基站向所述第一基站发送第二签名信息、第二密钥材料和第二加密数据中的至少一者；
    所述第二签名信息用于由所述第一基站转发给所述UE，所述第二签名信息依据第二密钥生成，所述第二密钥基于第三密钥材料生成，所述第三密钥材料基于所述UE的上下文生成；
    所述第二密钥材料用于由所述第一基站转发给所述UE；
    所述第二加密数据用于由所述第一基站转发给所述UE，所述第二加密数据依据第三密钥加密，所述第三密钥基于所述第三密钥材料生成；
    或，第二基站接收来自第一基站的消息，向所述第一基站发送第四密钥材料，所述第四密钥材料用于在所述第一基站侧生成第四密钥和第五密钥，所述第五密钥用于在所述第一基站侧解密第一加密数据，所述第一加密数据由第一基站侧接收自用户设备UE。
  11. 根据权利要求10所述的方法，其中，第二基站接收来自第一基站的携带第一加密数据的消息后，所述方法还包括：
    所述第二基站使用所述第三密钥加密发送给所述UE的数据，并通过所述第一基站转发给所述UE；
    或者，所述第二基站解密接收的通过所述第一基站转发的来自所述UE的加密数据。
  12. 一种移动网络小数据的安全传输方法，应用于用户设备UE，所述方法包括以下之一：
    用户设备UE在向第一基站发送的第一条消息中或第二条消息中携带第一加密数据，所述第一加密数据依据第一密钥加密，所述第一密钥基于第一密钥材料生成，所述第一密钥材料基于上下文生成；
    或，用户设备UE向第一基站发送第一签名信息和第一加密数据，所述第一加密数据依据第一密钥加密，所述第一密钥依据第一密钥材料生成，所述第一密钥材料基于上下文生成，所述第一签名信息基于所述上下文生成；
    或，用户设备UE向第一基站发送第一签名信息，所述第一签名信息基于上下文生成；
    所述UE接收来自第一基站的第二加密数据，所述第二加密数据依据第二密钥解密，所述第二密钥依据第二密钥材料生成。
  13. 根据权利要求12所述的方法，还包括：
    所述UE接收来自第一基站的第二加密数据，所述第二加密数据在所述第一基站发送给所述UE的第二条消息中携带。
  14. 根据权利要求12所述的方法，还包括：
    所述第二密钥与所述第一密钥相同，所述第二密钥材料与所述第一密钥材料相同。
  15. 根据权利要求12所述的方法，还包括：
    所述UE接收来自所述第一基站的第三密钥材料，所述第三密钥材料用于生成第四密钥材料，所述第四密钥材料用于生成第三密钥，所述第二密钥与所述第三密钥相同，所述第二密钥材料与所述第四密钥材料相同。
  16. 根据权利要求15所述的方法，还包括：
    所述UE接收来自所述第一基站的第二签名信息，所述第二签名信息用于所述UE依据第四密钥验证，所述第四密钥基于所述第四密钥材料生成。
  17. 根据权利要求12所述的方法，还包括：
    所述UE接收来自所述第一基站的第二签名信息，所述第二签名信息用于所述UE依据第四密钥验证，所述第四密钥基于所述第一密钥材料生成。
  18. 一种移动网络小数据的安全传输装置，应用于第一基站，包括：
    接收模块，设置为接收到来自用户设备UE的第一消息，所述第一消息携带第一加密数据和第三签名信息中的至少一者；
    其中，所述第一加密数据在所述UE侧依据第一密钥加密，所述第一密钥在所述UE侧依据第一密钥材料生成，所述第一密钥材料在所述UE侧依据上下文生成；
    所述第一签名信息在所述UE侧依据上下文生成；
    处理模块，设置为接收来自第二基站的第二密钥材料、第二签名信息和第二加密数据中的至少一者并转发给UE；
    所述第二密钥材料在所述第二基站侧依据所述UE的上下文生成；
    所述第二签名信息在所述第二基站侧依据第二密钥生成，所述第二密钥在所述第二基站侧依据第三密钥材料生成，所述第三密钥材料在所述第二基站侧依据所述UE的上下文生成；
    所述第二加密数据在所述第二基站侧依据第三密钥加密，所述第三密钥在所述第二基站侧依据所述第三密钥材料生成；
    或，
    发送模块，设置为向所述UE发送第三签名信息、第四密钥材料和第三加密数据中的至少一者；
    其中，所述第三签名信息依据第四密钥生成，所述第四密钥依据第二密钥材料生成，所述第二密钥材料在所述第一基站侧依据所述UE的上下文生成；
    所述第四密钥材料在所述第一基站侧的所述UE的上下文中，所述第四密钥材料用于在所述UE侧生成第五密钥材料，所述第五密钥材料用于在所述UE侧 生成第五密钥；
    所述第三加密数据依据第六密钥加密，所述第六密钥基于第六密钥材料生成，所述第六密钥材料来自所述第二基站并在所述第二基站侧基于所述UE的上下文生成，或所述第六密钥材料在所述第一基站侧依据所述UE的上下文生成。
  19. 一种移动网络小数据的安全传输装置，应用于用户设备UE，包括以下之一：
    处理模块，设置为在向第一基站发送的第一条消息中或第二条消息中携带第一加密数据，所述第一加密数据依据第一密钥加密，所述第一密钥基于第一密钥材料生成，所述第一密钥材料基于上下文生成；
    或，发送模块，设置为向第一基站发送第一签名信息和第一加密数据中的至少一者，所述第一加密数据依据第一密钥加密，所述第一密钥依据第一密钥材料生成，所述第一密钥材料基于上下文生成，所述第一签名信息基于所述上下文生成；
    接收模块，设置为接收来自第一基站的第二加密数据，所述第二加密数据依据第二密钥解密，所述第二密钥依据第二密钥材料生成。
  20. 一种计算机可读存储介质，存储有计算机可执行指令，所述计算机可执行指令用于执行权利要求1-17任一项的方法。
PCT/CN2018/073830 2017-01-25 2018-01-23 移动网络小数据的安全传输方法及装置 WO2018137617A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201710056695.9 2017-01-25
CN201710056695.9A CN108347726A (zh) 2017-01-25 2017-01-25 移动网络小数据的安全传输方法及装置

Publications (1)

Publication Number Publication Date
WO2018137617A1 true WO2018137617A1 (zh) 2018-08-02

Family

ID=62961823

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/073830 WO2018137617A1 (zh) 2017-01-25 2018-01-23 移动网络小数据的安全传输方法及装置

Country Status (2)

Country Link
CN (1) CN108347726A (zh)
WO (1) WO2018137617A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US11903079B2 (en) 2020-04-28 2024-02-13 Apple Inc. Framework for supporting custom signaling between a wireless device and a cellular network

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP3979763A4 (en) * 2019-07-04 2022-06-29 Guangdong Oppo Mobile Telecommunications Corp., Ltd. Data transmission method and apparatus, and communication device

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101228766A (zh) * 2005-04-15 2008-07-23 斯比德航海有限公司 密钥材料的交换
CN104144524A (zh) * 2013-05-08 2014-11-12 电信科学技术研究院 一种小数据传输方法和演进基站及用户终端
WO2015018074A1 (en) * 2013-08-09 2015-02-12 Nokia Solutions And Networks Oy Methods and apparatus

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101228766A (zh) * 2005-04-15 2008-07-23 斯比德航海有限公司 密钥材料的交换
CN104144524A (zh) * 2013-05-08 2014-11-12 电信科学技术研究院 一种小数据传输方法和演进基站及用户终端
WO2015018074A1 (en) * 2013-08-09 2015-02-12 Nokia Solutions And Networks Oy Methods and apparatus

Non-Patent Citations (2)

* Cited by examiner, † Cited by third party
Title
ERICSSON: "Baseline solution for small data transmission in RRC_INACTIVE", 3GPP TSG-RAN WG2 #96 TDOC R2-168713, vol. 3, no. 4, 13 November 2016 (2016-11-13), pages 1, 2, XP051178263, Retrieved from the Internet <URL:http://www.3gpp.org/ftp/Meetings_3GPP_SYNC/RAN2/Docs> *
ERICSSON: "Report of email discussion: [96#31][NR] UL data in inactive solu- tion B", 3GPP TSG-RAN WG2 NR ADHOC MEETING, R2-1700626, vol. 3, no. 4, 17 January 2017 (2017-01-17), pages 1 - 3, XP051211205, Retrieved from the Internet <URL:http://www.3gpp.org/ftp/Meetings_3GPP_SYNC/RAN2/Docs> *

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US11903079B2 (en) 2020-04-28 2024-02-13 Apple Inc. Framework for supporting custom signaling between a wireless device and a cellular network

Also Published As

Publication number Publication date
CN108347726A (zh) 2018-07-31

Similar Documents

Publication Publication Date Title
US20210266153A1 (en) Key Exchange Method and Apparatus
CN106922216B (zh) 用于无线通信的装置、方法和存储介质
CN101836470B (zh) 用于启用lte移动单元中非接入层(nas)安全性的方法和设备
US8295488B2 (en) Exchange of key material
CN102036230B (zh) 本地路由业务的实现方法、基站及系统
US20110033053A1 (en) Security key generating method, device and system
US20120170745A1 (en) Method and device for encrypting user identity during paging procedure
CN103476028A (zh) Nas count翻转时nas消息的处理方法及装置
CN101953191A (zh) 在无线通信系统中实施切换或在实施切换同时实施密钥管理的系统和方法
WO2018137617A1 (zh) 移动网络小数据的安全传输方法及装置
CN103813272A (zh) 一种集群组呼下行传输的方法
CN111835691B (zh) 一种认证信息处理方法、终端和网络设备
CN108270560B (zh) 一种密钥传输方法及装置
CN108271154B (zh) 一种认证方法及装置
CN112291196B (zh) 适用于即时通信的端到端加密方法及系统
CN112400335B (zh) 用于执行数据完整性保护的方法和计算设备
CN114503628A (zh) 管理通信系统中的安全密钥
CN113098688B (zh) 一种aka方法及装置
WO2018094594A1 (zh) 通信方法和设备
CN102469454A (zh) Rnc切换中的密钥设置方法及无线网络控制器、终端
CN116941263A (zh) 一种通信方法及装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18745330

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 18745330

Country of ref document: EP

Kind code of ref document: A1