WO2018137671A1

WO2018137671A1 - Authentication method, base station, user equipment, core network, system, device and data storage medium

Info

Publication number: WO2018137671A1
Application number: PCT/CN2018/074053
Authority: WO
Inventors: 谢振华
Original assignee: 中兴通讯股份有限公司
Priority date: 2017-01-24
Filing date: 2018-01-24
Publication date: 2018-08-02
Also published as: CN108616881A

Abstract

The invention discloses an authentication method, a base station, user equipment, a core network, a system, a device and a data storage medium. The method comprises: a first base station receiving algorithm information and a key from a core network network element and with respect to user equipment (UE); the first base station receiving a first token Token1 from a second base station and with respect to the UE, wherein the first token Token1 is first received by the second base station from the UE, and is verified on the basis of the algorithm information and the key; or, the first base station receiving a request from the second base station and with respect to the UE, and transmitting to the second base station a second token Token2 and the algorithm information, wherein the second token Token2 is generated on the basis of the algorithm information and the key, and used to verify, at the second base station, the first token Token1 transmitted from the UE.

Description

Authentication method, base station, user equipment, core network and system, device and storage medium

Cross-reference to related applications

The present application is based on a Chinese patent application filed on Jan.

Technical field

The present application relates to the field of communications, and in particular, to a connection reestablishment authentication method, a base station, a user equipment (UE), a core network and system, a communication device, and a storage medium.

Background technique

The 3rd Generation Partnership Project (3GPP) proposes an authentication scheme for mobile network connection reestablishment, which includes: first, the UE sends an attach request to a core network element (such as a mobile network entity MME), and then the core The network element performs authentication on the UE, negotiates a key and a security algorithm in the authentication process, and generates a Key based on the key; the core network element calculates the token (Token) 1 by using the negotiated key and the security algorithm, and carries the order The connection establishment of the card 1 indicates the source base station sent to the UE; the source base station transmits a downlink data message to the UE based on the token 1; when the UE needs to establish a connection with the target base station, the re-establishment including the token 1 is sent to the target base station. After the request information, the target base station and the source base station verify the token 1, and receive a handover instruction from the core network that includes the recalculated token 2.

It can be seen that in the authentication process of reconnecting in the prior art, the core network element needs to repeatedly perform calculation to obtain the token processing.

Summary of the invention

The main object of the present invention is to provide a connection re-establishment authentication method, a base station, a user equipment, a core network and system, a communication device, and a storage medium, which are intended to solve the above problems in the prior art.

To achieve the above object, an embodiment of the present invention provides a connection reestablishment authentication method, which is applied to a first base station, and the method includes:

The first base station receives algorithm information and a key for the terminal UE from the core network element;

Receiving, by the first base station, a first token Token1 for the UE from the second base station, where the Token1 is received by the second base station, and the first base station is based on the algorithm information. And verifying with the key;

Or the first base station receives a request from the second base station for the UE, and sends a second token Token2 and the algorithm information to the second base station, where the Token2 is generated based on the algorithm information and the key And for verifying, by the second base station side, the Token1 sent by the UE.

In the above solution, the method further includes: the first base station generates a second token Token2 based on the algorithm information and the key; and compare the generated Token2 with the Token1.

In the foregoing solution, the method further includes: when the first base station verifies that the Token1 is successful, sending the algorithm information to the second base station.

In the foregoing solution, the method further includes: the first base station sending the algorithm information to the UE.

In the above solution, the method further includes: the first base station transmitting the security capability information of the first base station to the core network element, where the security capability information is used on the core network side of the core network Based on its selection of the algorithm information.

The embodiment of the present invention further provides an authentication method for connection reestablishment, which is applied to a second base station, where the method includes:

The second base station receives the first token Token1 from the terminal UE;

Transmitting, by the second base station, the Token1 to the first base station; or

The second base station requests the first base station to send a second token Token2, and the Token2 is used to check the Token1 on the second base station side.

The embodiment of the present invention further provides an authentication method for connection reestablishment, which is applied to a terminal UE, and the method includes:

The terminal UE receives algorithm information and key generation information from a core network element;

The UE sends a first token Token1 to the second base station, and the Token1 is generated based on the algorithm information and a key generated based on the key generation information.

The embodiment of the present invention further provides an authentication method for connection reestablishment, which is applied to a core network, and the method includes:

The core network element negotiates key generation information and algorithm information with the terminal UE;

The algorithm information and a key generated based on the key generation information are transmitted to the first base station.

In the above solution, the core network element receives the security capability information from the first base station, and the security capability information is used by the core network element to select the algorithm information based on the core network element.

The embodiment of the present invention further provides a first base station, where the first base station includes:

a first receiving unit, configured to receive algorithm information and a key from a core network element;

a second receiving unit, configured to receive a first token Token1 from the second base station; the Token1 is received by the second base station from the UE, and the first base station is based on the algorithm information and the The key is verified;

or,

The second receiving unit is configured to receive a request from the second base station;

Correspondingly, the sending unit is configured to send the second token Token2 and the algorithm information to the second base station, where the Token2 is generated based on the algorithm information and the key, and configured to be in the second base station side school The Token1 sent by the UE is checked.

In the foregoing solution, the first base station further includes: a processing unit configured to compare the generated Token2 with the Token1; and generate a second token Token2 based on the algorithm information and the key.

In the foregoing solution, the sending unit is configured to: when the first base station checks that the Token1 is successful, send the algorithm information to the second base station.

In the above solution, the sending unit is configured to send the algorithm information to the UE.

In the above solution, the sending unit is configured to send the security capability information of the first base station to the core network element, where the security capability information is used on the core network side of the core network, based on the selection The algorithm information.

The embodiment of the present invention further provides a second base station, where the second base station includes:

a receiving unit, configured to receive a first token Token1 from the UE;

a sending unit, configured to forward the Token1 to the first base station; or

The second base station Token2 is requested to be sent to the first base station.

An embodiment of the present invention further provides a UE, where the UE includes:

An information receiving unit configured to receive algorithm information and key generation information from a core network element;

The information sending unit is configured to send a first token Token1 to the second base station, and the Token1 is generated based on the algorithm information and a key generated based on the key generation information.

The embodiment of the invention further provides a core network, where the core network includes:

a negotiating unit configured to negotiate key generation information and algorithm information with the UE;

And a communication unit configured to send the algorithm information and a key generated based on the key generation information to the first base station.

In the above solution, the communication unit is configured to receive security capability information from the first base station, where the security capability information is used by the core network element to select the algorithm information.

The embodiment of the invention further provides an authentication system for connection reconstruction, the system comprising:

a first base station configured to receive algorithm information and a key from a core network element; receive a first token Token1 from the second base station for the UE, and the Token1 is received by the second base station Determining the UE and verifying it based on the algorithm information and the key; or receiving a request from the second base station for the UE, sending a second token Token2 and the algorithm information to the second base station The Token2 is generated based on the algorithm information and the key, and is used to check the Token1 sent by the UE at the second base station side;

The second base station is configured to receive the first token Token1 from the UE; to forward the Token1 to the first base station; or to send a second token Token2 to the first base station;

The UE is configured to receive the algorithm information and the key generation information from the core network element, and send the first token Token1 to the second base station, where the Token1 is based on the algorithm information and the secret generated based on the key generation information. Key generation

The core network is configured to negotiate key generation information and algorithm information with the terminal UE; and send the algorithm information and a key generated based on the key generation information to the first base station.

The embodiment of the present invention further provides a computer readable storage medium storing computer executable instructions, and when the computer executable instructions are executed, the following processing is implemented:

Receiving algorithm information and a key for the terminal UE from the core network element;

Receiving, by the second base station, a first token Token1 for the UE, where the Token1 is received by the second base station from the UE, and is verified according to the algorithm information and the key;

Or receiving a request from the second base station for the UE, sending a second token Token2 and the algorithm information to the second base station, where the Token2 is generated based on the algorithm information and the key, and is used in the The second base station side checks the Token1 sent by the UE.

A communication device comprising: a processor and a memory configured to store a computer program executable on the processor,

Wherein the processor is configured to perform the steps of the foregoing method when the computer program is run.

In the solution provided by the embodiment of the present invention, the network side sends the slice security parameter of the selected slice network to the terminal, so that the network side and the terminal can respectively generate their dedicated keys for different slice networks, so that each slice network has The special security protection means realizes the security isolation between the slice networks and improves the security of the slice network communication.

DRAWINGS

1 is a schematic flowchart of a method for establishing connection reestablishment according to an embodiment of the present invention;

2 is a schematic flowchart 1 of a connection reestablishment authentication method according to Embodiment 1 of the present invention;

3 is a schematic flowchart 2 of a connection reestablishment authentication method according to Embodiment 1 of the present invention;

4 is a schematic flowchart of a method for establishing connection reestablishment according to an embodiment of the present invention;

FIG. 5 is a schematic flowchart of a method for establishing connection reestablishment according to an embodiment of the present invention;

FIG. 6 is a schematic flowchart of a connection reestablishment authentication method according to an embodiment of the present invention;

FIG. 7 is a schematic structural diagram of a structure of a first base station according to an embodiment of the present invention;

FIG. 8 is a schematic structural diagram of a second base station according to an embodiment of the present invention;

FIG. 9 is a schematic structural diagram of a structure of a UE according to an embodiment of the present invention;

10 is a schematic structural diagram of a core network according to an embodiment of the present invention;

FIG. 11 is a schematic structural diagram of a structure of a connection reestablishment authentication system according to an embodiment of the present invention.

detailed description

The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

An embodiment of the present invention provides a connection reestablishment authentication method, which is applied to a first base station, as shown in FIG. 1 , and includes:

Step 101: The first base station receives the algorithm information and the key for the terminal UE from the core network element, where the first base station is the source base station of the user equipment UE that is managed by itself;

Step 102: The first base station receives a first token Token1 for the UE from a second base station, where the Token1 is received by the second base station from the UE, and is based on the first base station. The algorithm information and the key are used to verify it;

Or the first base station receives a request from the second base station for the UE, and sends a second token Token2 and the algorithm information to the second base station, where the Token2 is generated based on the algorithm information and the key And for verifying, by the second base station side, the Token1 sent by the UE;

The second base station is a target base station to be handed over by the UE.

In the foregoing embodiment, the first base station and the second base station may be the same base station or different base stations.

Before performing step 101, the UE also needs to send an attach request to the core network element. Specifically, the first base station (that is, the source base station) may send an attach request to the core network element.

The first base station then sends security capability information to the core network element, which may include algorithm information that can be supported. The first base station sends the security capability information of the first base station to the core network element, where the security capability information is used to select the algorithm information based on the core network element side.

The first base station receives the algorithm information and the key from the core network.

The first base station and the UE can be authenticated by using the algorithm information and the key to generate an initial token, and then the first base station and the UE perform information transmission.

For example, it can include:

The core network element and the UE perform an authentication process, and the key generation information and the used security algorithm Algorithm are negotiated with the UE through the process, and a Key is generated based on the key generation information, and the core network element can select the source base station system according to the policy. The supported security algorithm may also be selected according to the received security capability information of the source base station system;

The core network element sends a connection establishment indication to the source base station system (such as an eNB), for example, sends a Connection Establishment Indication message, and the message carries the Key and the negotiated algorithm;

The source base station system stores the Algorithm and the Key, and sends a downlink data message to the UE, for example, sending an RRC DL Information Transfer message.

After the foregoing processing is completed, when the UE needs to handover to the target base station, that is, the second base station, the Key generated by the negotiated key generation information may be generated, and the negotiated Algorithm and related parameters (such as the source or target base station system identifier, or The user identifier assigned by the source base station system, etc.) calculates the first token Token1, and then sends a connection reestablishment request to the target base station, for example, sends an RRC Connection Re-establishment Request message, carrying Token1.

Thereafter, the method may include: the verifying the Token1 based on the algorithm information and the key, including:

The first base station generates a second token Token2 based on the algorithm information and the key;

The generated Token2 is compared with the Token1 to obtain a verification result.

The target base station (the second base station) requests the source base station (the first base station) to request the UE context, for example, sends a Retrieve UE Context Request message, which may carry the received Token1; the first base station system uses the Key and Algorithm and related parameters (such as the source or target). The base station system identifier, or the user identifier assigned by the source base station system, etc., calculates Token1. If the source base station system receives the Token1, the source base station system compares the calculated Token2 with the received Token1, and if they are equal, the UE is authenticated successfully, otherwise Authentication failed.

Further, after the authentication succeeds, or the source base station system does not receive the Token1, the first base station (the source base station) returns the UE context, for example, sends a Retrieve UE Context Response message, and if the source base station system does not receive the Token1, carries the calculated Token2. ;

Specifically, the first base station receives a request from the second base station, generates a second token Token2 based on the algorithm information and the key, and sends the Token2 to the second base station, so that the second base station And verifying, according to the Token2, the Token1 included in the connection re-establishment request sent by the UE; specifically, the target base station system receives the Token from the source base station system, and compares the received Token2 from the source base station system. And Token1 from the UE, if the UE is equal, the UE is authenticated successfully, otherwise the authentication fails. If the authentication is successful or the target base station does not receive the Token from the source base station system, the target base station system sends a connection reestablishment response to the UE, for example, sends an RRC Connection Re-establishment. Message.

FIG. 2 is a schematic flowchart 1 of a connection reestablishment authentication method according to Embodiment 1 of the present invention, where the process includes:

Step 201: The UE sends an attach request to the core network element (such as the mobile network entity MME), for example, sends an Attach Request message, and the message path source base station system (such as an eNB);

Step 202: The source base station system forwards the attach request to the core network element, and may carry the security capability information of the source base station system, such as the supported security algorithm information.

Step 203: The core network element and the UE perform an authentication process, and the key generation information and the used security algorithm Algorithm are negotiated with the UE through the process, and a key is generated based on the key generation information, and the core network element can select a source according to the policy. The security algorithm also supported by the base station system may also be selected according to the received security capability information of the source base station system;

Step 204: The core network element sends a connection establishment indication to the source base station system (such as an eNB), for example, sends a Connection Establishment Indication message, and the message carries a Key and a negotiated algorithm.

Step 205: The source base station system stores the Algorithm and the Key, and sends a downlink data message to the UE, for example, sending an RRC DL Information Transfer message.

Step 206: The UE wants to establish a connection with other base station systems (target base station systems) at a certain time, and then uses the negotiated key generation information to generate a Key, and the negotiated algorithm and related parameters (such as the source or target base station system identifier, Or the user identifier assigned by the source base station system, etc., calculates a Token, and then sends a connection reestablishment request to the target base station, for example, sending an RRC Connection Re-establishment Request message, carrying the Token;

Step 207: The target base station system requests the UE context from the source base station system, for example, sends a Retrieve UE Context Request message, which may carry the received Token.

Step 208: The source base station system uses the Key and Algorithm and related parameters (such as the source or target base station system identifier, or the user identifier allocated by the source base station system, etc.) to calculate the Token. If the source base station system receives the Token, the source base station system calculates the Token. The Token is compared with the received Token. If the UE is equal, the UE is authenticated successfully. Otherwise, the authentication fails. If the authentication succeeds or the source base station system does not receive the Token, the source base station returns the UE context, such as sending a Retrieve UE Context Response message, if the source base station The system does not receive the Token and carries the calculated Token;

Step 209: The target base station system receives the Token from the source base station system, and compares the received Token from the source base station system with the Token from the UE. If they are equal, the UE is authenticated successfully, otherwise the authentication fails. If the authentication succeeds or the target base station does not. Receiving a Token from the source base station system, the target base station system sends a connection reestablishment response to the UE, for example, sending an RRC Connection Re-establishment message;

Step 210: The target base station system sends a path switch request to the core network element, for example, sends a Path Switch message.

Step 211: The core network element sends a path switch response to the target base station system, for example, sends a Path Switch ACK message.

In addition, the embodiment further provides a different processing manner from the foregoing, that is, before the first base station receives the first token Token1 from the second base station, the method further includes:

Sending, according to the first algorithm information sent by the core network element, the first algorithm information, to the UE, and determining, by using the first algorithm information, an initial token, and determining, according to the initial order, Cards interact.

Before the first base station receives the first token Token1 from the second base station, the method further includes: receiving second algorithm information sent by the core network element;

Correspondingly, the method further includes: when the first base station verifies that the Token1 is successful, sending the second algorithm information to the second base station;

Alternatively, the second token may be calculated based on the second algorithm information, and the second token is compared with the first token to obtain a verification result;

Or sending the second algorithm to the second base station, so that the second base station calculates the second token based on the second algorithm information for verification, and obtains the verification result.

FIG. 3 is a schematic flowchart 2 of a connection reestablishment authentication method according to Embodiment 1 of the present invention, where the process includes:

Step 301: The UE sends an attach request to the core network element (such as the mobile network entity MME), for example, sends an Attach Request message, and the message path source base station system (such as an eNB);

Step 302: The source base station system forwards the attach request to the core network element, and may carry the security capability information of the source base station system, such as the supported security algorithm information.

Step 303: The core network element and the UE perform an authentication process, and the key generation information and the used security algorithm Algorithm1 are negotiated with the UE, and a key is generated based on the key generation information, and the core network element can select a source according to the policy. The security algorithm also supported by the base station system may also be selected according to the received security capability information of the source base station system;

Step 304: The core network element sends a connection establishment indication to the source base station system (such as an eNB), for example, sends a Connection Establishment Indication message, and the message carries a Key and an Algorithm2;

Step 305: The source base station system stores the Key and Algorithm2, and sends a downlink data message to the UE, for example, sends an RRC DL Information Transfer message, and the message carries Algorithm2;

Step 306: The UE wants to establish a connection with other base station systems (target base station systems) at a certain time, and then uses the negotiated key generation information to generate a Key, and the Algorithm2 and related parameters (such as the source or target base station system identifier, or the source base station). The user identifier assigned by the system, etc.) calculates the Token, and then sends a connection reestablishment request to the target base station system, for example, sending an RRC Connection Re-establishment Request message, carrying the Token;

Step 307: The target base station system requests the UE context from the source base station system, for example, sends a Retrieve UE Context Request message, which may carry the received Token.

Step 308: The source base station system calculates the Token by using the Key and Algorithm2 and related parameters (such as the source or target base station system identifier, or the user identifier allocated by the source base station system, etc.). If the source base station system receives the Token2, the source base station system calculates the token. The Token2 is compared with the received Token. If the UE is equal, the UE is authenticated successfully. Otherwise, the authentication fails. If the authentication succeeds or the source base station system does not receive the Token, the source base station system returns the UE context, such as sending a Retrieve UE Context Response message. The base station system carries the calculated Token without receiving the Token;

Step 309: The target base station system receives the Token from the source base station system, and compares the received Token from the source base station system with the Token from the UE. If they are equal, the UE is authenticated successfully, otherwise the authentication fails, if the authentication succeeds or the target base station system The Token from the source base station system is not received, and the target base station system sends a connection reestablishment response to the UE, for example, sending an RRC Connection Re-establishment message;

Step 310: The target base station system sends a path switch request to the core network element, for example, sends a Path Switch message.

Step 311: The core network element sends a path switch response to the target base station system, for example, sends a Path Switch ACK message.

After the foregoing steps are completed, the second base station system sends a path switch request to the core network element, for example, sends a Path Switch message; the core network element sends a path switch response to the target base station system, for example, sends a Path Switch ACK message.

Corresponding to the foregoing embodiments, the present embodiment describes an authentication method for a connection re-establishment from the second base station, the UE, and the core network side, respectively.

When applied to the second base station, referring to FIG. 4, the method includes:

Step 401: The second base station receives the first token Token1 from the UE;

Step 402: The second base station forwards the Token1 to the first base station; or

The second base station requests the first base station to send the second token Token2.

After the second base station requests the first base station to send the second token Token2, the method further includes:

After receiving the Token2, the second base station compares the Token1 and the Token2 to obtain a verification result.

In this embodiment, a connection re-establishment authentication method is applied to the UE. As shown in FIG. 5, the method includes:

Step 501: The UE generates information by using the first base station or directly receiving algorithm information and a key from the core network element.

Step 502: The UE sends a first token Token1 to the second base station, where the Token1 is generated based on the algorithm information and a key generated based on the key generation information.

The first base station is a source base station of the user equipment UE, and the second base station is a target base station of the UE.

An authentication method for connection reestablishment provided in this embodiment is applied to a core network. Referring to FIG. 6, the method includes:

Step 601: The core network element negotiates key generation information and algorithm information with the UE.

Step 602: Send the algorithm information and the key generated based on the key generation information to the first base station, where the first base station is a source base station of the user equipment UE managed by itself.

The core network element receives security capability information from the first base station, and the security capability information is used by the core network element to select the algorithm information.

It can be seen that, by adopting the foregoing solution, the token can be verified by the base station side when performing reconnection; thus, the generation of the token is repeated repeatedly on the core network side, and the load of the core network element is reduced.

An embodiment of the present invention provides a first base station, where the first base station includes:

a second receiving unit, configured to receive a first token Token1 from the second base station; the Token1 is received by the second base station from the UE, and is calibrated based on the algorithm information and the key Test

or,

Correspondingly, the sending unit is configured to send the second token Token2 and the algorithm information to the second base station, where the Token2 is generated based on the algorithm information and the key, and is used to check at the second base station side. The Token1 sent by the UE.

Specifically, as shown in FIG. 7, the first base station includes: a first receiving unit 71 configured to receive algorithm information and a key from a core network element; wherein the first base station is managed by itself a source base station of the user equipment UE;

The second receiving unit 72 is configured to receive the first token Token1 from the second base station; correspondingly, the processing unit 73 is configured to check the Token1 based on the algorithm information and the key;

or,

The second receiving unit 72 is configured to receive a request from the second base station;

Correspondingly, the processing unit 73 is configured to generate a second token Token2 based on the algorithm information and the key;

The sending unit 74 is configured to send the Token2 to the second base station;

The second base station is a target base station to be handed over by the UE.

The UE also needs to send an attach request to the core network element. Specifically, the first base station (that is, the source base station) can send an attach request to the core network element.

The first base station then sends security capability information to the core network element, which may include algorithm information that can be supported.

For example, it can include:

Thereafter, the second receiving unit is configured to generate a second token Token2 based on the algorithm information and the key;

The processing unit is configured to send the first algorithm information to the UE according to the first algorithm information sent by the core network element, and determine an initial token by using the first algorithm information between the UE and the UE. And interact based on the initial token.

Before the first base station receives the first token Token1 from the second base station, the first receiving unit is configured to receive second algorithm information sent by the core network element;

Correspondingly, the sending unit is configured to: when the first base station verifies that the Token1 is successful, send the second algorithm information to the second base station.

When applied to the second base station, referring to FIG. 8, the second base station includes:

The receiving unit 81 is configured to receive the first token Token1 from the UE;

The sending unit 82 is configured to forward the Token1 to the first base station; or

The second base station further includes:

The processing unit is configured to compare the Token1 and the Token2 to obtain a verification result after receiving the Token2.

As shown in FIG. 9, a UE includes:

The information receiving unit 91 is configured to: through the first base station or directly receive algorithm information and key generation information from the core network element;

The information sending unit 92 is configured to send a first token Token1 to the second base station, where the Token1 is generated based on the algorithm information and a key generated based on the key generation information;

A core network provided in this embodiment, see FIG. 10, includes:

The negotiating unit 1001 is configured to negotiate key generation information and algorithm information with the UE;

The communication unit 1002 is configured to send the algorithm information and a key generated based on the key generation information to the first base station, where the first base station is a source base station of the user equipment UE that is managed by itself.

Referring to FIG. 11, the embodiment provides an authentication system for connection reestablishment, and the system includes:

The first base station 1101 is configured to receive the algorithm information and the key from the core network element, where the first base station is the source base station of the user equipment UE managed by itself, and the first token is received from the second base station. Token1, verifying the Token1 based on the algorithm information and the key;

Or receiving a request from the second base station, generating a second token Token2 based on the algorithm information and the key, and sending the Token2 to the second base station, so that the second base station is based on the Token2 The Token1 included in the connection re-establishment request sent by the UE is used for verification; wherein the second base station is a target base station to be handed over by the UE;

The second base station 1102 is configured to receive the first token Token1 from the UE; forward the Token1 to the first base station; or request the first base station to send the second token Token2;

The UE1103 is configured to: through the first base station or directly receive algorithm information and key generation information from the core network element; send a first token Token1 to the second base station, where the Token1 is based on the algorithm information and based on the secret Key generation generated by key generation information;

The core network 1104 is configured to negotiate key generation information and algorithm information with the UE, and send the algorithm information and a key generated based on the key generation information to the first base station, where the first base station manages itself Source base station of the user equipment UE.

The embodiment further provides a computer readable storage medium storing computer executable instructions that, when executed, implement the following processing:

Receiving algorithm information and a key from a core network element;

Receiving a first token Token1 from the second base station, and verifying the Token1 based on the algorithm information and the key;

Or receiving a request from the second base station, generating a second token Token2 based on the algorithm information and the key, and sending the Token2 to the second base station, so that the second base station is based on the Token2 The Token1 included in the connection re-establishment request sent by the UE is verified;

The second base station is a target base station to be handed over by the UE.

Embodiments of the present invention also provide a communication apparatus including: a processor and a memory configured to store a computer program executable on the processor,

Wherein the processor is configured to perform the steps of the method in the foregoing embodiments when the computer program is run.

One of ordinary skill in the art will appreciate that all or a portion of the above steps may be performed by a program to instruct related hardware, such as a processor, which may be stored in a computer readable storage medium, such as a read only memory, disk or optical disk. Wait. Alternatively, all or part of the steps of the above embodiments may also be implemented using one or more integrated circuits. Correspondingly, each module/unit in the above embodiment may be implemented in the form of hardware, for example, by implementing an integrated circuit to implement its corresponding function, or may be implemented in the form of a software function module, for example, executing a program stored in the memory by a processor. / instruction to achieve its corresponding function. This application is not limited to any combination of the specified forms of hardware and software.

The basic principles and main features of the present application and the advantages of the present application are shown and described above. The present application is not limited by the above-described embodiments, and the above-described embodiments and the description are only for explaining the principles of the present application, and various changes and modifications may be made to the present application without departing from the spirit and scope of the application. And improvements are within the scope of the claimed invention.

Industrial applicability

The method and device for generating a key of a slice network provided by the present invention, the network side sends a slice security parameter of the selected slice network to the terminal, so that the network side and the terminal can respectively generate their own dedicated keys for different slice networks, so that each Each slice network has and has a special security protection means, which realizes the security isolation between the slice networks and improves the security of the slice network communication.

Claims

An authentication method for connection reestablishment is applied to a first base station, and the method includes:

The first base station receives algorithm information and a key for the terminal UE from the core network element;

Receiving, by the first base station, a first token Token1 for the UE from the second base station, where the Token1 is received by the second base station, and the first base station is based on the algorithm information. And verifying with the key;

Or the first base station receives a request from the second base station for the UE, and sends a second token Token2 and the algorithm information to the second base station, where the Token2 is generated based on the algorithm information and the key And for verifying, by the second base station side, the Token1 sent by the UE.
The method of claim 1 wherein the method further comprises:

The first base station generates a second token Token2 based on the algorithm information and the key;

The generated Token2 is compared with the Token1.
The method of claim 1 wherein the method further comprises:

And when the first base station verifies that the Token1 is successful, sending the algorithm information to the second base station.
The method of claim 1 wherein the method further comprises:

The first base station sends the algorithm information to the UE.
The method of claim 1 wherein the method further comprises:

The first base station sends the security capability information of the first base station to the core network element, where the security capability information is used to select the algorithm information based on the core network element side.
An authentication method for connection reestablishment is applied to a second base station, and the method includes:

The second base station receives the first token Token1 from the terminal UE;

Transmitting, by the second base station, the Token1 to the first base station; or

The second base station requests the first base station to send a second token Token2, and the Token2 is used to check the Token1 on the second base station side.
An authentication method for connection reestablishment is applied to a terminal UE, and the method includes:

The terminal UE receives algorithm information and key generation information from a core network element;

The UE sends a first token Token1 to the second base station, and the Token1 is generated based on the algorithm information and a key generated based on the key generation information.
An authentication method for connection reconstruction is applied to a core network, and the method includes:

The core network element negotiates key generation information and algorithm information with the terminal UE;

The algorithm information and a key generated based on the key generation information are transmitted to the first base station.
The method according to claim 8, wherein the core network element receives security capability information from the first base station, and the security capability information is used by the core network element to select the algorithm information based on the method .
A first base station, the first base station includes:

a first receiving unit, configured to receive algorithm information and a key from a core network element;

a second receiving unit, configured to receive a first token Token1 from the second base station; the Token1 is received by the second base station from the UE, and the first base station is based on the algorithm information and the The key is verified;

or,

The second receiving unit is configured to receive a request from the second base station;

Correspondingly, the sending unit is configured to send the second token Token2 and the algorithm information to the second base station, where the Token2 is generated based on the algorithm information and the key, and is used to check at the second base station side. The Token1 sent by the UE.
The first base station according to claim 10, wherein the first base station further comprises:

And a processing unit configured to compare the generated Token2 with the Token1; generate a second token Token2 based on the algorithm information and the key.
The first base station according to claim 10, wherein

The sending unit is configured to: when the first base station verifies that the Token1 is successful, send the algorithm information to the second base station.
The first base station according to claim 10, wherein the sending unit is configured to send the algorithm information to a UE.
The first base station according to claim 10, wherein the sending unit is configured to send security capability information of the first base station to the core network element; wherein the security capability information is used in the The core network element side selects the algorithm information based on it.
A second base station, the second base station includes:

a receiving unit, configured to receive a first token Token1 from the UE;

a sending unit, configured to forward the Token1 to the first base station; or

The second base station Token2 is requested to be sent to the first base station.
A UE, the UE includes:

An information receiving unit configured to receive algorithm information and key generation information from a core network element;

The information sending unit is configured to send a first token Token1 to the second base station, and the Token1 is generated based on the algorithm information and a key generated based on the key generation information.
A core network, the core network comprising:

a negotiating unit configured to negotiate key generation information and algorithm information with the UE;

And a communication unit configured to send the algorithm information and a key generated based on the key generation information to the first base station.
The core network according to claim 17, wherein the communication unit is configured to receive security capability information from the first base station, and the security capability information is used by the core network element to select the algorithm information.
A connection reconstruction authentication system, the system comprising:

a first base station configured to receive algorithm information and a key from a core network element; receive a first token Token1 from the second base station for the UE, and the Token1 is received by the second base station Determining the UE and verifying it based on the algorithm information and the key; or receiving a request from the second base station for the UE, sending a second token Token2 and the algorithm information to the second base station The Token2 is generated based on the algorithm information and the key, and configured to check the Token1 sent by the UE on the second base station side;

The second base station is configured to receive the first token Token1 from the UE; to forward the Token1 to the first base station; or to send a second token Token2 to the first base station;

The UE is configured to receive the algorithm information and the key generation information from the core network element, and send the first token Token1 to the second base station, where the Token1 is based on the algorithm information and the secret generated based on the key generation information. Key generation

The core network is configured to negotiate key generation information and algorithm information with the terminal UE; and send the algorithm information and a key generated based on the key generation information to the first base station.
A computer readable storage medium storing computer executable instructions that, when executed, implement the following processing:

Receiving algorithm information and a key for the terminal UE from the core network element;

Receiving, by the second base station, a first token Token1 for the UE, where the Token1 is received by the second base station from the UE, and is verified according to the algorithm information and the key;

Or receiving a request from the second base station for the UE, sending a second token Token2 and the algorithm information to the second base station, where the Token2 is generated based on the algorithm information and the key, and is used in the The second base station side checks the Token1 sent by the UE.
A communication device comprising: a processor and a memory configured to store a computer program executable on the processor,

Wherein the processor is configured to perform the steps of the method of any one of claims 1-9 when the computer program is run.