WO2018151546A1

WO2018151546A1 - Method and device for improved security in wireless communication system

Info

Publication number: WO2018151546A1
Application number: PCT/KR2018/001963
Authority: WO
Inventors: 류선희; 안라연; 정정수; 정병훈; 문정민; 박승훈; 황지원
Original assignee: 삼성전자 주식회사
Priority date: 2017-02-20
Filing date: 2018-02-14
Publication date: 2018-08-23

Abstract

Disclosed are a communication technique for merging, with IoT technology, a 5G communication system for supporting data transmission rate higher than that of a 4G system, and a system therefor. The disclosure can be applied to intelligent services (for example, smart home, smart building, smart city, smart car or connected car, health care, digital education, retail, security and safety related services and the like) on the basis of 5G communication technology and IoT-related technology. In addition, the disclosure relates to a method by which a terminal operates in a wireless communication system, comprising the steps of: receiving a radio resource control (RRC) connection stop message including packet data convergence protocol (PDCP) entity related information and inactivation counter information from a first base station; storing a first security key currently being used by the terminal and the inactivation counter information; allowing the terminal to move to a second base station; allowing the terminal to check uplink data to be transmitted; generating a second security key on the basis of the PDCP entity related information and the inactivation counter information; and transmitting the uplink data encrypted using the second security key to the second base station.

Description

Method and apparatus for improved security in wireless communication system

The present invention relates to a method of operating a base station and a terminal for managing the RRC connection state for low power low latency.

In order to meet the increasing demand for wireless data traffic since the commercialization of 4G communication systems, efforts are being made to develop improved 5G communication systems or pre-5G communication systems. For this reason, a 5G communication system or a pre-5G communication system is called a system after a 4G network (Beyond 4G Network) or a system after an LTE system (Post LTE). In order to achieve high data rates, 5G communication systems are being considered for implementation in the ultra-high frequency (mmWave) band (eg, such as the 60 Gigabit (60 GHz) band). In order to mitigate the path loss of radio waves in the ultra-high frequency band and increase the propagation distance of radio waves, beamforming, massive array multiple input / output (FD-MIMO), and FD-MIMO are used in 5G communication systems. Array antenna, analog beam-forming, and large scale antenna techniques are discussed. In addition, in order to improve the network of the system, 5G communication systems have advanced small cells, advanced small cells, cloud radio access network (cloud RAN), ultra-dense network (ultra-dense network) , Device to Device communication (D2D), wireless backhaul, moving network, cooperative communication, Coordinated Multi-Points (CoMP), and interference cancellation The development of such technology is being done. In addition, in 5G systems, Hybrid FSK and QAM Modulation (FQAM) and Slide Window Superposition Coding (SWSC), Advanced Coding Modulation (ACM), and FBMC (Filter Bank Multi Carrier) and NOMA are advanced access technologies. Non-orthogonal multiple access (SAP) and sparse code multiple access (SCMA) are being developed.

Meanwhile, the Internet is evolving from a human-centered connection network in which humans create and consume information, and an Internet of Things (IoT) network that exchanges and processes information between distributed components such as things. The Internet of Everything (IoE) technology, which combines big data processing technology through connection with cloud servers and the like, is emerging. In order to implement the IoT, technical elements such as sensing technology, wired / wireless communication and network infrastructure, service interface technology, and security technology are required, and recently, a sensor network for connection between things, a machine to machine , M2M), Machine Type Communication (MTC), etc. are being studied. In an IoT environment, intelligent Internet technology (IT) services can be provided that collect and analyze data generated from connected objects to create new value in human life. IoT is a field of smart home, smart building, smart city, smart car or connected car, smart grid, health care, smart home appliances, advanced medical services, etc. through convergence and complex of existing information technology (IT) technology and various industries. It can be applied to.

Accordingly, various attempts have been made to apply the 5G communication system to the IoT network. For example, technologies such as sensor network, machine to machine (M2M), machine type communication (MTC), and the like, are implemented by techniques such as beamforming, MIMO, and array antennas. It is. Application of cloud radio access network (cloud RAN) as the big data processing technology described above may be an example of convergence of 5G technology and IoT technology.

The design of the RRC state for the wireless communication terminal to transmit and receive data was overly conservative due to the design philosophy of the previous generation focused on voice calls. For example, even after no traffic arrives for a certain period of time after receiving traffic, power consumption is severely maintained due to the RRC connected state (Connected discontinuous reception, Connected DRX, C-DRX). In addition, in case of a smart phone user, keep alive messages are frequently generated as data, irrespective of the user's quality of service (QoS). When the RRC connection is designed based on the voice call service, the terminal power consumption may be worsened. . An embodiment of the present invention provides a method for setting a security key for data transmission when a base station in which a terminal is located is changed in consideration of mobility of the terminal in a situation in which data transmission is performed without an RRC state transition in an RRC INACTIVE state. .

In addition, an embodiment of the present invention provides a method for determining and applying a security key according to whether a packet data convergence protocol (PDCP) entity is changed.

An embodiment of the present invention for solving the above problems is a radio resource including a packet data convergence protocol (PDCP) entity related information and a deactivation counter information from a first base station in a method of operating a terminal in a wireless communication system; control) receiving a connection stop message, storing the first security key and the deactivation counter information currently being used by the terminal, moving the terminal to a second base station, and checking uplink data to be transmitted by the terminal. And generating a second security key based on the PDCP entity related information and the deactivation counter information and transmitting the uplink data encrypted with the second security key to the second base station. .

In addition, an embodiment of the present invention, in the terminal, a radio resource control (RRC) connection stop including a packet data convergence protocol (PDCP) entity-related information and a deactivation counter information from a transceiver for transmitting and receiving a signal and a first base station Receive a message, and stores the first security key and the deactivation counter information currently being used by the terminal, the terminal moves to the second base station, confirms the uplink data to be transmitted by the terminal, the PDCP entity related information and And a control unit generating a second security key based on the deactivation counter information and controlling to transmit the uplink data encrypted with the second security key to the second base station.

According to an embodiment of the present invention, the communication system of the terminal and the base station transitions to the RRC Connected_Active (RRC_CONNECTED) state when transmitting data directly in an Inactive (RRC_INACTIVE) state while selecting an RRC state for data transmission and performing a procedure therefor. Since the transition is not performed, the standby time (C-DRX, Radio tail) in the Active (RRC_CONNECTED) state is kept to a minimum, so the power consumption saving effect of the terminal is expected. In addition, by transmitting data without RRC release message for transition of RRC state, if you want to transmit data in Inactive (RRC_INACTIVE) (Idle) state, it does not transition the RRC state to Connected_Active (RRC_CONNECTED), so delays in related control signaling This reduces the data transmission delay. In addition, the reduction of the RRC release message for the transition of the RRC state is expected to increase the efficiency of radio resource use by reducing the power consumption of the 5G base station (RU / TRP) and reducing the peripheral interference between 5G cells.

In addition, according to an embodiment of the present invention can provide an improved security method.

1 is a diagram schematically illustrating a structure of a (5G, NR) communication system according to an embodiment of the present invention.

2 is a diagram illustrating an example of operations of three RRC states, Connected_Active (RRC_CONNECTED), Connected_Inactive, and Idle, which are to be applied in a (5G, NR) communication system according to an exemplary embodiment of the present invention.

3 is a diagram illustrating an exemplary state of a terminal, a base station, and a core-network (MME) in an inactive (RRC_INACTIVE) state in a communication system according to an embodiment of the present invention.

4 is a diagram illustrating an example of a UE operating in an RRC Inactive state according to an embodiment of the present invention a) within a cell, b) within the same PDCP, within an entity, and c) another PDCP entity.

5 is a diagram illustrating a generation and application of a security key for a data transmission operation in an Inactive (RRC_INACTIVE) state of a terminal in a communication system according to an embodiment of the present invention.

FIG. 6 illustrates an RRC field for transmitting an Enable PDCP_entity info and an INACTIVE counter when transmitting an RRC Connection suspend in a communication system according to an embodiment of the present invention.

FIG. 7 illustrates a generation and application of a security key for a data transmission operation in an Inactive (RRC_INACTIVE) state of a terminal in a communication system according to an embodiment of the present invention.

8 is a diagram illustrating an example of notation of corresponding information when the communication system transmits PDCP entity information in a communication system according to an embodiment of the present invention.

9 is a diagram illustrating a generation and application of a security key for a data transmission operation in an Inactive (RRC_INACTIVE) state of a terminal in a communication system according to an embodiment of the present invention.

FIG. 10 illustrates generation and application of a security key for a data transmission operation in an Inactive (RRC_INACTIVE) state in a communication system according to an embodiment of the present invention.

FIG. 11 is a diagram illustrating a security key generation and application for a data transmission operation in an Inactive (RRC_INACTIVE) state of a terminal in a communication system according to an embodiment of the present invention.

12 is a view showing the structure of another terminal according to an embodiment of the present invention.

13 is a diagram showing the structure of another base station according to an embodiment of the present invention.

14 is a diagram showing the structure of a core network node according to an embodiment of the present invention.

Hereinafter, embodiments of the present invention will be described in detail with the accompanying drawings. In addition, in describing the present invention, when it is determined that a detailed description of a related known function or configuration may unnecessarily obscure the subject matter of the present invention, the detailed description thereof will be omitted. Terms to be described later are terms defined in consideration of functions in the present invention, and may be changed according to intentions or customs of users or operators. Therefore, the definition should be made based on the contents throughout the specification.

Advantages and features of the present invention, and methods for achieving them will be apparent with reference to the embodiments described below in detail in conjunction with the accompanying drawings. However, the present invention is not limited to the embodiments disclosed below, but may be implemented in various forms, and only the embodiments of the present invention make the disclosure of the present invention complete and the general knowledge in the technical field to which the present invention belongs. It is provided to fully convey the scope of the invention to those skilled in the art, and the present invention is defined only by the scope of the claims. Like reference numerals refer to like elements throughout.

An embodiment of the present invention relates to an operation method of a base station and a terminal which are discussed in 3GPP RAN 5G. The standard defines energy-efficient operation with the main goal of improving the power efficiency [bit / J] of the terminal and base station networks more than 1000 times within the next 10 years. To solve this problem, a control for reducing the active (RRC_CONNECTED) operation time of the UE has been started to solve the possibility of additional power consumption due to the beamforming transmission method required for mmW operation of the high frequency band.

The technique proposed in the embodiment of the present invention is a technique for controlling and maintaining an RRC connection based on three RRC states, Connected_Active (RRC_CONNECTED), Connected_Inactive, and Idle, which are to be applied in a mobile communication system (5G or NR). In particular, the spectral efficiency improvement and the channel access method are improved for the RRC state (Inactive and (or) Active (RRC_CONNECTED)) determination method for data transmission and efficient transmission in the RRC inactive state when transmitting traffic of the UE. It covers how to support the feature.

According to an embodiment of the present invention, the RRC state (Inactive and (or) Active (RRC_CONNECTED)) determination method for transmitting data and the spectral efficiency improvement and channel access method improvement for efficiently transmitting the traffic of the UE in the RRC Inactive state are improved. Deal with.

In addition, the embodiment of the present invention deals with the improvement of the security method according to the change of the PDCP entity.

1 is a diagram schematically illustrating a structure of a 5G NR communication system according to an embodiment of the present invention.

In FIG. 1, a base station (gNB or base station, 110, 115, 120, and 125) is connected to a terminal (UE or terminal, 105) through a wireless channel, and performs a more complicated role than that of a conventional (UMTS) NodeB and an eNodeB base station of LTE. .

In the mobile communication system, all user traffic including real-time services such as Voice over IP (VoIP) service through the Internet protocol is serviced through a shared channel, so that the UE's buffer state, available transmit power state, channel state, etc. There is a need for an apparatus for scheduling by collecting the state information of the gNB (110, 115, 120, 125) is responsible for this. One gNB typically controls multiple cells. The S-GW 130 is a device for providing a data bearer, and generates or removes a data bearer under the control of the MME 140. The MME 140 is a device that is responsible for various control functions as well as mobility management function for the terminal 105 is connected to a plurality of base stations.

2 is a diagram illustrating three RRC states, Connected_Active (RRC_CONNECTED) 205, Connected_Inactive 210, and Idle 215, which are applied in a 5G NR communication system according to an exemplary embodiment of the present invention.

The connected Active (RRC_CONNECTED) state 205 may be referred to as an RRC connected mode, and is a wireless connection state in which a terminal can transmit and receive data. The idle state 215 may be referred to as a standby mode or an RRC standby mode, and is a wireless access state in which the terminal monitors whether paging is transmitted to the terminal. The two modes are in a wireless access state that is also applied to the LTE system, and the detailed technology is the same as that of the existing LTE system. In the 5G NR communication system, the Connected_inactive state 210 is newly defined and may be named as the RRC_INACTIVE state. In the RRC inactive state, the UE context is maintained in the base station and the terminal, RAN-based paging is supported.

In the RRC INACTIVE state, the UE may transition to the connected mode or the standby mode by using a specific procedure. According to the connection activation, the mode is changed from the inactive (RRC_INACTIVE) mode to the connected mode, and the mode is changed from the connected mode to the inactive (RRC_INACTIVE) mode using the connection inactivation procedure. The connection activation / inactivation procedure is one or more RRC messages transmitted and received between the terminal and the base station, characterized in that composed of one or more steps. You can also switch from Inactive (RRC_INACTIVE) mode to Standby mode according to a specific procedure. As the specific procedure mentioned above, various methods such as specific message exchange or timer-based or event-based may be considered. The transition between connected and standby mode follows existing LTE technology. That is, switching between the modes is performed through a connection establishment or release procedure.

As shown in FIG. 2, the 3GPP NR operates three RRC states by adding an Inactive (RRC_INACTIVE) state to two existing RRC states, and the UE operates as one RRC state at a time.

3 is a diagram illustrating an example of states of a terminal, a base station, and an MME in an inactive state in an NR communication system according to an exemplary embodiment of the present invention.

Inactive is a new RRC state, the air interface of the terminal 305 and the base station 310 is not connected, but the core network of the base station 310 and the MME 315 maintains the connected state. Even if the terminal 305 releases the RRC Connected_Active (RRC_CONNECTED) state with the base station 310, the base station 310 and the MME 315 are in the ECM Connected state, and the context of the terminal 305 is the base station 310 and the MME ( Assume that 315 is storing.

In order to reduce the RRC transition delay in the existing RRC idle state, it is necessary to omit the S1 connection establishment & security procedure. To this end, the Anchor eNB stores the UE context including the resume ID for UE confirmation. When a mobile station is connected to a new base station (gNB) while moving in idle state, the mobile station transmits a corresponding ID to check the identity of the mobile station. The new base station) retrieves the UE context based on the terminal ID and then performs an access procedure.

However, the transmission operation of cellular-internet of things (C-IoT) and narrow band-internet of things (NB-IoT) in the standard 3GPP Release 13 transmits (RRC resume) data after transitioning to the RRC connected state. There is no need to set up a separate data radio bearer (DRB). However, the MAC design related to the Inactive (RRC_INACTIVE) state is needed as an enhancement to the limitations of the control plane (CP) / user plane (UP) -solution agreed to the NB-IoT. In case of CP-solution, it is necessary to solve SRB-based MME-gNB load increase problem, delay resolution, and QoS discrimination by transmitting initial small data based on NAS security (SRB, signaling radio bearer) in idle state. In addition, UP-solution operates to minimize CN (core network) burden and delay due to RRC signaling through RRC connection resume / suspend procedure, but because of data transmission in connected state, there is a problem of standby power consumption such as C-DRX. .

As a way to solve this problem, the following operation can be considered.

1) Inactive (RRC_INACTIVE) state introduced: Added Inactive (RRC_INACTIVE) state terminal operation compared to Idle-based NB-IoT operation (aperiodic CQI (channel quality indicator), BSR (buffer status report) related information, new monitoring timer, etc.)

2) Small data transmission within Inactive (RRC_INACTIVE) state: DRB-based data transmission (SRB-based MME-gNB load increase problem solving, delay resolution, QoS discrimination support)

4 is a diagram illustrating an example of a UE operating in an RRC Inactive (RRC_INACTIVE) state according to an embodiment of the present invention in a) within a cell, b) within a same PDCP entity, and c) moving to another PDCP entity. to be.

In scenario a) or b), it is possible to use an old security key because it operates within the same PDCP entity, but a new security key is required when the terminal moves to another PDCP entity. PDCP entities may be the same or different in the same base station, and even if different cells, PDCP entities may be the same or different.

Therefore, an embodiment of the present invention may consider the following operation according to the necessity of a new security key when the terminal moves to a different cell / PDCP entity.

1) a new indication message design and control signal transmission procedure transmitted by the base station so that the terminal can recognize movement to a different cell / PDCP entity different from the previous anchor cell;

2) the UE identifies / detects movement to different cell / PDCP entities; and

3) Based on this, distinguishing the case where RRC signaling (RRC connection request, or RRC connection resume Request) control signal is required when transmitting data in Inactive (RRC_INACTIVE) state, procedure to apply security key, and

4) This includes transmitting data and RRC signaling (RRC connection request, or RRC connection resume request) accordingly.

In this case, RRC signaling (RRC connection request, or RRC connection resume request) includes UE_ID and MAC-I.

In addition, the terminal derives a new security key based on INACTIVE_count, and in this case, the corresponding data + RRC signaling is ciphered based on the new key, integrity protected, and includes an operation of transmitting MAC-I and INACTIVE_count.

Another embodiment of the present invention includes transmitting data to a DRB when RRC signaling is not needed. In this case, a new MAC CE (MAC header) format indicating RRC resume is required for data transmission. This includes the operation of transmitting corresponding information by defining a new MAC-CE format in addition to the existing MAC-CE as follows.

For example, a new MAC-CE may be indicated by selecting one bit string from among reserved bits (01011-11001). According to an embodiment, 01011 includes an example of operating as a MAC CE indicating UL data transmission transmitted during an Inactive (RRC_INACTIVE) state. Herein, the specific index number may be changed.

Table. New LCID for UL-SCH

The corresponding information of UL data transmission in Inactive (RRC_INACTIVE) includes an operation of setting a window for continuously monitoring a physical downlink control channel (PDCCH) and waiting time for the terminal and the base station.

For example, in case of UL data transmission in Inactive (RRC_INACTIVE), it includes setting and maintaining a window for monitoring the PDCCH to support DL / UL transmission to be transmitted subsequently. In this case, the method includes a method of referring to TA information or BSR information channel CQI information acquired from previous UL data in Inactive (RRC_INACTIVE).

In another embodiment, when a UE transmits data in an Inactive (RRC_INACTIVE) state, a new MAC header format (MAC CE) for identifying whether ACK or DL data transmission is transmitted for UL data is defined as follows, and when the corresponding information is transmitted, It includes the operation of transmitting and controlling the time for setting and waiting for a window for continuously monitoring the PDCCH by the terminal and the base station.

For example, in the case of DL ACK for UL data in Inactive (RRC_INACTIVE), it includes an operation of increasing the low power efficiency of the UE by setting a window for continuously monitoring a short PDCCH.

Table. New LCID for DL-SCH

As a method for generating and applying a security key according to various embodiments of the present disclosure, the following method and operation may be considered.

A method of operating when the target base station is different from the anchor base station is as shown in the following embodiment.

1) A method for generating a new security key and deciphering data including UE_ID (eg, Resume ID) at the target base station based on the new security key. At this time, the anchor base station transmits security key related information for generating a new security key to the target base station. At this time, there is a burden (signalling and delay) to be allocated the next hop key (NH) from the MME.

Even when the UE moves and the new PDCP entity is not known, the anchor base station omits the operation of transmitting the security key related information for generating the new security key to the target base station. In this case, to reduce the burden of having to allocate the counter and NH from the MME, the method includes using a security key (old) by lowering the NG changing counter (NCC) again.

2) Forwarding the entire encrypted data from the target base station to the anchor base station based on the existing security key and transmitting it to the Core-network (S-GW) via the anchor base station (PDCP entity).

anchor Because it forwards the entire encrypted data to the base station, it consumes resources of backhaul (X2, Xn, etc.), and delay occurs because data is transmitted to Core-network (S-GW) via Anchor base station (PDCP entity).

When forwarding the entire encrypted data from the target base station to the anchor base station based on the existing security key, via the anchor base station (PDCP entity)

1) In order to support UE specific anchor, UE_ID must be deciphered at target base station. Therefore, security key to be applied to UE_ID is commonly used between anchor base station at target base station so that only the corresponding part can be deciphered at target.

2) By specifying a network specific anchor, for example, the anchor base station can be fixed within a certain area (network-wise paging area or tracking area) set by the network, and forwarded to the fixed anchor base station as a whole.

According to an embodiment, according to UE mobility type information indicated in UE capability of a terminal,

1) Fixed station always operates within anchor base station

1-1) Always send using old security key

1-2) Always create and send new security key

2) In case of mobile terminal, it is possible to change anchor base station.

2-1) In the case of always creating and using a new security key, a target base station for transmitting data in an Inactive (RRC_INACTIVE) state transmits data directly to a core network (S-GW) without data forwarding to an existing anchor base station. action

2-2) In case of always transmitting by using existing security key, target base station for transmitting data in Inactive (RRC_INACTIVE) state forwards all encrypted data to existing anchor base station through Core-network (S- How to send to GW)

According to the service type information indicated in the UE capability of the terminal

3) If the service type is delay tolerant, the delay in data forward does not degrade QoS and / or forwards the entire encrypted data to the anchor base station if it is not (and / or) heavy data traffic service type. X2, Xn and so on)

3-1) Always forwarding to target-anchor base station using old security key

3-2) A method of always creating and transmitting a new security key and forwarding it to the target- anchor base station for transmission.

4) Service requirements of the terminal (service type, use case, ultra reliable low latency communication (URLLC), enhanced mobile broadband (eMBB), massive machine type communications (MMTC) or radio access network (RAN) slice information, network slice)) Information based on UE capacity based on requirements including network slice selection assistance information (NSSAI).

The NSSAI is network slice related information corresponding to the terminal and can be used as additional information in the DRB configuration by transmitting the corresponding information to the base station.

If the delay requirement is strict: The delay in data forward degrades the QoS.

And / or for heavy data traffic service type:

anchor Because it is forwarding the entire encrypted data to the base station, it is exhausted with resources of backhaul (X2, Xn, etc.).

One embodiment includes the following operations because data deciphering and CN (S-GW, etc.) are required without data forwarding from the target cell to the anchor base station;

In an embodiment of the present invention, data deciphering includes a security key application method and a deciphering analysis method including each or all of ciphering and integrality protection.

This operation may include an operation applied differently according to UE capability or applied to all Inactive (RRC_INACTIVE) state terminals.

4-1) Operation of applying AS security key for INACTIVE Data transmission in common between target base station and anchor base station

-Commonly applied operation within MME

-Common operation within the (RAN-based) paging area (PA)

. PA zone is fixed to the network

. PA region is UE-specific

-Commonly applied within the (CN-based) tracking area (TA)

. TA zone is fixed to the network

. TA area is UE-specific

5) Since one PDCP integrates multiple DUs in a CU in the CU-DU structure, even if the DU is changed in a relatively large area, the same security key is used when the same DU is used. How to indicate whether PDCP has been changed

For example, in the case of distinguishing a neighboring CU with an indication of 1 bit or 3 bits (8 sequences), most DU changes occur within a CU within a wide CU coverage.

-Update the security key when the CU (PDPC) changes.

In the CU-DU, a CU is a control unit, a DU is an RF related processing unit, and a PDCP is assumed to be located in a CU. RLC / MAC may be located in CU / DU and PHY is assumed to be located in DU.

The term itself includes various extended versions in addition to the CU and DU, and is applicable to the separation and extension structure of the control unit and the RF.

Referring to FIG. 5, when the RRC connection suspend is transmitted, when the PDCP_entity info and INACTIVE counters are transmitted and the network provides PDCP entity information (part of ID or ID), this indication is transmitted to the UE, and the UE transmits the RRC INACTIVE. The RRC Release (cause = suspend, connection suspend) which is transitioned to, and the method of fixing the new security key based on this (e.g., always using new key or always old key) Explain.

Referring to the embodiment of FIG. 5, a method of not transmitting the Enable PDCP_entity info and the INACTIVE counter without changing the legacy RRC release message or setting the Enable PDCP_entity info and the INACTIVE counter of the new RRC connection suspend to NULL may be considered. . Here, Enable PDCP_entity info is a parameter indicating whether PDCP_entity ID information is transmitted to the UE, and may be used as a criterion for determining whether PDCP_entity is the same as or different from the anchor PDCP storing the UE context when the UE is suspended. The INACTIVE counter is a security key generation related parameter for generating a new key when the PDCP_entity is different from the anchor PDCP storing the UE context or when the change is unknown when the terminal is suspend.

Specifically, referring to FIG. 5, the mobile communication system may include a terminal 505, an anchor cell 510, a new cell 515, and a core network node 520. The core network node 520 may include an MME and / or an S-GW. The fixed cell 510 may be named a fixed base station, and the new cell 515 may be named a new base station. The transmission / reception operation of the cell may be understood as the transmission / reception operation of the base station corresponding to the cell.

In operation 531, the core network node 520 may transmit an INACTVE message to the fixed cell 510. The INACTIVE message may include INACTIVE_NH and INACTIVE_NCC. The fixed cell 510 receiving the INACTIVE message may transmit an RRC connection suspend message to the terminal 505 (operation 533). The RRC connection stop message may be an RRC connection release message including an RRC connection suspend, and may include Enable PDCP_entity info = 0 and an INACTIVE counter. In case of PDCP_entity info = 0, it may indicate that the terminal 505 does not provide PDCP_entity ID information.

In operation 535, the terminal 505 may store a UE context. The UE context may include an old key (A_KeNB) and INACTIVE_counter. In operation 537, the fixed cell 510 may store a UE context. The UE context may include an old key (A_KeNB) and INACTIVE_counter.

In operation 539, the terminal 505 may move to a new cell 515 or a new base station. The terminal 505 may receive at least one of system information, SRS, or RS from the moved new cell 515. At least one of the system information, the SRS, or the RS may include the PDCP entity ID of the new cell 515 (operation 541).

In operation 543, the uplink data transmitted by the terminal 505 may be generated. In operation 545, the terminal 505 may increase the INACTIVE counter. For example, you can increase the counter value by one. In operation 547, the terminal 505 may derive a new security key (T_KeNB) and apply it. A new security key can be derived / generated from the INACTIVE_counter.

In operation 549, the UE 505 may transmit an RRC connection resume request message to the new cell 515. The UE may transmit uplink data (UL data) together with the RRC connection resumption request message. The UL data may include a UE ID and / or an inactive counter and may be encrypted with a new security key (cyphered and integrity protected). In operation 551, the new cell 515 may identify the fixed cell 510 or the fixed base station. The new cell 515 may identify the fixed cell 510 using the UE ID, which may be a Resume ID. The Resume ID may be provided to the terminal 505 in operation 533.

If the fixed cell 510 is identified, in operation 553, the new cell 515 transmits a UE Context Search request to the fixed cell 510. The terminal context search request may include a UE_ID. In operation 555, the fixed cell 510 transmits a UE Context Response to a new cell 515. The terminal context search response may include T_KeNB and INACTIVE_NCC. In operation 557, the new cell 515 stores the terminal context. The terminal context may include information (T_KeNB, INACITVE_NCC) about a new security key received from the fixed cell 510.

In operation 559, the new cell 515 transmits an RRC connection response message to the terminal 505. The RRC connection response message may include resume / suspend information and ACK / NACK information. In operation 561, the terminal 505 transmits an RRC connection reconfig complete message to the new cell 515. In operation 563, the new cell 515 sends a path switch request message to the core network node 520. In operation 565, the core network node 520 sends a path switch response message to the new cell 515. In operation 567, the new cell 515 transmits a context release message to the fixed cell 510.

6 is a diagram illustrating an RRC field for transmitting an Enable PDCP_entity info and an INACTIVE counter when transmitting an RRC release (cause = suspend) or an RRC connection suspend in a communication system according to an embodiment of the present invention.

In the embodiment of the present invention, the PDCP_entity information for generating and applying the security key transmits an Enable PDCP_entity info and an INACTIVE counter as a new field when transmitting (RRC Connection suspend) in an RRC release message, and enables PDCP_entity info in relation to PDCP entity information. = 1, this may be transmitted in an RRC connection suspend for transitioning the terminal to RRC INACTIVE.

If PDCP_entity_Indication, indicates that the network provides PDCP entity information.

-In case of PDCP_entity_blind, it indicates that the network can operate regardless of PDCP entity information.

NULL: indicates that the network does not provide PDCP entity information.

Based on this Enable PDCP_entity info information

If Enable PDCP_entity info = PDCP_entity_Indication, the UE and the base station can know whether the network provides PDCP entity information.Based on this, the ID itself can be transmitted as System Information (mandatory or on). Method of transmitting as data through -demand SI, mapping to radio resources (time of TTI, frequency of subcarrier, space such as beam index, scrambling sequence, etc.) to inform the terminal of ID information of PDCP entity It includes a method.

The terminal receives ID related information of the PDCP entity based on the corresponding PDCP_entity_method and determines whether to use the NCC value of the security key to be applied as it is or whether to generate a new security key by NCC + and apply the corresponding security key to Inactive ( RRC_Inactive) state can transmit data.

In addition, when the RRC release message (RRC Connection suspend) is transmitted, security key information to be applied to inactive data transmission such as Inactive_counter is transmitted. The security key can be common for the Inactive (RRC_INACTIVE) state within cell-specific or configured areas based on MME / PA / TA or cell list.

Connected_key is an operation that uses the security key used by the corresponding gNB and transmits the security key related information.Inactive_Key A security key used in the Inactive (RRC_INACTIVE) state separately from the security key used by the gNB in the connected state. This is an operation for transmitting related information, and NULL indicates that there is no need to transmit security key related information in a corresponding network.

For example, if a new security key is not needed because the coverage area common to the PDCP entity operating in the CU is large in a (CU-DU) structure, the UE transmits inactive data only within a serving (anchor) base station (cell, PDCP entity). If the mobile station moves out of the serving (anchor) base station (cell, PDCP entity), it performs an operation of updating the security key after the transition to the connected state. In this case, the RRC connection request or the RRC resume request applies NAS security, thereby indicating that the security key update is not necessary in the Inactive (RRC_INACTIVE) state.

In this CU-DU structure, a method for indicating PDCP Change Indication in a control signal between base stations corresponding to a cell is included.

PDCP Change Indication indicates the PDCP information for the corresponding DU / corresponding cell that the UE moves to request an RRC connection or add or handover to a cell.

PDCP Change Indication IE (information element)

That is, the terminal indicates whether a new security key to be used by the 5G base station gNB newly accessed by the UE through (RRC connection, cell addition, handover), etc. is indicated by a field 'KgNB update required'. In addition, the terminal informs whether the PDCP recovery should be performed in the newly-connected 5G base station gNB through RRC connection, cell addition, handover), etc. as a 'PDCP data recovery required' field.

FIG. 7 illustrates generation and application of a security key for a data transmission operation in an Inactive (RRC_INACTIVE) state in a communication system according to an exemplary embodiment of the present invention.

Referring to FIG. 7, when the RRC connection suspend is transmitted, the enable PDCP_entity info and INACTIVE counters are transmitted, and when the network provides PDCP entity information and Enable PDCP_entity info = 1, this is indicated on the RRC connection suspend where the UE transitions to RRC INACTIVE. And a method of transmitting security key information to be applied to inactive data transmission such as Inactive_counter. The security key may be common for the purpose of Inactive (RRC_INACTIVE) state within the region specific to the cell specific or configured based on MME / PA / TA or cell list as described above.

In the embodiment of FIG. 7, the UE determines whether to generate a new security key (operation of generating and applying a new key when PDCP_entity is changed), and DATA, UE_ID (eg resume_ID, S-TMSI (SAE-temporary) to transmit the corresponding security key. mobile subscriber identity), T-RNTI, etc.) and the new base station receives the data and processes the data at the target (security key decoding and CN (S-GW)) or forwarding to the anchor cell. An operation of determining whether to perform and a method of adding a new UE transmission field for the determination are provided.

For example, a method of transmitting an RRC connection request (RRC resume request) by adding a bit indicating whether forwarding is necessary to an anchor base station or whether an old key is used or not is forwarded to an anchor base station in a new MAC CE format. Method to add bit indicating whether old key is used or not and send Anchor cell if target base station tries to transmit data to security key decoding and CN (S-GW) without forwarding to another anchor base station. It includes how to perform forwarding.

Referring to FIG. 7, the mobile communication system may include a terminal 705, an anchor cell 710, a new cell 715, and a core network node 720. Core network node 720 may include an MME and / or an S-GW.

In operation 731, the core network node 520 may transmit an INACTVE message to the fixed cell 710. The INACTIVE message may include INACTIVE_NH and INACTIVE_NCC. The fixed cell 710 receiving the INACTIVE message may transmit an RRC connection suspend message to the terminal 705 (operation 733). The RRC connection stop message may be an RRC connection release message including an RRC connection suspend, and may include Enable PDCP_entity info = 1 and an INACTIVE counter. In the case of PDCP_entity info = 1, it may be instructed to provide the PDCP_entity ID information to the terminal 505.

In operation 735, the terminal 705 may store a UE context. The UE context may include an old key (A_KeNB) and INACTIVE_counter. In operation 737, the fixed cell 710 may store a UE context. The UE context may include an old key (A_KeNB) and INACTIVE_counter.

In operation 739, the terminal 705 may move to a new cell 515 or a new base station. The terminal 705 may receive at least one of system information, SRS, or RS from the moved new cell 715. At least one of the system information, the SRS or the RS may include the PDCP entity ID of the new cell 715 (operation 741).

In operation 743, the uplink data transmitted by the terminal 705 may be generated. In operation 744, the terminal 705 checks whether the PDCP entity is different. That is, in operation 733, the terminal 705 checks whether the PDCP entity of the cell transmitting the message is different from the PDCP entity of the currently moved cell. If the PDCP entity is different, the operation proceeds to operation 745. In operation 745, the terminal 705 may increase the INACTIVE counter. For example, you can increase the counter value by one. In operation 747, the terminal 705 may derive a new security key (T_KeNB) and apply it. A new security key can be derived / generated from the INACTIVE_counter.

In operation 749, the UE 705 may transmit an RRC connection resume request message to the new cell 715. The UE may transmit uplink data (UL data) together with the RRC connection resumption request message. The UL data may include a UE ID and / or an inactive counter and may be encrypted with a new security key (cyphered and integrity protected). The RRC connection resumption request message may include information indicating whether to forward the UL data to the fixed cell 710 and information indicating whether to use an old key. A bit of information indicating whether forwarding of the UL data is required or a bit indicating information indicating whether to use an old key may be added to a new MAC CE format. In addition, regardless of the indicator, the new cell 715 may attempt to send UL data to the core network node 720 and forward to the fixed cell 710 if it fails.

In operation 751, the new cell 715 may identify the fixed cell 710 or the fixed base station. The new cell 715 may identify the fixed cell 710 using the UE ID, which may be at least one of Resume ID, S-TMSI, and T-RNTI. The Resume ID may be provided to the terminal 705 in operation 733.

If the fixed cell 710 is identified, in operation 753, the new cell 715 transmits a UE Context Search request to the fixed cell 710. The terminal context search request may include a UE_ID. In operation 755, the fixed cell 710 transmits a UE Context Response to a new cell 715. The terminal context search response may include T_KeNB and INACTIVE_NCC. In operation 757, the new cell 715 stores the terminal context. The terminal context may include information (T_KeNB, INACITVE_NCC) about a new security key received from the fixed cell 710.

In operation 759, the new cell 715 transmits an RRC connection response message to the terminal 705. The RRC connection response message may include resume / suspend information and ACK / NACK information. In operation 761, the terminal 705 transmits an RRC connection reconfig complete message to the new cell 715. In operation 763, the new cell 715 transmits a path switch request message to the core network node 720. In operation 765, the core network node 720 transmits a path switch response message to the new cell 715. In operation 767, the new cell 715 transmits a context release message to the fixed cell 710.

8 is a diagram illustrating an example of notation of corresponding information when a communication system transmits PDCP entity information in a communication system according to an embodiment of the present invention.

As illustrated in FIG. 3, when only the UE-related information is broadcasted through system information, the UE cannot know PDCP entity information of the base station. Accordingly, an embodiment of the present invention provides a method for the base station to further transmit PDCP entity information to the corresponding terminal. As shown in 810 of FIG. 8, there may be a method of additionally transmitting the entire ID of the PDCP entity or the ID of the PDCP entity uniquely defined within the tracking area or the paging area as an additional field in addition to the existing cell ID (PCell ID). As shown in 820 of 8, some information of the PDCP entity may be included as an additional field in an existing cell ID.

In the CU-DU structure, since one PDCP integrates multiple DUs in a CU, the same security key is used when the same DU is used even if the DU is changed in a relatively wide area. In this case, whether or not the same PDCP can be indicated using only some bits of the PCDP ID, and through this, it can be indicated whether to change the PDCP.

For example, when distinguishing from neighboring CUs by indication of 1 bit or 3 bits (8 sequences), most DU changes occur within the same CU within a wide CU coverage. Therefore, when only the DU is changed without changing the CU, it does not update the security key, but includes a method of updating the security key when the CU (PDPC entity) is changed.

As a method of transmitting ID related information of PDCP entity, the ID itself is transmitted as data through system information (mandatory or on-demand SI), radio resources (time of TTI, frequency of subcarrier, beam index, etc.). It is possible to use a method of informing the terminal of ID information of the PDCP entity by mapping the space, a scrambling sequence, etc.). (How to send system information, How to send the information periodically to common SI, How to send on demand SI, How to send via synchronization signal, How to send via PSS, How to send via SSS, Reference signal (RS), how to transmit via CRS, how to transmit via DMRS, how to transmit via BRS, how to transmit via aRS)

FIG. 9 is a diagram illustrating a generation and application of a security key for a data transmission operation in an INACTIVE state in a communication system according to an embodiment of the present invention. When a RRC connection suspend is transmitted, an Enable PDCP_entity info and an INACTIVE counter are transmitted. In case of providing PDCP entity information, when Enable PDCP_entity info = 1, a method of transmitting this by marking the RRC connection suspend which is transitioned to RRC INACTIVE and transmitting a new security key based on this method (when PDCP_entity is changed) A method of generating a new security key in the process of generating a new key based on Inactive_Conter, ie, depending on whether the PDCP_entity has been changed using the old key (A_KeNB) and INACTIVE_counter included in the stored UE context as input values. Determine whether to generate a new key.

That is, if the PDCP_entity is the same, the operation includes using an existing old key without increasing the inactive counter, and generating a new new key based on the existing old key by increasing the inactive counter when the PDCP_entity is changed.

In addition, when PDCP_entity is not explicitly indicated, according to the base station configuration or the terminal configuration

RRC connection request and RACH transition from RRC_Inactive to RRC_Connected state include the operation of using the old key without increasing the inactive counter at all times.

In addition, when the PDCP_entity is not explicitly instructed, the Inactive counter is always increased during the RRC connection request and the RACH operation that transitions from the RRC_Inactive to the RRC_Connected state according to the base station configuration or the terminal configuration. It includes the operation of generating.

In another embodiment, the present invention includes a method of separating and using a security key to be used in RRC_connected and a security key to be used in an RRC INACTIVE state. In an embodiment of the present invention, an access stratum (AS) security for INACTIVE data transmission is used. The key can be applied in common between the target base station and the anchor base station.

Common operation within the same MME

-Common operation within the same (RAN-based) paging area (PA) (when the PA area is fixed to the network and the PA area is UE-specific)

-Commonly applied within the same (CN-based) tracking area (TA) (when the TA area is fixed to the network and the TA area is UE-specific).

FIG. 10 transmits an Enable PDCP_entity info and an INACTIVE counter when transmitting an RRC Connection suspend, and if the Network provides PDCP entity information and Enable PDCP_entity info = 1, the terminal indicates this to an RRC connection suspend that is transitioned to RRC INACTIVE and transmits it. The present invention relates to a method and a method of determining whether to generate a new security key based on the method.

The embodiment of FIG. 10 includes an operation of applying an existing key when the PDCP_entity of the moved cell is the same and a method of transmitting a DL ACK / NACK in an RRC connection response.

Referring to FIG. 10, a mobile communication system may include a terminal 1005, an anchor cell 1010, a new cell 1015, and a core network node 1020. The core network node 1020 may include an MME and / or an S-GW.

In operation 1031, the core network node 1020 may transmit an INACTVE message to the fixed cell 710. The INACTIVE message may include INACTIVE_NH and INACTIVE_NCC. The fixed cell 1010 receiving the INACTIVE message may transmit an RRC connection suspend message to the terminal 1005 (operation 1033). The RRC connection stop message may be an RRC connection release message including an RRC connection suspend, and may include Enable PDCP_entity info = 1 and an INACTIVE counter.

In operation 1035, the terminal 1005 may store a UE context. The UE context may include an old key (A_KeNB) and INACTIVE_counter. In operation 1037, the fixed cell 1010 may store a UE context. The UE context may include an old key (A_KeNB) and INACTIVE_counter.

In operation 1039, the terminal 1005 may move to a new cell 1015 or a new base station. The terminal 1005 may receive at least one of system information, SRS, or RS from the moved new cell 1015. At least one of the system information, the SRS, or the RS may include a PDCP entity ID of the new cell 1015 (operation 1041).

In operation 1043, the UE 1005 may generate uplink data to be transmitted. In operation 1044, the terminal 1005 checks whether the PDCP entity is different. That is, in operation 1033, the terminal 1005 checks whether the PDCP entity of the cell transmitting the message is different from the PDCP entity of the currently moved cell. If the PDCP entities are identical, the operation proceeds to operation 1045. In operation 1045, the terminal 1005 maintains the INACTIVE counter without increasing it. In operation 1047, the terminal 1005 uses the old key (A_KeNB) previously used as a security key.

In operation 1049, the UE 1005 may transmit UL data to the new cell 1015 when transmitting an RRC Connection request message. The UL data may include a UE ID and may be encrypted with an old key. In operation 1051, the new cell 1015 may identify the fixed cell 1010 or the fixed base station. The new cell 1015 may identify the fixed cell 1010 using the UE ID, which may be at least one of Resume ID, S-TMSI, and T-RNTI. The Resume ID may be provided to the terminal 1005 in operation 1033.

If the fixed cell 1010 is confirmed, in operation 1053, the new cell 1015 transmits a UE Context Search request to the fixed cell 1010. The terminal context search request may include a UE_ID. In operation 1055, the fixed cell 1010 transmits a UE Context Response to a new cell 1015. The UE context search response may include a PDCP sequence number (SN). In operation 1057, the new cell 1015 stores the terminal context. The UE context may include an old key, Inactive_counter, and the new cell 1015 may update the PDCP SN.

In operation 1059, the new cell 1015 transmits an RRC connection response message to the terminal 1005. The RRC connection response message may include resume / suspend information, UE context update information, and ACK / NACK information. In operation 1061, the terminal 1005 transmits an RRC connection reconfig complete message to the new cell 1015. In operation 1063, the new cell 1015 transmits a path switch request message to the core network node 1020. In operation 1065, the core network node 1020 transmits a path switch response message to the new cell 1015. In operation 1067, the new cell 1015 transmits a context release message to the fixed cell 1010.

FIG. 11 illustrates that when PDRC_entity info and INACTIVE counters are transmitted when the RRC connection suspend is transmitted, and the network provides PDCP entity information, when Enable PDCP_entity info = 1, the terminal indicates this to the RRC connection suspend that is transitioned to RRC INACTIVE. And a method for determining whether to generate a new security key based on the same.

The embodiment of FIG. 11 includes a method of applying an existing key and piggybacking to paging for transmission of DL ACK / NACK when PDCP_entity of the moved cell is the same.

Referring to FIG. 11, a mobile communication system may include a terminal 1105, an anchor cell 1110, a new cell 1115, and a core network node 1120. The core network node 1120 may include an MME and / or an S-GW.

In operation 1131, the core network node 1120 may transmit an INACTVE message to the fixed cell 1110. The INACTIVE message may include INACTIVE_NH and INACTIVE_NCC. The fixed cell 1110 having received the INACTIVE message may transmit an RRC connection suspend message to the UE 1105 (operation 1133). The RRC connection stop message may be an RRC connection release message including an RRC connection suspend, and may include Enable PDCP_entity info = 1 and an INACTIVE counter.

In operation 1135, the UE 1105 may store a UE context. The UE context may include an old key (A_KeNB) and INACTIVE_counter. In operation 1137, the fixed cell 1110 may store a UE context. The UE context may include an old key (A_KeNB) and INACTIVE_counter.

In operation 1139, the terminal 1105 may move to a new cell 1115 or a new base station. The terminal 1105 may receive at least one of system information, SRS, or RS from the moved new cell 1115. At least one of the system information, the SRS or the RS may include the PDCP entity ID of the new cell 1115 (operation 1141).

In operation 1143, uplink data transmitted by the terminal 1105 may be generated. In operation 1144, the terminal 1105 checks whether the PDCP entity is different. That is, the UE 1105 checks whether the PDCP entity of the cell which has transmitted the message is different from the PDCP entity of the cell which is currently moved in operation 1133. If the PDCP entities are identical, the operation proceeds to operation 1145. In operation 1145, the terminal 1105 maintains the INACTIVE counter without increasing it. In operation 1147, the terminal 1105 uses an old key (A_KeNB) previously used as a security key.

In operation 1149, the UE 1105 may transmit UL data to the new cell 1115 without RRC signaling. The UL data may include a UE ID and may be encrypted with an old key. In operation 1151, the new cell 1115 may identify the fixed cell 1110 or the fixed base station. The new cell 1115 may identify the fixed cell 1110 using the UE ID, and the UE ID may be at least one of Resume ID, S-TMSI, and T-RNTI. The Resume ID may be provided to the terminal 1105 in operation 1133.

After checking the fixed cell 1110, in operation 1153, the new cell 1115 transmits a UE Context Search request to the fixed cell 1110. The terminal context search request may include a UE_ID. In operation 1155, the fixed cell 1110 transmits a UE Context Response to a new cell 1115. The UE context search response may include a PDCP sequence number (SN). In operation 1157, the new cell 1115 stores the terminal context. The UE context may include an old key, Inactive_counter, and the new cell 1015 may update the PDCP SN.

In operation 1163, the new cell 1115 transmits a path switch request message to the core network node 1120. In operation 1165, the core network node 1120 transmits a path switch response message to the new cell 1115. In operation 1167, the new cell 1115 transmits a context release message to the fixed cell 1110. In operation 1169, the core network node 1120 transmits a paging message to the fixed cell 1110. In operation 1171, the fixed cell 1110 may transmit a paging message to the terminal 1105, and piggyback ACK / NACK on the paging message.

12 is a diagram illustrating a structure of a terminal according to an embodiment of the present invention.

Referring to FIG. 12, the terminal may include a transceiver 1210, a controller 1220, and a storage 1230. In an embodiment of the present disclosure, the controller 1220 may be defined as a circuit or an application specific integrated circuit or at least one processor.

The transceiver 1210 may exchange a signal with another network entity. The transceiver 1210 may receive system information from, for example, a base station, and may receive a synchronization signal or a reference signal. The controller 1220 may control the overall operation of the terminal according to the embodiment proposed by the present invention. The storage unit 1230 may store at least one of information transmitted and received through the transceiver 1210 and information generated through the controller 1220.

According to an embodiment of the present invention, the control unit 1220 receives a radio resource control (RRC) connection stop message including packet data convergence protocol (PDCP) entity related information and deactivation counter information from a first base station, Stores the first security key and the deactivation counter information being used, the terminal moves to a second base station, identifies uplink data to be transmitted by the terminal, and based on the PDCP entity related information and deactivation counter information. A security key may be generated, and the uplink data encrypted with the second security key may be transmitted to the second base station.

The controller 1220 determines whether the PDCP entity of the first base station and the PDCP entity of the second base station are the same when the ID of the PDCP entity is provided according to the PDCP entity related information. When the PDCP entity of the first base station and the PDCP entity of the second base station are different from each other, the deactivation counter may be updated to generate the second security key. If the PDCP entities of the first base station and the second base station are the same, the second security key may be the same as the first security key.

If the ID of the PDCP entity is not provided according to the PDCP entity related information, the controller 1220 updates the deactivation counter regardless of whether the PDCP entity of the first base station and the PDCP entity of the second base station are the same. The second security key may be generated.

In addition, the controller 1220 may control to transmit the uplink data together with the RRC connection resumption request message. In addition, the controller 1220 may control to transmit the identifier of the terminal and the deactivation counter used to generate the second security key together with the uplink data. In addition, the control unit 1220 receives system information including the cell identifier of the second base station and the PDCP entity identifier of the second base station from the second base station, and based on the PDCP entity identifier of the second base station; The PDCP entity of the first base station and the PDCP entity of the second base station may be controlled to determine whether the same.

13 is a diagram illustrating a structure of a base station according to an embodiment of the present invention.

Referring to FIG. 13, the base station may include a transceiver 1310, a controller 1320, and a storage 1330. In an embodiment of the present disclosure, the controller 1320 may be defined as a circuit or application specific integrated circuit or at least one processor.

The transceiver 1310 may transmit and receive signals with other network entities. For example, the transceiver 1310 may transmit system information to the terminal, and may transmit a synchronization signal or a reference signal. The controller 1320 may control the overall operation of the base station according to the embodiment proposed by the present invention. The storage unit 1330 may store at least one of information transmitted and received through the transceiver 1310 and information generated through the controller 1320.

14 is a diagram illustrating a structure of a core network node according to an embodiment of the present invention. The core network node may be an MME or an S-GW, or may be a function corresponding to an MME or a function corresponding to an S-GW.

Referring to FIG. 14, the core network node may include a transceiver 1410, a controller 1420, and a storage 1430. In an embodiment of the present disclosure, the controller 1420 may be defined as a circuit or an application specific integrated circuit or at least one processor.

The transceiver 1410 may transmit and receive signals with other network entities. For example, the transceiver 1410 may transmit system information to the terminal, and may transmit a synchronization signal or a reference signal. The controller 1420 may control the overall operation of the core network node according to the embodiment proposed by the present invention. The storage 1430 may store at least one of information transmitted and received through the transceiver 1410 and information generated through the controller 1420.

In addition, the embodiments disclosed in the specification and the drawings merely present specific examples to easily explain and easily understand the contents of the present invention, and are not intended to limit the scope of the present invention. Therefore, the scope of the present invention should be construed that all changes or modifications derived based on the technical spirit of the present invention are included in the scope of the present invention in addition to the embodiments disclosed herein.

Claims

In the method of operating a terminal in a wireless communication system,

Receiving a radio resource control (RRC) connection stop message including packet data convergence protocol (PDCP) entity related information and deactivation counter information from a first base station;

Storing the first security key and the deactivation counter information currently being used by the terminal;

Moving the terminal to a second base station;

Confirming uplink data to be transmitted by the terminal;

Generating a second security key based on the PDCP entity related information and the deactivation counter information; And

Transmitting the uplink data encrypted with the second security key to the second base station.
The method of claim 1,

Determining whether a PDCP entity of the first base station and a PDCP entity of the second base station are the same when an ID of a PDCP entity is provided according to the PDCP entity related information;

And if the PDCP entity of the first base station and the PDCP entity of the second base station are different from each other, updating the deactivation counter to generate the second security key.
The method of claim 2, wherein if the PDCP entities of the first base station and the second base station are the same, the second security key is the same as the first security key.
The method of claim 1,

If the ID of the PDCP entity is not provided according to the PDCP entity related information, the PDCP entity of the first base station and the PDCP entity of the second base station update the deactivation counter to generate the second security key regardless of the identity. Characterized in that the method.
The method of claim 1, wherein the uplink data is transmitted with an RRC connection resumption request message.
The method of claim 1, wherein the deactivation counter used to generate the identifier of the terminal and the second security key is transmitted together with the uplink data.
3. The method of claim 2 including receiving system information from the second base station, the system information including the cell identifier of the second base station and the PDCP entity identifier of the second base station;

And determining whether the PDCP entity of the first base station and the PDCP entity of the second base station are the same based on the PDCP entity identifier of the second base station.
In the terminal,

Transmitting and receiving unit for transmitting and receiving a signal; And

Receive a radio resource control (RRC) connection stop message including packet data convergence protocol (PDCP) entity related information and deactivation counter information from a first base station, and store the first security key and the deactivation counter information currently being used by the terminal. The terminal moves to the second base station, identifies uplink data to be transmitted by the terminal, generates a second security key based on the PDCP entity related information and the deactivation counter information, and encrypts the second security key. And a control unit controlling to transmit the uplink data to the second base station.
The method of claim 8, wherein, when the ID of the PDCP entity is provided according to the PDCP entity related information, the controller determines whether the PDCP entity of the first base station and the PDCP entity of the second base station are the same, And if the PDCP entity of the base station and the PDCP entity of the second base station are different from each other, updating the deactivation counter to generate the second security key.
10. The terminal of claim 9, wherein if the PDCP entities of the first base station and the second base station are the same, the second security key is the same as the first security key.
The method of claim 8, wherein the control unit,

If the ID of the PDCP entity is not provided according to the PDCP entity related information, the PDCP entity of the first base station and the PDCP entity of the second base station update the deactivation counter to generate the second security key irrespective of the same identity. Terminal for controlling.
The terminal of claim 8, wherein the controller controls the uplink data to be transmitted together with an RRC connection resumption request message.
The terminal of claim 8, wherein the controller controls to transmit the identifier of the terminal and the deactivation counter used to generate the second security key together with the uplink data.
The method of claim 9, wherein the control unit receives system information including the cell identifier of the second base station and the PDCP entity identifier of the second base station from the second base station, and based on the PDCP entity identifier of the second base station; And control to determine whether the PDCP entity of the first base station and the PDCP entity of the second base station are the same.