WO2018202117A1

WO2018202117A1 - Key updating method and device

Info

Publication number: WO2018202117A1
Application number: PCT/CN2018/085568
Authority: WO
Inventors: 戴明增; 彭文杰; 刘菁; 郭轶; 曾清海
Original assignee: 华为技术有限公司
Priority date: 2017-05-05
Filing date: 2018-05-04
Publication date: 2018-11-08
Also published as: CN108810888A; CN108810888B

Abstract

The present application provides a key updating method and device, the method comprising: acquiring by a user equipment (UE) first indication information, the first indication information comprising information about key update, and the key being used for communication between the UE and a secondary base station; and completing the key update or keeping the key unchanged by the UE according to the first indication information. The UE can be flexibly controlled by means of the first indication information to complete the key update or keep the key unchanged; in particular when the key is not required to be updated, the UE does not need to establish a PDCP layer, therefore, service will not be interrupted and service quality will be guaranteed.

Description

Secret key update method and device

This application claims the priority of the Chinese Patent Application, filed on May 5, 2017, filed on Jan. 05,,,,,,,,,,,,,,,,,,,,,,,,,,, in.

Technical field

The present application relates to communication technologies, and in particular, to a secret key update method and device.

Background technique

In order to implement user equipment (User Equipment, UE) to obtain radio resources from Long Term Evolution (LTE) and New Radio (NR) NR access air ports for data transmission, to obtain a larger transmission rate gain. A dual connectivity (DC) transmission system is generally formed between LTE and NR, which may be referred to as an LTE NR DC transmission system.

When the UE accesses the network, the access network root key is needed. In the LTE NR DC transmission system, the access network root key based on the primary base station is called a KeNB, and the access network root key based on the secondary base station is called an S-K eNB, where the S-K eNB is based on the KeNB and the secondary cell group. (Secondary Cell Group, SCG) Counter derived from the counter. For example, when the S-KeNB needs to be derived, the primary base station generates a 32-bit random number as the value of the SCG Counter, and sends the value of the SCG Counter to the UE, and the UE derives the S-KeNB by using the values of the KeNB and the SCG Counter.

In the LTE NR DC transmission system, when the UE performs handover between the primary base station, the handover in the primary base station, the handover in the primary cell, the handover between the secondary base station, and the handover in the secondary base station, the S-KeNB needs to be updated, and the S-KeNB is updated every time. The Packet Data Convergence Protocol (PDCP) layer needs to be re-established, which will cause service interruption and delay, and cannot guarantee the service quality of the service.

Summary of the invention

The present invention provides a key update method and device for solving the problem that the service interruption time is caused when the key is updated in the prior art, and the service quality of the service cannot be guaranteed.

A first aspect of the present application provides a method for updating a secret key, the method comprising:

The user equipment UE acquires first indication information; the first indication information includes information about a key update; and the secret key is used for communication between the UE and the secondary base station;

The UE completes the key update or keeps the key unchanged according to the first indication information.

In the above solution, the UE acquires first indication information including information about the key update, completes the key update or keeps the key unchanged according to the first indication information, and uses the first indication information to flexibly control the UE to complete. The key update or keep the key unchanged. In particular, when the key is not required to be updated, the UE does not need to establish a PDCP layer. Therefore, the service is not interrupted and the service quality of the service is guaranteed.

In a possible implementation manner, the acquiring, by the UE, the first indication information includes:

The UE receives the first indication information sent by the primary base station or the secondary base station; the first indication information includes an indication that the key does not need to be updated;

The UE completes the key update or keeps the key unchanged according to the first indication information, including:

The UE keeps the key unchanged according to the first indication information.

In a possible implementation, the first indication information further includes handover indication information, where the handover indication information is used to indicate that the UE performs base station handover or cell handover.

In the foregoing solution, when the first indication information indicates that the key does not need to be updated, the UE continues to use the original key to communicate with the secondary base station, and the UE does not need to establish the PDCP layer, so the service is not interrupted, and the service is guaranteed. Quality of service.

Receiving, by the UE, first indication information sent by the primary base station; the first indication information includes an indication that the key needs to be updated;

The UE completes the key update according to the first indication information.

In a possible implementation manner, the first indication information further includes configuration information, counter information, and handover indication information;

The configuration information includes packet data convergence protocol PDCP layer configuration information and algorithm information;

Counter information is used to complete the key update;

The handover indication information is used to indicate that the UE performs base station handover or cell handover.

In a possible implementation manner, the counter information is information that is determined by the secondary base station according to the access network root key and the secret key update list of the secondary base station, where the secret key update list includes the access network root key and the counter information of the secondary base station. The mapping relationship between them. The secondary base station can quickly obtain new key and counter information directly from the key update list, which can improve the speed of the key update.

In a possible implementation manner, the counter information is information generated by the primary base station according to an indication that the key needs to be updated. The primary base station sends the counter information to the UE, so that the UE generates a new key according to the counter information, which avoids the risk that the primary base station directly transmits the new key may cause the key to be leaked, and improves the reliability and security of the key.

In a possible implementation manner, the UE includes a first communication module that is a module that performs a communication function with the primary base station, and a second communication module that is a module that performs a communication function with the secondary base station. ;

The UE completes the key update according to the first indication information, including:

The first communication module generates a second key according to at least the counter information and the first key, and sends the second key to the second communication module; the first key is the access network root key of the primary base station;

The second communication module establishes a PDCP layer according to PDCP layer configuration information;

The second communication module generates a third key according to at least the second key and the algorithm information, and the third key is applied to data transmission between the UE and the secondary base station.

The first communication module sends the configuration information, the counter information, and the first key to the second communication module; the first key is the access network root key of the primary base station;

The second communication module generates a second key according to at least the counter information and the first key;

In the above solution, when the key needs to be updated, the UE timely updates the key according to the first indication information to ensure the security and reliability of the transmission data between the UE and the secondary base station.

A second aspect of the present application provides a method for updating a secret key, the method comprising:

The primary base station acquires first indication information; the first indication information includes information about a key update; and the secret key is used for communication between the UE and the secondary base station;

The primary base station sends the first indication information to the user equipment UE, so that the UE completes the key update or keeps the key unchanged according to the first indication information.

In a possible implementation manner, the first indication information includes an indication that the key does not need to be updated, and the indication that the key does not need to be updated is used to indicate that the UE keeps the key unchanged.

In a possible implementation manner, the first indication information includes an indication that the key needs to be updated, and the indication that the key needs to be updated is used to instruct the UE to complete the key update.

Counter information is used to complete the key update;

In a possible implementation manner, the counter information is information that is determined by the secondary base station according to the access network root key and the secret key update list of the secondary base station, where the secret key update list includes the access network root key and the counter information of the secondary base station. The mapping relationship between them.

In a possible implementation manner, the counter information is information generated by the primary base station according to an indication that the key needs to be updated.

In a possible implementation, the primary base station obtains the first indication information, including:

The primary base station receives the second indication information sent by the secondary base station; the second indication information includes an indication that the key needs to be updated, configuration information, and handover indication information;

The primary base station generates counter information according to an indication that the key needs to be updated;

The primary base station generates first indication information according to the counter information, the configuration information, and the handover indication information.

In a possible implementation manner, the primary base station generates the first indication information according to the counter information, the configuration information, and the handover indication information, including:

The primary base station sends the counter information to the secondary base station, so that the secondary base station encapsulates the counter information.

The primary base station generates first indication information according to the encapsulated counter information, configuration information, and handover indication information.

The beneficial effects of the secret key updating method provided by the second aspect of the present application are similar to those of the first aspect, and are not described herein again.

A third aspect of the present application provides a method for updating a secret key, the method comprising:

The secondary base station acquires first indication information; the first indication information includes information about a key update; and the secret key is used for communication between the UE and the secondary base station;

The secondary base station sends the first indication information to the user equipment UE, so that the UE completes the key update or keeps the key unchanged according to the first indication information.

In a possible implementation manner, the first indication information further includes configuration information and handover indication information;

In a possible implementation manner, the first indication information further includes counter information, where the counter information is information determined by the secondary base station according to the access network root key and the secret key update list of the secondary base station, where the secret key update list includes the secondary base station The mapping relationship between the access network root key and the counter information.

In a possible implementation manner, the secondary base station sends the first indication information to the user equipment UE, including:

The secondary base station sends the first indication information to the UE by using the primary base station.

The beneficial effects of the secret key updating method provided by the third aspect of the present application are similar to those of the first aspect, and are not described herein again.

A fourth aspect of the present application provides a key update apparatus, where the apparatus includes:

An acquiring module, configured to obtain first indication information; the first indication information includes information about a key update; and the secret key is used for communication between the UE and the secondary base station;

And a processing module, configured to complete the key update or keep the key unchanged according to the first indication information.

In a possible implementation, the acquiring module is specifically configured to receive first indication information sent by the primary base station or the secondary base station; the first indication information includes an indication that the key does not need to be updated;

The processing module is specifically configured to keep the key unchanged according to the first indication information.

In a possible implementation manner, the acquiring module is specifically configured to receive first indication information that is sent by the primary base station, where the first indication information includes an indication that the key needs to be updated;

The processing module is specifically configured to complete the key update according to the first indication information.

Counter information is used to complete the key update;

In a possible implementation manner, the processing module includes a first communication module that is a module that performs a communication function with the primary base station, and a second communication module that performs a communication function with the secondary base station. Module

The first communication module is configured to generate a second key according to at least the counter information and the first key, and send the second key to the second communication module; the first key is an access network root key of the primary base station;

The second communication module is configured to establish a PDCP layer according to PDCP layer configuration information;

The second communication module is configured to generate a third key according to at least a second key and algorithm information, where the third key is applied to data transmission between the UE and the secondary base station.

The first communication module is configured to send the configuration information, the counter information, and the first key to the second communication module; the first key is an access network root key of the primary base station;

The second communication module is configured to generate a second key according to at least the counter information and the first key;

The beneficial effects of the secret key updating apparatus provided by the fourth aspect of the present application are similar to those of the first aspect, and are not described herein again.

A fifth aspect of the present application provides a key update apparatus, including:

And a sending module, configured to send the first indication information to the user equipment UE, so that the UE completes the key update or keeps the key unchanged according to the first indication information.

Counter information is used to complete the key update;

In a possible implementation, the acquiring module is specifically configured to receive the second indication information sent by the secondary base station, generate the counter information according to the indication that the key needs to be updated, and generate the first indication information according to the counter information, the configuration information, and the handover indication information. The second indication information includes an indication that the key needs to be updated, configuration information, and handover indication information.

In a possible implementation, the acquiring module generates the first indication information according to the counter information, the configuration information, and the handover indication information, including:

The acquiring module sends the counter information to the secondary base station, so that the secondary base station encapsulates the counter information, and generates the first indication information according to the encapsulated counter information, the configuration information, and the handover indication information.

The beneficial effects of the key updating apparatus provided by the fifth aspect of the present application are similar to those of the method provided by the second aspect, and are not described herein again.

A sixth aspect of the present application provides a key update apparatus, including:

In a possible implementation, the sending module is specifically configured to send the first indication information to the UE by using the primary base station.

The beneficial effects of the secret key updating apparatus provided by the sixth aspect of the present application are similar to those of the method provided by the second aspect, and are not described herein again.

The sixth aspect of the application further provides an apparatus, including a processor and a memory;

The memory is for storing instructions, the processor is for executing instructions stored in the memory, and when the processor executes the instructions stored in the memory, the device is configured to perform the method as provided in any one of the first to third aspects.

A seventh aspect of the present application provides a secret key updating apparatus including at least one processing element (or chip) for performing the methods of the above first to third aspects.

An eighth aspect of the present application provides a program for performing the methods of the above first to third aspects when executed by a processor.

A ninth aspect of the present application provides a program product, such as a computer readable storage medium, comprising the program of the eighth aspect.

A tenth aspect of the present application provides a computer readable storage medium having stored therein instructions that, when executed on a computer, cause the computer to perform the methods of the first to third aspects described above.

The eleventh aspect of the present application further provides a communication system, where the communication system includes: a primary base station and a secondary base station;

The primary base station is configured to perform the secret key update method provided by the second aspect;

The secondary base station is configured to perform the secret key update method provided by the third aspect.

DRAWINGS

FIG. 1 is a schematic diagram of an application scenario of a method for updating a secret key according to an embodiment of the present application;

2 is a flowchart of a method for updating a secret key according to an embodiment of the present application;

FIG. 3 is a flowchart of a method for updating a secret key according to another embodiment of the present application;

4 is a flowchart of a method for updating a secret key according to another embodiment of the present application;

FIG. 5 is a flowchart of a method for updating a secret key according to another embodiment of the present application;

FIG. 6 is a flowchart of a method for updating a secret key according to still another embodiment of the present application;

FIG. 7 is a flowchart of a method for updating a secret key according to still another embodiment of the present application;

FIG. 8 is a flowchart of a method for updating a secret key according to still another embodiment of the present application;

FIG. 9 is a flowchart of a method for updating a secret key according to another embodiment of the present application;

FIG. 10 is a flowchart of a method for updating a secret key according to another embodiment of the present application;

FIG. 11 is a flowchart of a method for updating a secret key according to another embodiment of the present application;

FIG. 12 is a schematic diagram of a key update apparatus according to an embodiment of the present application;

FIG. 13 is a remote key updating apparatus according to another embodiment of the present application;

FIG. 14 is a key update apparatus according to still another embodiment of the present application;

FIG. 15 is a device according to an embodiment of the present application.

detailed description

The secret key updating method provided by the present application is applied to a wireless communication system, and particularly to the 5th Generation mobile communication technology (5G) system. FIG. 1 is a schematic diagram of an application scenario of a method for updating a secret key according to an embodiment of the present disclosure. As shown in FIG. 1 , an application scenario of the method for updating a key includes a UE1, a primary base station 2, a secondary base station 3, and a core network 4, where A control plane and a user plane connection may be established between the base station 2 and the core network 4, and a user plane connection may be established between the secondary base station 3 and the core network 4.

FIG. 2 is a flowchart of a method for updating a secret key according to an embodiment of the present application. This embodiment relates to a specific implementation process in which the UE completes the key update or keeps the key unchanged according to the first indication information. As shown in FIG. 2, the key update method includes the following steps:

Step 101: The UE acquires first indication information. The first indication information includes information about a key update. The secret key is used for communication between the UE and the secondary base station.

In this embodiment, the secret key is used for communication between the UE and the secondary base station. For example, the UE and the secondary base station use the secret key or use the secret key derived based on the secret key to encrypt, decrypt, and complete the transmission data. Protection, integrity check, etc., the UE may obtain first indication information including information about the key update from the primary base station or the secondary base station. The information about the key update is used to indicate whether the UE key needs to be updated, and the secondary base station can determine whether the key needs to be updated based on whether there is a security risk. For example, if the existing key has been used for a long time and exceeds the validity period, it is required. If the parameters such as the IDentification (ID) for security protection cannot continue to ensure the security of the transmitted data, the security of the transmitted data may be ensured by updating the key; or when the UE switches the main In the cell/primary and secondary cells, the original key is still valid, and the key does not need to be updated.

The information about the key update may be implicit or displayed. For example, the information about the key update is implicit, and the information about the key update carried in the first indication information indicates that the key needs to be updated. The information indicating that the key update is not carried in the indication information indicates that the key does not need to be updated; the information about the key update is explicit, and the key may be indicated in a certain field of the first indication information, for example, secret. Whether the key update field is 1 indicates that the key needs to be updated, and whether the key update field is 0 indicates that the key does not need to be updated, and other methods may be used to indicate whether the key needs to be updated, which is not used in this application. Limited.

Step 102: The UE completes the key update or keeps the key unchanged according to the first indication information.

In this embodiment, the UE acquires information about the key update from the first indication information, and determines whether the key needs to be updated according to the information about the key update, thereby completing the key update or keeping the key unchanged.

In the secret key update method provided by the embodiment of the present application, the UE acquires the first indication information including the information about the key update, and completes the key update or keeps the key unchanged according to the first indication information, and adopts the first indication information. The UE can be flexibly controlled to complete the key update or keep the key unchanged. In particular, when the key is not required to be updated, the UE does not need to establish a Packet Data Convergence Protocol (PDCP) layer, so Business interruption ensures the quality of service of the business.

Optionally, in the embodiment shown in FIG. 2, a method for updating a key does not need to be updated as follows:

Step 101: The UE acquires the first indication information, where the UE receives the first indication information sent by the primary base station or the secondary base station, where the first indication information includes an indication that the key does not need to be updated.

In this embodiment, the first indication information may be sent by the primary base station to the UE, or the secondary base station may send the first indication information to the primary base station, and then sent by the primary base station to the UE, or the secondary base station will include the key. The new indication is not sent to the primary base station, and the primary base station does not need to generate the first indication information according to the new indication according to the key, and then sends the first indication information to the UE.

Further, the first indication information further includes handover indication information, where the handover indication information is used to indicate that the UE performs base station handover or cell handover. The base station handover includes a handover between a primary base station, a handover in a primary base station, a handover between a secondary base station, and a handover in a secondary base station, and the handover of the cell includes a handover between the primary intra-cell and a handover between the primary cells. For example, the handover indication information is information that is determined by the secondary base station according to factors such as a measurement report. For example, when the primary cell in the secondary base station needs to be handed over, the secondary base station may send the handover indication information to the UE, and instruct the UE to perform the primary cell in the secondary base station. Switch. For example, when the handover indication information is determined by the primary base station according to factors such as the measurement report, for example, when the cell in the primary base station needs to be handed over, the primary base station may send the handover indication information to the UE, and instruct the UE to perform cell handover of the primary base station.

Step 102: “The UE completes the key update or keeps the key unchanged according to the first indication information”, and the method includes: the UE keeps the key unchanged according to the first indication information.

In this embodiment, if the first indication information includes an indication that the key does not need to be updated, the UE continues to communicate with the secondary base station by using the original key. or;

In this embodiment, if the information about the key update is not carried in the first indication information, the UE continues to communicate with the secondary base station by using the original key. or;

In this embodiment, if the information carrying the key update in the first indication information is the same as the original, the UE continues to communicate with the secondary base station by using the original key.

FIG. 3 is a flowchart of a method for updating a secret key according to another embodiment of the present application. The embodiment relates to an interaction manner between a UE, a primary base station, and a secondary base station when the key does not need to be updated, as shown in FIG. 3 . As shown, the method includes the following steps:

Step 201: The secondary base station sends first indication information to the primary base station.

The first indication information includes an indication that the key does not need to be updated, and the handover indication information, where the handover indication information is used to instruct the UE to perform the primary cell handover in the secondary base station.

Step 202: The primary base station determines to perform primary cell handover in the secondary base station according to the handover indication information, and keeps the counter information unchanged.

Step 203: The primary base station sends the first indication information to the UE.

Step 204: The primary base station sends a handover indication response message to the secondary base station.

Optionally, step 203 and step 204 may be performed simultaneously or sequentially.

Step 205: The UE performs primary cell handover in the secondary base station according to the handover indication information.

Step 206: The UE communicates with the secondary base station by using the old secret key.

The method for updating the key provided by the embodiment of the present application, when the key does not need to be updated, the UE continues to use the original key to communicate with the secondary base station, and the UE does not need to establish the PDCP layer. Therefore, the service is not interrupted. The quality of service of the business.

Optionally, in the embodiment shown in FIG. 2, a method for updating a secret key is as follows:

Step 101: The UE acquires the first indication information, where the UE includes the first indication information sent by the primary base station, where the first indication information includes an indication that the key needs to be updated.

In this embodiment, the first indication information is obtained by the primary base station from the secondary base station, and the first indication information may be sent by the secondary base station to the primary base station and forwarded by the primary base station to the UE, or the secondary base station may include the secret key. The information indicating the indication to be updated is sent to the primary base station, and the primary base station generates first indication information according to the indication that the key needs to be updated, and sends the first indication information to the UE. The indication information that the key needs to be updated may be a display indication or an implicit indication. For example, an embodiment of the implicit indication is that the secondary base station sends the cell handover indication information to the UE, and the default key needs to be updated.

Further, the first indication information further includes configuration information, counter information, and handover indication information; the configuration information includes Packet Data Convergence Protocol (PDCP) layer configuration information and algorithm information; and the counter information is used to complete the key update; The handover indication information is used to indicate that the UE performs base station handover or cell handover. The PDCP layer configuration information is used by the UE to establish a PDCP layer or re-establish a PDCP layer, and the algorithm information is an encryption, decryption, integrity protection, integrity check and other algorithms selected by the secondary base station according to the security capability of the UE and its own policy. The handover indication information is information that the secondary base station determines according to factors such as a measurement report.

Optionally, the counter information is information that is determined by the secondary base station according to the access network root key and the secret key update list of the secondary base station, and the key update list includes a mapping relationship between the access network root key and the counter information of the secondary base station. .

In this embodiment, the key update list may be pre-generated and sent to the secondary base station for storage by the primary base station, or may be generated by the secondary base station for storage. When the secondary base station determines to perform primary cell handover in the secondary base station, the slave list is selected. A suitable key and corresponding counter information are sent to the UE. The secondary base station can quickly obtain new key and counter information directly from the key update list, which can improve the speed of the key update.

Optionally, the counter information is information generated by the primary base station according to an indication that the key needs to be updated.

In this embodiment, when the secondary base station determines to perform the primary cell handover in the secondary base station, the primary base station transmits information including an indication that the key needs to be updated, and when the primary base station determines that the key needs to be updated, the counter information is generated. The primary base station sends the counter information to the UE, so that the UE generates a new key according to the counter information, which avoids the risk that the primary base station directly transmits the new key may cause the key to be leaked, and improves the reliability and security of the key.

Step 102: “The UE completes the key update or keeps the key unchanged according to the first indication information”, and the method includes: the UE completes the key update according to the first indication information.

In this embodiment, the UE determines, according to the first indication information, that the key needs to be updated, the UE generates a new key, and uses the new key to communicate with the secondary base station.

The key update method provided by the embodiment of the present invention, when the key needs to be updated, the UE timely updates the key according to the first indication information to ensure the security and reliability of the transmission data between the UE and the secondary base station.

Further, when the key needs to be updated, the implementation manner of performing the key update on the UE side may be implemented by different functional modules, as shown in FIG. 4 and FIG. 5 .

A method for updating a secret key is as shown in FIG. 4, and may include the following steps:

Step 301: The secondary base station sends second indication information to the primary base station.

The second indication information may include configuration information, handover indication information, and an indication that the key needs to be updated.

Step 302: The primary base station generates counter information according to an indication that the key needs to be updated.

Step 303: The primary base station generates first indication information according to the counter information, the configuration information, and the handover indication information.

Step 304: The primary base station sends the first indication information to the UE.

The implementation manners of the secondary base station and the primary base station in this embodiment are only an exemplary description, and may also be implemented in other manners.

In this embodiment, the UE includes a first communication module, which is a module that performs a communication function with the primary base station, and a second communication module, which is a module that performs a communication function with the secondary base station; Complete the key update according to the first indication information, including:

Step 305: The first communications module generates a second key according to at least the counter information and the first key.

The first key is the access network root key of the primary base station.

Step 306: The first communication module sends the second key to the second communication module.

Step 307: The second communications module establishes a PDCP layer according to PDCP layer configuration information.

Step 308: The second communication module generates a third key according to at least a second key and algorithm information.

The third key is applied to data transmission between the UE and the secondary base station.

Step 309: The second communication module uses the third key to communicate with the secondary base station.

In this embodiment, if the primary base station is a base station of a Long Term Evolution (LTE) network, and the secondary base station is a base station of a new generation Radio (NR) network, the corresponding first communication module adopts an LTE protocol stack. After completing the above steps 305 and 306, the second communication module completes steps 307, 308, and 309 using the NR protocol stack.

Another method for updating the secret key is shown in FIG. 5, which may include the following steps:

Step 401: The secondary base station sends third indication information to the primary base station.

The third indication information may include an indication that the handover indication information and the secret key need to be updated.

Step 402: The primary base station generates counter information according to the indication that the key needs to be updated.

Step 403: The primary base station sends the counter information to the secondary base station.

Step 404: The secondary base station generates first indication information according to the counter information, the indication that the key needs to be updated, and the configuration information.

Step 405: The secondary base station sends the first indication information to the primary base station.

Step 406: The primary base station sends the first indication information to the UE.

Step 407: The first communication module sends the configuration information, the counter information, and the first key to the second communication module.

The first key is the access network root key of the primary base station.

Step 408: The second communication module generates a second key according to at least the counter information and the first key.

Step 409: The second communication module establishes a PDCP layer according to PDCP layer configuration information.

Step 4010: The second communication module generates a third key according to at least a second key and algorithm information.

Step 4011: The second communication module uses the third key to communicate with the secondary base station.

In this embodiment, if the primary base station is the base station of the LTE network and the secondary base station is the base station of the NR network, the corresponding first communication module uses the LTE protocol stack to complete the foregoing step 407, and the second communication module uses the NR protocol stack to complete step 408. ~ 4011.

FIG. 6 is a flowchart of a method for updating a secret key according to still another embodiment of the present application. The embodiment relates to a process in which the primary base station acquires the first indication information, and sends the first indication information to the UE, so that the UE completes the key update or keeps the key unchanged according to the first indication information, as shown in FIG. The key update method includes the following steps:

Step 501: The primary base station acquires first indication information, where the first indication information includes information about a key update, and the secret key is used for communication between the UE and the secondary base station.

Step 502: The primary base station sends the first indication information to the user equipment UE, so that the UE completes the key update or keeps the key unchanged according to the first indication information.

Optionally, in the embodiment shown in FIG. 6, the first indication information includes an indication that the key does not need to be updated, and the indication that the key does not need to be updated is used to indicate that the UE keeps the key unchanged.

Further, the first indication information further includes handover indication information, where the handover indication information is used to indicate that the UE performs base station handover or cell handover.

Optionally, in the embodiment shown in FIG. 6, the first indication information includes an indication that the key needs to be updated, and the indication that the key needs to be updated is used to instruct the UE to complete the key update. The indication information that the key needs to be updated may also be a display indication or an implicit indication. For example, an embodiment of the implicit indication is that the secondary base station sends the cell handover indication information to the UE, and the default key needs to be updated.

Further, the first indication information further includes configuration information, counter information, and handover indication information; the configuration information includes packet data convergence protocol PDCP layer configuration information and algorithm information; the counter information is used to complete the key update; and the handover indication information is used to indicate the UE Perform base station handover or cell handover.

Optionally, if the counter information is generated by the primary base station according to the indication that the key needs to be updated, the key update method may further include: the primary base station sending the counter information to the secondary base station, so that the secondary base station according to at least the counter information and the A secret key generates a second secret key, and then generates a third secret key according to at least the second secret key and the algorithm information. or,

The key update method may further include: the primary base station generates a second key according to at least the counter information and the first key, and sends the second key to the secondary base station, so that the secondary base station generates the second key according to at least the second key and the algorithm information. The third key.

The first key is the access network root key of the primary base station, and the third key is applied to data transmission between the UE and the secondary base station.

In this embodiment, the primary base station sends the counter information to the secondary base station, or sends the second key to the secondary base station, so that the secondary base station generates the third key, and the third key is used between the UE and the secondary base station. Communication ensures the accuracy of data transmission.

Further, when the key needs to be updated, as shown in FIG. 7, the step “the primary base station acquires the first indication information” includes:

Step 601: The primary base station receives the second indication information sent by the secondary base station, where the second indication information may include an indication that the key needs to be updated, configuration information, and handover indication information.

Step 602: The primary base station generates counter information according to an indication that the key needs to be updated.

Step 603: The primary base station generates first indication information according to the counter information, the configuration information, and the handover indication information.

Further, as shown in FIG. 8, the step “the primary base station generates the first indication information according to the counter information, the configuration information, and the handover indication information” includes:

Step 6031: The primary base station sends the counter information to the secondary base station, so that the secondary base station encapsulates the counter information.

Step 6032: The primary base station generates first indication information according to the encapsulated counter information, configuration information, and handover indication information.

The key update method provided by the embodiment of the present application is the implementation method of the primary base station side corresponding to the embodiment shown in FIG. 2 to FIG. 5 , and the implementation principle and the beneficial effects thereof can be referred to the implementation principles of the embodiments shown in FIG. 2 and FIG. 5 . The beneficial effects will not be described here.

FIG. 9 is a flowchart of a method for updating a secret key according to another embodiment of the present application. The embodiment relates to a process in which the secondary base station acquires the first indication information, and sends the first indication information to the UE, so that the UE completes the key update or keeps the key unchanged according to the first indication information, as shown in FIG. The embodiment includes the following steps:

Step 701: The secondary base station acquires first indication information, where the first indication information includes information about a key update, and the secret key is used for communication between the UE and the secondary base station.

Step 702: The secondary base station sends the first indication information to the user equipment UE, so that the UE completes the key update or keeps the key unchanged according to the first indication information.

Optionally, the secondary base station sends the first indication information to the user equipment UE, where the secondary base station sends the first indication information to the UE by using the primary base station.

In this embodiment, the secondary base station may send the first indication information to the UE by using the primary base station, or may directly send the first indication information to the UE. For example, when the first indication information indicates that the key does not need to be updated, the secondary base station may directly send the first indication information to the UE, and when the first indication information indicates that the key needs to be updated, the secondary base station sends the first indication information to the primary The base station processes the first indication information by the primary base station and then sends the first indication information to the UE.

Optionally, in the embodiment shown in FIG. 9, the first indication information includes an indication that the key does not need to be updated, and the indication that the key does not need to be updated is used to indicate that the UE keeps the key unchanged.

Optionally, in the embodiment shown in FIG. 9, the first indication information includes an indication that the key needs to be updated, and the indication that the key needs to be updated is used to instruct the UE to complete the key update.

Further, the first indication information further includes configuration information and handover indication information; the configuration information includes packet data convergence protocol PDCP layer configuration information and algorithm information; and the handover indication information is used to indicate that the UE performs base station handover or cell handover.

Further, the first indication information further includes counter information, where the counter information is information determined by the secondary base station according to the access network root key and the secret key update list of the secondary base station, and the key update list includes the access network root of the secondary base station. The mapping between key and counter information.

The key update method provided by the embodiment of the present application is the implementation method of the secondary base station side corresponding to the embodiment shown in FIG. 2 to FIG. 5 , and the implementation principle and the beneficial effects thereof can be referred to the implementation principles of the embodiments shown in FIG. 2 to FIG. 5 . The beneficial effects will not be described here.

FIG. 10 is a flowchart of a method for updating a secret key according to another embodiment of the present application. This embodiment relates to a process in which a primary base station encrypts and transmits a first NR radio resource control to a UE. As shown in FIG. 10, the method includes the following steps:

Step 801: The secondary base station sends first NR radio resource control (RRC) information to the primary base station.

Optionally, the first NR RRC information includes first indication information, and the first means that the information includes information about a key update.

Step 802: The primary base station performs encryption and integrity protection processing on the first NR RRC information by using the primary base station secret key to generate second NR RRC information.

Step 803: The primary base station sends the second NR RRC information to the UE.

In this embodiment, the UE includes a first communication module that is a module that performs a communication function with the primary base station, and a second communication module that is a module that performs a communication function with the secondary base station.

Step 804: The first communication module decrypts and completes the second NR RRC information by using the primary base station secret key, and obtains the first indication information.

Step 805: The first communications module sends the first indication information to the second communications module.

Step 806: The second communication module completes the key update or keeps the key unchanged according to the first indication information, and generates a first NR RRC response message.

Step 807: The second communications module sends the first NR RRC response message to the first communications module.

Step 808: The first communications module encrypts the first NR RRC response information by using a primary base station secret key to generate a second NR RRC response message.

Step 809: The first communications module sends the second NR RRC response message to the primary base station.

Step 8010: The primary base station decrypts and completes the second NR RRC response information by using the primary base station secret key, and obtains the first NR RRC response information.

Step 8011: The primary base station sends the first NR RRC response information to the secondary base station.

FIG. 11 is a flowchart of a method for updating a secret key according to another embodiment of the present application. This embodiment relates to a process in which a secondary base station encrypts and transmits a first NR radio resource control to a UE. As shown in FIG. 11, the method includes the following steps:

Step 901: The secondary base station performs encryption and integrity protection processing on the first NR RRC information by using the secondary base station secret key to generate second NR RRC information.

Step 902: The secondary base station sends the second NR RRC information to the primary base station.

Step 903: The primary base station sends the second NR RRC information to the UE.

Step 904: The first communications module sends the second NR RRC information to the second communications module.

Step 905: The second communication module decrypts and completes the second NR RRC information by using the secondary base station secret key, and obtains the first indication information.

Step 906: The second communication module completes the key update or keeps the key unchanged according to the first indication information, and generates a first NR RRC response message.

Step 907: The second communication module encrypts the first NR RRC response information by using the secondary base station secret key to generate a second NR RRC response message.

Step 908: The second communications module sends the second NR RRC response message to the first communications module.

Step 909: The first communications module sends the second NR RRC response message to the primary base station.

Step 9010: The primary base station sends the second NR RRC response message to the secondary base station.

Step 9011: The secondary base station uses the secondary base station secret key to perform decryption and integrity check on the second NR RRC response information, and obtains the first NR RRC response information.

The key update method provided by FIG. 10 and FIG. 11 is that the primary base station or the secondary base station performs encryption and integrity protection processing on the first NR radio resource control including the first indication information, thereby ensuring reliability and security of the key update. .

FIG. 12 is a device for updating a secret key according to an embodiment of the present invention. As shown in FIG. 12, the device includes an obtaining module 11 and a processing module 12. The obtaining module 11 is configured to obtain the first indication information; the first indication information includes information about the key update; the secret key is used for communication between the UE and the secondary base station; and the processing module 12 is configured to complete the key update according to the first indication information. Or keep the key unchanged.

Optionally, the obtaining module 11 is specifically configured to receive the first indication information that is sent by the primary base station or the secondary base station, where the first indication information includes an indication that the key does not need to be updated, and the processing module 12 is specifically configured to: maintain the key according to the first indication information. constant.

Optionally, the obtaining module 11 is configured to receive the first indication information sent by the primary base station, where the first indication information includes an indication that the key needs to be updated, and the processing module 12 is specifically configured to complete the key update according to the first indication information.

Further, the first indication information further includes configuration information, counter information, and handover indication information;

Counter information is used to complete the key update;

Optionally, as shown in FIG. 13, the processing module 12 includes a first communication module 121 and a second communication module 122. The first communication module 121 is a module that performs a communication function with the primary base station, and the second communication module 122 is configured to perform a module for performing communication functions by the secondary base station;

The first communication module 121 is configured to generate a second key according to at least the counter information and the first key, and send the second key to the second communication module 122; the first key is the access network root key of the primary base station. ;

The second communication module 122 is configured to establish a PDCP layer according to PDCP layer configuration information;

The second communication module 122 is configured to generate a third key according to at least a second key and algorithm information, where the third key is applied to data transmission between the UE and the secondary base station.

Alternatively, another implementation of FIG. 13 is as follows:

The first communication module 121 sends the configuration information, the counter information, and the first key to the second communication module 122; the first key is the access network root key of the primary base station;

The second communication module 122 generates a second key according to at least the counter information and the first key;

The second communication module 122 establishes a PDCP layer according to PDCP layer configuration information;

The second communication module 122 generates a third key according to at least a second key and algorithm information, and the third key is applied to data transmission between the UE and the secondary base station.

The implementation principle and beneficial effects of the key update device provided by the embodiment of the present application are similar to the implementation principles and beneficial effects of the key update method shown in FIG. 2 to FIG. 5, and details are not described herein again.

FIG. 14 is a device for updating a secret key according to another embodiment of the present application. As shown in FIG. 14, the device includes an obtaining module 21 and a sending module 22. The obtaining module 21 is configured to obtain the first indication information; the first indication information includes information about the key update; the secret key is used for communication between the UE and the secondary base station; and the sending module 22 is configured to send the first indication information to the user equipment. The UE, so that the UE completes the key update or keeps the key unchanged according to the first indication information.

Optionally, the first indication information includes an indication that the key does not need to be updated, and the indication that the key does not need to be updated is used to indicate that the UE keeps the key unchanged.

Optionally, the first indication information includes an indication that the key needs to be updated, and the indication that the key needs to be updated is used to instruct the UE to complete the key update.

Counter information is used to complete the key update;

Optionally, the obtaining module 21 is specifically configured to receive second indication information that is sent by the secondary base station, generate counter information according to the indication that the key needs to be updated, and generate first indication information according to the counter information, the configuration information, and the handover indication information; The indication information includes an indication that the key needs to be updated, configuration information, and handover indication information.

Further, the acquiring module 21 generates the first indication information according to the counter information, the configuration information, and the handover indication information, where the acquiring module 21 sends the counter information to the secondary base station, so that the secondary base station encapsulates the counter information; The counter information, the configuration information, and the handover indication information generate first indication information.

The implementation principle and beneficial effects of the key update device provided by the embodiment of the present application are similar to the implementation principles and beneficial effects of the key update method shown in FIG. 6-8, and details are not described herein again.

Another embodiment of the present application further provides a key update apparatus, and the structural block diagram of the apparatus is the same as that of FIG. 14. As shown in FIG. 14, the apparatus includes an acquisition module 21 and a transmission module 22. The obtaining module 21 acquires the first indication information; the first indication information includes information about the key update; the secret key is used for communication between the UE and the secondary base station; and the sending module 22 is configured to send the first indication information to the UE, so that The UE completes the key update or keeps the key unchanged according to the first indication information.

Further, the first indication information further includes configuration information and handover indication information;

Optionally, the sending module 22 is specifically configured to send the first indication information to the UE by using the primary base station.

The implementation principle and beneficial effects of the key update device provided by the embodiment of the present application are similar to the implementation principles and beneficial effects of the key update method shown in FIG. 9 , and details are not described herein again.

FIG. 15 is a device according to an embodiment of the present invention. As shown in FIG. 15, the device includes a processor 31 and a memory 32. The memory 32 is used to store instructions, and the processor 31 is configured to execute the memory. 32 stored instructions, when the processor 31 executes the instructions stored by the memory 32, the apparatus is operative to perform the method of any of the embodiments of FIGS.

In the specific implementation of the foregoing device, it should be understood that the processor may be a central processing unit (CPU), or may be other general-purpose processors, a digital signal processor (DSP), an application specific integrated circuit ( Application Specific Integrated Circuit (ASIC), etc. The general purpose processor may be a microprocessor or the processor or any conventional processor or the like. The steps of the method disclosed in connection with the present application may be directly embodied by hardware processor execution or by a combination of hardware and software modules in a processor.

All or part of the steps of implementing the above method embodiments may be performed by hardware associated with the program instructions. The aforementioned program can be stored in a readable memory. When the program is executed, the steps including the foregoing method embodiments are performed; and the foregoing memory (storage medium) includes: read-only memory (English: read-only memory, abbreviation: ROM), RAM, flash memory, hard disk, Solid state drive, magnetic tape (English: magnetic tape), floppy disk (English: floppy disk), optical disc (English: optical disc) and any combination thereof.

The embodiment of the present application further provides a communication system, where the communication system includes: a primary base station and a secondary base station; the primary base station is configured to perform the method for updating a secret key according to any of the embodiments in FIG. 6 to FIG. The secret key updating method described in the embodiment.

The embodiment of the present application further provides a secret key updating apparatus including at least one processing element (or chip) for performing the method described in any of the above Figures 2-11.

The embodiment of the present application further provides a program, when executed by a processor, for performing the method described in any of the above Figures 2-11.

The embodiment of the present application further provides a program product, such as a computer readable storage medium, including the program of the previous embodiment.

The embodiment of the present application further provides a computer readable storage medium having instructions stored therein that, when run on a computer, cause the computer to perform the method of any of the above-described FIGS. 2-11.

Claims

A method for updating a secret key, the method comprising:

The user equipment UE acquires first indication information; the first indication information includes information about the key update; the secret key is used for communication between the UE and the secondary base station;

The UE completes the key update or keeps the key unchanged according to the first indication information.
The method according to claim 1, wherein the acquiring, by the UE, the first indication information comprises:

Receiving, by the UE, the first indication information sent by the primary base station or the secondary base station; the first indication information includes an indication that the key does not need to be updated;

The UE completes the key update or keeps the key unchanged according to the first indication information, including:

The UE keeps the key unchanged according to the first indication information.
The method according to claim 2, wherein the first indication information further includes handover indication information, where the handover indication information is used to indicate that the UE performs base station handover or cell handover.
The method according to claim 1, wherein the acquiring, by the UE, the first indication information comprises:

Receiving, by the UE, the first indication information sent by the primary base station; the first indication information includes an indication that the key needs to be updated;

The UE completes the key update or keeps the key unchanged according to the first indication information, and includes:

The UE completes the key update according to the first indication information.
The method according to claim 4, wherein the first indication information further comprises configuration information, counter information, and handover indication information;

The configuration information includes packet data convergence protocol PDCP layer configuration information and algorithm information;

The counter information is used to complete the key update;

The handover indication information is used to indicate that the UE performs base station handover or cell handover.
The method according to claim 5, wherein the counter information is information determined by the secondary base station according to an access network root key and a secret key update list of the secondary base station, where the key update list includes a mapping relationship between the access network root key of the secondary base station and the counter information.
The method according to claim 5, wherein the counter information is information generated by the primary base station according to an indication that the key needs to be updated.
The method according to any one of claims 5 to 7, wherein the UE comprises a first communication module and a second communication module, and the first communication module is a module that performs a communication function with the primary base station The second communication module is a module that performs a communication function with the secondary base station;

The UE completes the key update according to the first indication information, including:

The first communication module generates a second key according to at least the counter information and the first key, and sends the second key to the second communication module; the first key is a primary base station Access network root key;

The second communication module establishes a PDCP layer according to the PDCP layer configuration information;

The second communication module generates a third key according to at least the second key and the algorithm information, and the third key is applied to data transmission between the UE and the secondary base station.
The method according to any one of claims 5 to 7, wherein the UE comprises a first communication module and a second communication module, and the first communication module is a module that performs a communication function with the primary base station The second communication module is a module that performs a communication function with the secondary base station;

The UE completes the key update according to the first indication information, including:

The first communication module sends the configuration information, the counter information, and the first key to the second communication module; the first key is an access network root key of the primary base station;

The second communication module generates a second key according to at least the counter information and the first key;

The second communication module establishes a PDCP layer according to the PDCP layer configuration information;

The second communication module generates a third key according to at least the second key and the algorithm information, and the third key is applied to data transmission between the UE and the secondary base station.
A method for updating a secret key, the method comprising:

The primary base station acquires first indication information; the first indication information includes information about the key update; the secret key is used for communication between the UE and the secondary base station;

The primary base station sends the first indication information to the user equipment UE, so that the UE completes the key update or keeps the key unchanged according to the first indication information.
The method according to claim 10, wherein the first indication information comprises an indication that the key does not need to be updated, and the indication that the key does not need to be updated is used to indicate that the UE keeps the key constant.
The method according to claim 11, wherein the first indication information further includes handover indication information, where the handover indication information is used to indicate that the UE performs base station handover or cell handover.
The method according to claim 10, wherein the first indication information comprises an indication that the key needs to be updated, and the indication that the key needs to be updated is used to instruct the UE to complete the key update.
The method according to claim 13, wherein the first indication information further comprises configuration information, counter information, and handover indication information;

The configuration information includes packet data convergence protocol PDCP layer configuration information and algorithm information;

The counter information is used to complete the key update;

The handover indication information is used to indicate that the UE performs base station handover or cell handover.
The method according to claim 14, wherein the counter information is information determined by the secondary base station according to the access network root key and the secret key update list of the secondary base station, where the key update list includes the A mapping relationship between the access network root key of the secondary base station and the counter information.
The method according to claim 14, wherein the counter information is information generated by the primary base station according to an indication that the key needs to be updated.
The method according to claim 16, wherein the acquiring, by the primary base station, the first indication information comprises:

The primary base station receives the second indication information sent by the secondary base station; the second indication information includes an indication that the key needs to be updated, the configuration information, and the handover indication information;

The primary base station generates the counter information according to an indication that the key needs to be updated;

The primary base station generates the first indication information according to the counter information, the configuration information, and the handover indication information.
The method according to claim 17, wherein the generating, by the primary base station, the first indication information according to the counter information, the configuration information, and the handover indication information comprises:

Sending, by the primary base station, the counter information to the secondary base station, so that the secondary base station encapsulates the counter information;

The primary base station generates the first indication information according to the encapsulated counter information, the configuration information, and the handover indication information.
A method for updating a secret key, the method comprising:

The secondary base station acquires first indication information, where the first indication information includes information about the key update, and the secret key is used for communication between the UE and the secondary base station;

The secondary base station sends the first indication information to the user equipment UE, so that the UE completes the key update or keeps the key unchanged according to the first indication information.
The method according to claim 19, wherein the first indication information comprises an indication that the key does not need to be updated, and the indication that the key does not need to be updated is used to indicate that the UE keeps the key constant.
The method according to claim 20, wherein the first indication information further comprises handover indication information, and the handover indication information is used to indicate that the UE performs base station handover or cell handover.
The method according to claim 19, wherein the first indication information comprises an indication that the key needs to be updated, and the indication that the key needs to be updated is used to instruct the UE to complete the key update.
The method according to claim 22, wherein the first indication information further comprises configuration information and handover indication information;

The configuration information includes packet data convergence protocol PDCP layer configuration information and algorithm information;

The handover indication information is used to indicate that the UE performs base station handover or cell handover.
The method according to claim 23, wherein the first indication information further comprises counter information, where the counter information is determined by the secondary base station according to the access network root key and the secret key update list of the secondary base station. The information, the key update list includes a mapping relationship between the access network root key of the secondary base station and the counter information.
The method according to any one of claims 19 to 24, wherein the sending, by the secondary base station, the first indication information to the user equipment UE includes:

The secondary base station sends the first indication information to the UE by using a primary base station.
An apparatus, comprising: a processor and a memory;

The memory is for storing instructions for executing the memory stored instructions, the apparatus for performing any one of claims 1 to 25 when the processor executes the memory stored instructions Said method.