CN104735626A - Achieving method and device for trunking group communication public security - Google Patents
Achieving method and device for trunking group communication public security Download PDFInfo
- Publication number
- CN104735626A CN104735626A CN201310714496.4A CN201310714496A CN104735626A CN 104735626 A CN104735626 A CN 104735626A CN 201310714496 A CN201310714496 A CN 201310714496A CN 104735626 A CN104735626 A CN 104735626A
- Authority
- CN
- China
- Prior art keywords
- key
- group
- random number
- network side
- integrity protection
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L12/00—Data switching networks
- H04L12/02—Details
- H04L12/16—Arrangements for providing special services to substations
- H04L12/18—Arrangements for providing special services to substations for broadcast or conference, e.g. multicast
- H04L12/1813—Arrangements for providing special services to substations for broadcast or conference, e.g. multicast for computer conferences, e.g. chat rooms
- H04L12/1818—Conference organisation arrangements, e.g. handling schedules, setting up parameters needed by nodes to attend a conference, booking network resources, notifying involved parties
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
- H04L63/065—Network architectures or network communication protocols for network security for supporting key management in a packet data network for group communications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
- H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
- H04L9/0869—Generation of secret information including derivation or calculation of cryptographic keys or passwords involving random numbers or seeds
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
- H04L9/3236—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions
- H04L9/3242—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
- H04W12/043—Key management, e.g. using generic bootstrapping architecture [GBA] using a trusted network node as an anchor
- H04W12/0431—Key distribution or pre-distribution; Key agreement
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04M—TELEPHONIC COMMUNICATION
- H04M2203/00—Aspects of automatic or semi-automatic exchanges
- H04M2203/15—Aspects of automatic or semi-automatic exchanges related to dial plan and call routing
- H04M2203/152—Temporary dial plan
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04M—TELEPHONIC COMMUNICATION
- H04M2203/00—Aspects of automatic or semi-automatic exchanges
- H04M2203/60—Aspects of automatic or semi-automatic exchanges related to security aspects in telephonic communication systems
- H04M2203/609—Secret communication
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04M—TELEPHONIC COMMUNICATION
- H04M3/00—Automatic or semi-automatic exchanges
- H04M3/42—Systems providing special services or facilities to subscribers
- H04M3/50—Centralised arrangements for answering calls; Centralised arrangements for recording messages for absent or busy subscribers ; Centralised arrangements for recording messages
- H04M3/51—Centralised call answering arrangements requiring operator intervention, e.g. call or contact centers for telemarketing
- H04M3/5116—Centralised call answering arrangements requiring operator intervention, e.g. call or contact centers for telemarketing for emergency applications
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- General Engineering & Computer Science (AREA)
- Power Engineering (AREA)
- Computer Hardware Design (AREA)
- Computing Systems (AREA)
- Multimedia (AREA)
- Mobile Radio Communication Systems (AREA)
Abstract
The invention provides an achieving method and device for trunking group communication public security. The achieving method comprises the steps that when a terminal in a group initiates group calling, random numbers from a network side are received; according to the random numbers and a root key obtained from the network side in advance, an intermediate parameter is generated, and a first key used for NAS decryption of a non-access layer and integrity protection is also generated; according to the intermediate parameter, a second key is generated; according to the second key, decryption and integrity protection are conducted on data from a trunking group control channel TGCCH and a trunking group service channel TGTCH. By the adoption of the technical scheme, the problem that in relevant techniques, the purpose that a terminal on a downlink public channel achieves the security of multiple users for the point-to-multi-point trunking group service cannot be achieved is solved, and therefore the safety mechanism of a trunking group communication channel of trunking group UE sides is achieved.
Description
Technical field
The communications field of the present invention, more particularly, relates to a kind of implementation method and device of trunking communication public safety.
Background technology
In existing LTE system, descending common broadcast channel does not do safeguard protection, and dedicated channel then each user has its security parameter alone.But due to the specific demand of cluster, need jointly to monitor a common signal channel with the multiple user of group, so just need multiple security parameters to want synchronous.
At present in correlation technique, support terminal is not on common down channel, for point-to-points this group service, realizes the problem of the safety of multi-user, not yet proposes effective solution at present.
Summary of the invention
The invention provides a kind of method and device of trunking communication public safety, at least to solve in correlation technique, support terminal is not on common down channel, for point-to-points this group service, realizes the problem of the safety of multi-user.
In order to achieve the above object, according to an aspect of the present invention, provide a kind of implementation method of trunking communication public safety, comprising: when the terminal in group initiates group calling, receive the random number from network side; Intermediate parameters is generated according to described random number and the root key that obtains from network side in advance, and for Non-Access Stratum (Non-Access Stratum, referred to as NAS) deciphering and the first key of integrity protection; The second key is generated according to described intermediate parameters; According to described second double secret key from clustered control channel (Trunking Group Control Channel; referred to as TGCCH) and the decrypt data of group service channel (TrunkingGroup Traffic Channel, referred to as TGTCH) and integrity protection.
Preferably, generate the second key according to described intermediate parameters, comprising: utilize Secret splitting algorithm (Key Distribution Algorithm, referred to as KDF) algorithm to generate described second key according to described intermediate parameters.
Preferably, receive the random number from network side, comprising: the beep-page message receiving described network side; Described random number is obtained from described beep-page message.
Preferably, described first key, comprising: for the first sub-key of NAS deciphering, the second sub-key for NAS integrity protection; And/or described second key, comprising: for signaling deciphering and the 3rd sub-key of integrity protection, the 4th sub-key for the data deciphering of TGTCH of TGCCH.
Preferably, describedly also to comprise: after described group calling terminates, retain described root key, and delete described random number, described first key and described second key.
Preferably, described method also comprises: in described decrypt data process, be decrypted by identical counting Count value the data acquisition that the terminal in described group receives.
Preferably, described method also comprises: before described terminal initiates group calling, receives the described root key that network side sends.
In order to achieve the above object, according to a further aspect of the invention, additionally provide a kind of implement device of trunking communication public safety, comprising: receiver module, when initiating group calling for the terminal in group, receive the random number from network side; First generation module, for generating intermediate parameters according to described random number and the root key that obtains from network side in advance, and deciphers and the first key of integrity protection for Non-Access Stratum NAS; Second generation module, for generating the second key according to described intermediate parameters; Processing module, for according to described second double secret key from the decrypt data of clustered control channel TGCCH and group service channel TGTCH and integrity protection.
Preferably, described second generation module is also for utilizing KDF algorithm to generate described second key according to described intermediate parameters.
Preferably, described receiver module, comprising: receiving element, for receiving the beep-page message of described network side; Acquiring unit, for obtaining described random number from described beep-page message.
Pass through the present invention, adopt when the terminal in group initiates group calling, according to the random number received from network side and in advance from the root key that network side obtains, generate and be used for Non-Access Stratum NAS and decipher and the first key of integrity protection and the technical scheme for generating the intermediate parameters from clustered control channel TGCCH and the decrypt data of group service channel TGTCH channel and the second key of integrity protection, solve in correlation technique, support terminal is not on common down channel, for point-to-points this group service, realize the problem of the safety of multi-user.Thus achieve the security mechanism that cluster user equipment (User Equipment, referred to as UE) holds common down channel.
Accompanying drawing explanation
Accompanying drawing described herein is used to provide a further understanding of the present invention, and form a application's part, schematic description and description of the present invention, for explaining the present invention, does not form inappropriate limitation of the present invention.In the accompanying drawings:
Fig. 1 is the flow chart of the implementation method of trunking communication public safety according to the embodiment of the present invention;
Fig. 2 is the schematic flow sheet generating Kgnasenc according to root key Kg according to the embodiment of the present invention;
Fig. 3 is the schematic flow sheet generating Kgnasint according to root key Kg according to the embodiment of the present invention;
Fig. 4 is the schematic flow sheet generating Kgenb according to root key Kg according to the embodiment of the present invention;
Fig. 5 is the schematic flow sheet generating Kgupenc according to Kgenb according to the embodiment of the present invention;
Fig. 6 is the schematic flow sheet generating Kgrrcenc according to Kgenb according to the embodiment of the present invention;
Fig. 7 is the schematic flow sheet generating Kgrrcint according to Kgenb according to the embodiment of the present invention;
Fig. 8 is the deciphering schematic diagram of the steady state data according to the embodiment of the present invention;
Fig. 9 is the Organization Chart of group system according to the preferred embodiment of the invention;
Figure 10 is the structure chart of the implement device of trunking communication public safety according to the embodiment of the present invention;
Figure 11 is a structure chart again of the implement device of trunking communication public safety according to the embodiment of the present invention.
Embodiment
Hereinafter also describe the present invention in detail with reference to accompanying drawing in conjunction with the embodiments.It should be noted that, when not conflicting, the embodiment in the application and the feature in embodiment can combine mutually.
Fig. 1 is the flow chart of the implementation method of trunking communication public safety according to the embodiment of the present invention.As shown in Figure 1, the method comprises: step S102 to step S108,
S102: when the terminal in group initiates group calling, receive the random number from network side; Terminal in group also needs to there are following steps: starting up of terminal has been registered before initiating group calling, and network side initiates the root key that group information updating receives network side transmission.The root key that the embodiment of the present invention provides is different from existing LTE system, and such as: in existing LTE system, root key Kg is solidificated in inside SIM card.And the user that the root key that the embodiment of the present invention provides is same group has same root key Kg, so can not be solidificated in SIM card.But be carried to each terminal by NAS signaling.And this NAS signaling is LTE safeguard protection, so be safe.
In this step S102, the random number received from network side can comprise: the beep-page message receiving above-mentioned network side; Above-mentioned random number is obtained from above-mentioned beep-page message.
S104: generate intermediate parameters according to above-mentioned random number and the root key that obtains from network side in advance, and for NAS deciphering and the first key of integrity protection.
In the present embodiment, above-mentioned first key, comprising: for the first sub-key of NAS deciphering, the second sub-key for NAS integrity protection.In the present embodiment, the first sub-key in the first key determined according to random number and above-mentioned root key and the second sub-key can specifically be respectively: for the K value Kgnasenc of NAS layer encryption and decryption and the K value Kgnasint for NAS layer integrity protection; Above-mentioned intermediate parameters can be specially: for generating the K value Kgenb of air interface key further.
As shown in Figure 2, Fig. 2 is the schematic flow sheet generating Kgnasenc according to root key Kg according to the embodiment of the present invention.In fig. 2, the ginseng that enters wherein used is NAS cryptographic algorithm Alg, group id, and random number R and, and each parameter wherein used is as follows: (1) KDF function input key is Kg; (2) each parameter constructing byte serial s is respectively: FC=0x15 parameter p 0=Alg-ID, and cryptographic algorithm identifies, and is 0x00 during use EEA0 algorithm, is 0x01 during use 128-EEA1 algorithm, is 0x02 during use 128-EEA2 algorithm; Parameter L0=0x000x01; Parameter p 1=NAS-enc-alg, 0x01; Parameter L1=0x000x01; P2=GID, group mark, 64bit; L2=0x000x08; P3=Rand; L3=0x000x04(3) KDF function exports the key of 256bit, and because NAS cryptographic algorithm needs use 128 to input key, the low 128bit therefore intercepting the 256bit that KDF exports is Kgnasenc.
As shown in Figure 3, Fig. 3 is the schematic flow sheet generating Kgnasint according to root key Kg according to the embodiment of the present invention.In figure 3, the ginseng that enters wherein used is NAS protection algorithm integrallty Alg, group ID, and random number R and, and each parameter wherein used is as follows: (1) KDF function input key is Kg; (2) each parameter constructing byte serial s is respectively: FC=0x15; Parameter p 0=Alg-ID, cryptographic algorithm identifies, and is 0x00 during use EIA0 algorithm, is 0x01 during use 128-EIA1 algorithm, is 0x02 during use 128-EIA2 algorithm; Parameter L0=0x000x01; Parameter p 1=NAS-int-alg, 0x02; Parameter L1=0x000x01; P2=GID, group mark, 64bit; L2=0x00,0x08; P3=Rand; L3=0x000x04(3) KDF function exports the key of 256bit, and because NAS protection algorithm integrallty needs use 128 keys, the low 128bit therefore intercepting the 256bit that KDF exports is Kgnasint.
As shown in Figure 4, Fig. 4 is the schematic flow sheet generating Kgenb according to root key Kg according to the embodiment of the present invention.In the diagram, wherein entering ginseng is SN and random number R and, and each parameter wherein used is as follows: (1) KDF function input key is Kg; (2) each parameter constructing byte serial s is respectively: FC=0x11 parameter p 0=SN id, SN id is by travelling carriage national code (Mobile CountryCode, referred to as MCC) specifically can inquire about LTE standard with mobile network code, MNC (Mobile Network Code, referred to as MNC) according to such as following table 1() shown in rule form:
Table 1
Wherein, the length of parameter L0=p0 is 0x000x03 parameter p 1=Rand, and 32bit, Rand are the length of the random number parameter L1=p1 that each group calling is generated by PHR when setting up, and are 0x000x04.Wherein, digital 1-8 represents 8 bits in byte.
S106: generate the second key according to above-mentioned intermediate parameters.
Wherein, according to intermediate parameters generate two keys utilize be KDF, in addition, above-mentioned second key, comprising: for TGCCH signaling deciphering and the 3rd sub-key of integrity protection, the 4th sub-key for the data deciphering of TGTCH.In the present embodiment, above-mentioned 3rd sub-key can be specially: Kgrrcint, Kgrrcenc, and the 4th sub-key can be specially: Kgupenc.
As shown in Figure 5, Fig. 5 is the schematic flow sheet generating Kgupenc according to Kgenb according to the embodiment of the present invention.In Figure 5, the ginseng that enters wherein used is UP cryptographic algorithm Alg, group id, and random number R and, and each parameter wherein used is as follows: (1) KDF function input key is Kgenb; (2) each parameter constructing byte serial s is respectively: FC=0x15 parameter p 0=Alg-ID, and cryptographic algorithm identifies, and is 0x00 during use EEA0 algorithm, is 0x01 during use 128-EEA1 algorithm, is 0x02 during use 128-EEA2 algorithm; Parameter L0=0x000x01; Parameter p 1=UP-enc-alg, 0x05; Parameter L1=0x000x01; P2=GID, group mark, 64bit; L2=0x00,0x08; P3=Rand; L3=0x00 0x04(3) KDF function exports the key of 256bit, and because UP cryptographic algorithm needs use 128 keys, the low 128bit therefore intercepting the 256bit that KDF exports is Kgupenc.
As shown in Figure 6, Fig. 6 is the schematic flow sheet generating Kgrrcenc according to Kgenb according to the embodiment of the present invention.In figure 6, the ginseng that enters wherein used is RRC cryptographic algorithm Alg, group id, and random number R and, and each parameter wherein used is as follows: (1) KDF function input key is Kgenb; (2) each parameter constructing byte serial s is respectively: FC=0x15 parameter p 0=Alg-ID, and cryptographic algorithm identifies, and is 0x00 during use EEA0 algorithm, is 0x01 during use 128-EEA1 algorithm, is 0x02 during use 128-EEA2 algorithm; Parameter L0=0x00 0x01; Parameter p 1=RRC-enc-alg, 0x03; Parameter L1=0x000x01; P2=GID, group mark, 64bit; L2=0x00,0x08; P3=Rand; L3=0x00 0x04(3) KDF function exports the key of 256bit, and because UP cryptographic algorithm needs use 128 keys, the low 128bit therefore intercepting the 256bit that KDF exports is Kgrrcenc.
As shown in Figure 7, Fig. 7 is the schematic flow sheet generating Kgrrcint according to Kgenb according to the embodiment of the present invention.In the figure 7, the ginseng that enters wherein used is RRC protection algorithm integrallty Alg, group id, and random number R and, and each parameter wherein used is as follows: (1) KDF function input key is Kgenb; (2) each parameter constructing byte serial s is respectively: FC=0x15 parameter p 0=Alg-ID, and cryptographic algorithm identifies, and is 0x00 during use EEA0 algorithm, is 0x01 during use 128-EEA1 algorithm, is 0x02 during use 128-EEA2 algorithm; Parameter L0=0x00 0x01; Parameter p 1=RRC-int-alg, 0x04; Parameter L1=0x00 0x01; P2=GID, group mark, 64bit; L2=0x00,0x08; P3=Rand; L3=0x00 0x04(3) KDF function exports the key of 256bit, and because UP cryptographic algorithm needs use 128 keys, the low 128bit therefore intercepting the 256bit that KDF exports is Kgrrcint.
S108: according to above-mentioned second double secret key from the decrypt data of TGCCH and TGTCH and integrity protection.
At above-mentioned steps S102 to after step S108 is finished, start the signaling and the data that receive TGCCH and TGTCH channel, carry out normal group service.The wherein signaling public safety key K grrcenc of TGCCH channel; Kgrrcint is decrypted and integrity protection; the user face data of TGTCH is decrypted by key K gupenc; and after above-mentioned group calling terminates; retain above-mentioned root key, and delete above-mentioned random number, above-mentioned first key and above-mentioned second key.
The decrypting process related in the present embodiment: namely in above-mentioned decrypt data process, be that the data acquisition that the terminal in above-mentioned group receives is decrypted by identical counting Count value.
In existing LTE system, user's deciphering needs to use a count value, count=hfn+sn, and whenever sn overturns time, hfn increases progressively 1.And in the embodiment of the present application, the user accessed to make different time can successful decryption, when being designed to solidification hfn, sn upset, do not increase progressively the mode of hfn.Thus the user of the access that makes first to access and lag can correct decrypted user face data.
In order to better understand above-mentioned decrypting process, Fig. 8 is the deciphering schematic diagram of the steady state data according to the embodiment of the present invention.As shown in Figure 8, based on the principle shown in Fig. 8, following treatment step can be adopted to be decrypted steady state data:
Step one: obtain corresponding key value, BRARER value, data length length, encryption and decryption direction direction, and count value (wherein count value=hfn+sn, because sn upset does not increase progressively hfn, so each terminal can calculate same count value by receiving the packet of eNB).
Step 2: obtain keystream block by cryptographic algorithm.
Step 3: the keystream block of data code flow to be encrypted and generation is encrypted.
By each step above-mentioned, when initiating group calling by the terminal in group, according to the random number received from network side and in advance from the root key that network side obtains, generate and be used for Non-Access Stratum NAS and decipher and the first key of integrity protection and the technical scheme for generating the intermediate parameters from clustered control channel TGCCH and the decrypt data of group service channel TGTCH channel and the second key of integrity protection, solve in correlation technique, support terminal is not on common down channel, for point-to-points this group service, realize the problem of the safety of multi-user.Thus achieve the security mechanism that cluster UE holds common down channel.The random number that the embodiment of the present invention provides is carried in the paging, and purposes is to make each group calling can generate different keys.
In order to better understand the implementation procedure of above-mentioned trunking communication public safety, Fig. 9 is the Organization Chart of group system according to the preferred embodiment of the invention.As shown in Figure 9,
Step one: Kg corresponding for each group is issued terminal by group information updating process by core net.
Step 2: certain group initiates group calling, nets side by generation random number, by paging delivery to the terminal of this group (UE, User Equipment).
Step 3: terminal calculates each key value corresponding, for integrity protection and deciphering by the security algorithm of random number GroupCallRand and Kg and solidification.
Wherein, the design of random number GroupCallRand: to the repeatedly group calling of same group, Kg is constant, in order to do not cracked easily, need to make to initiate this group group calling at every turn, can have different keys, the random number that the embodiment of the present invention provides is carried in the paging, and purposes is to make each group calling can generate different keys.It should be noted that, PDS is the abbreviation of Personal Digital System in fig .9, can be translated into personal digital system, PHS is the abbreviation of Personal Handy phone System, can be translated into hand-phone system, eNB is the abbreviation of E-UTRAN NodeB, can be translated into evolved base station.
Additionally provide a kind of implement device of trunking communication public safety in the present embodiment, for realizing above-described embodiment and preferred implementation, having carried out repeating no more of explanation, and below the module related in this device being described.As used below, term " module " can realize the software of predetermined function and/or the combination of hardware.Although the device described by following examples preferably realizes with software, hardware, or the realization of the combination of software and hardware also may and conceived.Figure 10 is the structure chart of the implement device of trunking communication public safety according to the embodiment of the present invention.As shown in Figure 10, this device comprises:
Receiver module 102, when initiating group calling for the terminal in group, receives the random number from network side;
The further improvement of the embodiment of the present invention to technique scheme is, receiver module 102 is also for utilizing KDF algorithm to generate above-mentioned second key according to above-mentioned intermediate parameters.
First generation module 104, is connected with receiver module 102, for generating intermediate parameters according to above-mentioned random number and the root key that obtains from network side in advance, and deciphers and the first key of integrity protection for Non-Access Stratum NAS;
Second generation module 106, is connected with the first generation module 104, for generating the second key according to described intermediate parameters;
Processing module 108, is connected with the second generation module 106, for according to above-mentioned second double secret key from the decrypt data of TGCCH and TGTCH and integrity protection.
In the present embodiment, as shown in figure 11, receiver module 102 also comprises:
Receiving element 1022, for receiving the beep-page message of above-mentioned network side;
Acquiring unit 1024, is connected with receiving element 1022, for obtaining above-mentioned random number from above-mentioned beep-page message.
By each step above-mentioned, when initiating group calling by the terminal in group, the random number that first generation module 104 receives from network side according to receiver module 102 and in advance from the root key that network side obtains, generate and be used for Non-Access Stratum NAS and decipher and the first key of integrity protection and processing module 108 generate the technical scheme of the second double secret key from clustered control channel TGCCH and the decrypt data of group service channel TGTCH channel and the intermediate parameters of integrity protection according to the second generation module 106, solve in correlation technique, support terminal is not on common down channel, for point-to-points this group service, realize the problem of the safety of multi-user.Thus achieve the security mechanism that cluster UE holds common down channel.The random number that the embodiment of the present invention provides is carried in the paging, and purposes is to make each group calling can generate different keys.
In sum, the technique scheme that the embodiment of the present invention provides reaches following effect: solve in correlation technique, support terminal is not on common down channel, for point-to-points this group service, realizes the problem of the safety of multi-user.Thus achieve the security mechanism that cluster UE holds common down channel.The random number that the embodiment of the present invention provides is carried in the paging, and purposes is to make each group calling can generate different keys.
Obviously, those skilled in the art should be understood that, above-mentioned of the present invention each device or each step can realize with general calculation element, they can concentrate on single calculation element, or be distributed on network that multiple calculation element forms, alternatively, they can realize with the executable program code of calculation element, thus, they can be stored and be performed by calculation element in the storage device, and in some cases, step shown or described by can performing with the order be different from herein, or they are made into each integrated circuit modules respectively, or the multiple module in them or step are made into single integrated circuit module to realize.Like this, the present invention is not restricted to any specific hardware and software combination.
These are only the preferred embodiments of the present invention, be not limited to the present invention, for a person skilled in the art, the present invention can have various modifications and variations.Within the spirit and principles in the present invention all, any amendment done, equivalent replacement, improvement etc., all should be included within protection scope of the present invention.
Claims (10)
1. an implementation method for trunking communication public safety, is characterized in that, comprising:
When the terminal in group initiates group calling, receive the random number from network side;
Generate intermediate parameters according to described random number and the root key that obtains from network side in advance, and decipher and the first key of integrity protection for Non-Access Stratum NAS;
The second key is generated according to described intermediate parameters;
According to described second double secret key from the decrypt data of clustered control channel TGCCH and group service channel TGTCH and integrity protection.
2. method according to claim 1, is characterized in that, generates the second key, comprising according to described intermediate parameters:
Secret splitting algorithm KDF algorithm is utilized to generate described second key according to described intermediate parameters.
3. method according to claim 1, is characterized in that, receives the random number from network side, comprising:
Receive the beep-page message of described network side;
Described random number is obtained from described beep-page message.
4. method according to claim 1, is characterized in that,
Described first key, comprising: for the first sub-key of NAS deciphering, the second sub-key for NAS integrity protection; And/or
Described second key, comprising: for signaling deciphering and the 3rd sub-key of integrity protection, the 4th sub-key for the data deciphering of TGTCH of TGCCH.
5. method according to claim 1, is characterized in that, also comprises:
After described group calling terminates, retain described root key, and delete described random number, described first key and described second key.
6. according to the method described in claim 1 to 5, it is characterized in that, described method also comprises:
To in described decrypt data process, the data acquisition that the terminal in described group receives is decrypted by identical counting Count value.
7. according to the method described in claim 1 to 5, it is characterized in that, also comprise:
Before described terminal initiates group calling, receive the described root key that network side sends.
8. an implement device for trunking communication public safety, is characterized in that, comprising:
Receiver module, when initiating group calling for the terminal in group, receives the random number from network side;
First generation module, for generating intermediate parameters according to described random number and the root key that obtains from network side in advance, and deciphers and the first key of integrity protection for Non-Access Stratum NAS;
Second generation module, for generating the second key according to described intermediate parameters;
Processing module, for according to described second double secret key from the decrypt data of clustered control channel TGCCH and group service channel TGTCH and integrity protection.
9. device according to claim 8, is characterized in that, described second generation module is also for utilizing KDF algorithm to generate described second key according to described intermediate parameters.
10. device according to claim 8, is characterized in that, described receiver module, comprising:
Receiving element, for receiving the beep-page message of described network side;
Acquiring unit, for obtaining described random number from described beep-page message.
Priority Applications (2)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201310714496.4A CN104735626A (en) | 2013-12-20 | 2013-12-20 | Achieving method and device for trunking group communication public security |
| PCT/CN2014/078185 WO2014180390A2 (en) | 2013-12-20 | 2014-05-22 | Trunking group communication public security implementation method and device |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201310714496.4A CN104735626A (en) | 2013-12-20 | 2013-12-20 | Achieving method and device for trunking group communication public security |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN104735626A true CN104735626A (en) | 2015-06-24 |
Family
ID=51867811
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201310714496.4A Pending CN104735626A (en) | 2013-12-20 | 2013-12-20 | Achieving method and device for trunking group communication public security |
Country Status (2)
| Country | Link |
|---|---|
| CN (1) | CN104735626A (en) |
| WO (1) | WO2014180390A2 (en) |
Cited By (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN107529159A (en) * | 2016-06-22 | 2017-12-29 | 中兴通讯股份有限公司 | The Access Layer encryption of broadband cluster DSCH Downlink Shared Channel, decryption, completeness protection method and device, safety implementation method |
| CN107820221A (en) * | 2016-09-12 | 2018-03-20 | 大唐移动通信设备有限公司 | Cluster multi call business encryption method and cluster core net |
| CN109729522A (en) * | 2017-10-27 | 2019-05-07 | 普天信息技术有限公司 | Eat dishes without rice or wine encryption method and device under fail soft mode |
Families Citing this family (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN112954610B (en) * | 2019-11-22 | 2022-07-26 | 成都鼎桥通信技术有限公司 | Group signaling transmission method and device |
Citations (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN1592175A (en) * | 2003-09-04 | 2005-03-09 | 华为技术有限公司 | Method for producing long code mask for cluster service |
| CN1601957A (en) * | 2003-09-22 | 2005-03-30 | 华为技术有限公司 | Method of distributing group secret keys |
| CN102291680A (en) * | 2010-06-18 | 2011-12-21 | 普天信息技术研究院有限公司 | Encrypted group calling method based on long term evolution (TD-LTE) trunking communication system |
| CN103179558A (en) * | 2012-09-20 | 2013-06-26 | 中兴通讯股份有限公司 | Method and system for cluster system implementing group calling encryption |
| CN103297958A (en) * | 2012-02-22 | 2013-09-11 | 华为技术有限公司 | Security context establishing method, device and system |
| CN103369523A (en) * | 2013-07-18 | 2013-10-23 | 成都鼎桥通信技术有限公司 | Method for improving cluster downlink safety |
| EP2648437A4 (en) * | 2010-12-22 | 2013-12-18 | Huawei Tech Co Ltd | Method, apparatus and system for key generation |
Family Cites Families (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102300167A (en) * | 2010-06-23 | 2011-12-28 | 中兴通讯股份有限公司 | Method and system for realizing fail soft |
| CN102625300B (en) * | 2011-01-28 | 2015-07-08 | 华为技术有限公司 | Generation method and device for key |
-
2013
- 2013-12-20 CN CN201310714496.4A patent/CN104735626A/en active Pending
-
2014
- 2014-05-22 WO PCT/CN2014/078185 patent/WO2014180390A2/en active Application Filing
Patent Citations (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN1592175A (en) * | 2003-09-04 | 2005-03-09 | 华为技术有限公司 | Method for producing long code mask for cluster service |
| CN1601957A (en) * | 2003-09-22 | 2005-03-30 | 华为技术有限公司 | Method of distributing group secret keys |
| CN102291680A (en) * | 2010-06-18 | 2011-12-21 | 普天信息技术研究院有限公司 | Encrypted group calling method based on long term evolution (TD-LTE) trunking communication system |
| EP2648437A4 (en) * | 2010-12-22 | 2013-12-18 | Huawei Tech Co Ltd | Method, apparatus and system for key generation |
| CN103297958A (en) * | 2012-02-22 | 2013-09-11 | 华为技术有限公司 | Security context establishing method, device and system |
| CN103179558A (en) * | 2012-09-20 | 2013-06-26 | 中兴通讯股份有限公司 | Method and system for cluster system implementing group calling encryption |
| CN103369523A (en) * | 2013-07-18 | 2013-10-23 | 成都鼎桥通信技术有限公司 | Method for improving cluster downlink safety |
Cited By (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN107529159A (en) * | 2016-06-22 | 2017-12-29 | 中兴通讯股份有限公司 | The Access Layer encryption of broadband cluster DSCH Downlink Shared Channel, decryption, completeness protection method and device, safety implementation method |
| CN107820221A (en) * | 2016-09-12 | 2018-03-20 | 大唐移动通信设备有限公司 | Cluster multi call business encryption method and cluster core net |
| CN109729522A (en) * | 2017-10-27 | 2019-05-07 | 普天信息技术有限公司 | Eat dishes without rice or wine encryption method and device under fail soft mode |
Also Published As
| Publication number | Publication date |
|---|---|
| WO2014180390A2 (en) | 2014-11-13 |
| WO2014180390A3 (en) | 2014-12-24 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US11856402B2 (en) | Identity-based message integrity protection and verification for wireless communication | |
| ES2554671T3 (en) | Effective terminal authentication in telecommunications networks | |
| US20150382189A1 (en) | Key exchange method and apparatus | |
| CN103338437B (en) | The encryption method of a kind of mobile instant message and system | |
| CN111669276A (en) | Network verification method, device and system | |
| JP5613768B2 (en) | Method and apparatus for encrypting user identifier of calling process | |
| CN107018676A (en) | Being mutually authenticated between user equipment and evolution block core | |
| CN111465008B (en) | Initialization vector generation for performing encryption and authentication in wireless communication | |
| US11082843B2 (en) | Communication method and communications apparatus | |
| EP2854329B1 (en) | Method, system, and device for securely establishing wireless local area network | |
| CN106714152B (en) | Key distribution and receiving method, first key management center and first network element | |
| CN101242264A (en) | Data transmission method, device and system and mobile terminal | |
| Cattaneo et al. | Security Issues and Attacks on the GSM Standard: a Review. | |
| WO2014131356A1 (en) | Method, system, and terminal for hierarchical management of group keys of broadband cluster system | |
| CN101635924A (en) | CDMA port-to-port encryption communication system and key distribution method thereof | |
| US10601586B2 (en) | Method and apparatus for key management of end encrypted transmission | |
| CN104735626A (en) | Achieving method and device for trunking group communication public security | |
| CN101938743B (en) | Generation method and device of safe keys | |
| CN112134831B (en) | Method and device for sending and processing access request | |
| KR100330418B1 (en) | Authentication Method in Mobile Communication Environment | |
| CN101640840B (en) | Broadcast or multicast-based safe communication method and broadcast or multicast-based safe communication device | |
| US20230246809A1 (en) | Processing module for authenticating a communication device in a 3g capable network | |
| CN117956452A (en) | Safe wireless communication method and system based on broadcast message hiding | |
| Duraiappan et al. | Improving Speech Security and Authentication in Mobile Communications | |
| CN115915122A (en) | Data processing method and device, network side equipment and terminal |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| WD01 | Invention patent application deemed withdrawn after publication |
Application publication date: 20150624 |
|
| WD01 | Invention patent application deemed withdrawn after publication |