WO2012100749A1 - 密钥生成方法和设备 - Google Patents
密钥生成方法和设备 Download PDFInfo
- Publication number
- WO2012100749A1 WO2012100749A1 PCT/CN2012/070743 CN2012070743W WO2012100749A1 WO 2012100749 A1 WO2012100749 A1 WO 2012100749A1 CN 2012070743 W CN2012070743 W CN 2012070743W WO 2012100749 A1 WO2012100749 A1 WO 2012100749A1
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- key
- umts
- lte system
- integrity
- user equipment
- Prior art date
Links
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
- H04L63/061—Network architectures or network communication protocols for network security for supporting key management in a packet data network for key exchange, e.g. in peer-to-peer networks
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
- H04W12/043—Key management, e.g. using generic bootstrapping architecture [GBA] using a trusted network node as an anchor
- H04W12/0431—Key distribution or pre-distribution; Key agreement
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L2463/00—Additional details relating to network architectures or network communication protocols for network security covered by H04L63/00
- H04L2463/061—Additional details relating to network architectures or network communication protocols for network security covered by H04L63/00 applying further key derivation, e.g. deriving traffic keys from a pair-wise master key
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W88/00—Devices specially adapted for wireless communication networks, e.g. terminals, base stations or access point devices
- H04W88/12—Access point controller devices
Definitions
- LTE Long Term Evolution
- UMTS Universal Mobile Telecommunications System
- UMTS LTE Boosting which is anchored by a base station (evolved NodeB; hereinafter referred to as eNB)
- eNB evolved NodeB
- the Radio Network Controller (hereinafter referred to as RNC) accesses the core network of the LTE system through the eNB.
- RNC Radio Network Controller
- UE User equipment
- the access NE of the system transmits data to the core network, thereby increasing the transmission rate of the service.
- the RNC and eNB retain the existing protocols more completely.
- the data of the LTE system and the UMTS are aggregated on the Packet Data Convergence Protocol (PDCP) layer.
- PDCP Packet Data Convergence Protocol
- the LTE system and the UMTS use the respective security protocol layers to secure the service data.
- the UE performs an authentication and key agreement (AKA) with the core network through the LTE system to generate a key of the LTE system.
- AKA authentication and key agreement
- the UE performs an authentication and key agreement (AKA) with the core network through the LTE system to generate a key of the LTE system.
- the UE performs an authentication and key agreement (AKA) with the core network through the LTE system to generate a key of the LTE system.
- AKA authentication and key agreement
- the embodiment of the present invention provides a key generation method and device, so as to generate a UMTS key in an UL Boosting scenario with an eNB as an anchor, and improve the security of data transmitted on the UMTS.
- the embodiment of the present invention provides a key generation method, which is applied in a scenario where a base station is used as an anchor for a universal mobile communication system (UMTS) and a long-term evolution (LTE) system resource aggregation, and includes:
- UMTS universal mobile communication system
- LTE long-term evolution
- the embodiment of the invention further provides a key generation method, which is applied to a universal mobile communication system with a base station as an anchor point.
- UMTS Universal Mobile Telecommunication Standard
- LTE Long Term Evolution
- the access network node of the LTE system sends a UMTS key derivation indication message to the control node of the UMTS, where the UMTS key derivation indication message carries a random number generated by the access network node, so that the control node of the UMTS Deriving an integrity key and an encryption key of the UMTS according to the Internet Protocol security key and the random number; the access network node of the LTE system is derived according to the Internet Protocol security key and the random number
- the embodiment of the present invention further provides a key generation method, which is applied in a scenario where a base station is used as an anchor for a universal mobile communication system (UMTS) and a long-term evolution (LTE) system resource aggregation, and includes:
- UMTS universal mobile communication system
- LTE long-term evolution
- the user equipment receives the UMTS key derivation indication message
- the root key of the LTE system and the random number carried by the UMTS key derivation indication message are derived into a integrity key and an encryption key of the UMTS.
- the embodiment of the present invention further provides a message sending method, which is applied in a scenario where a base station is used as an anchor for a universal mobile communication system (UMTS) and a long-term evolution (LTE) system resource aggregation, and includes:
- UMTS universal mobile communication system
- LTE long-term evolution
- the control node of the UMTS receives the integrity key and the encryption key of the UMTS sent by the access network node of the LTE system, and the security capability of the user equipment;
- the control node of the UMTS sends an integrity-protected security mode command message to the user equipment by using an access network node of the LTE system, where the security mode command message carries the security of the user equipment according to the user equipment An integrity algorithm and an encryption algorithm for capability selection, a security capability of the user equipment, and a parameter value generated by the control node, and a control node generated by the control node according to the integrity key of the UMTS The parameter value, the integrity sequence number, the security mode command message, and the integrity information generated by the direction identifier.
- the embodiment of the present invention further provides a core network node device, which is used in a scenario where a base station is used as an anchor for a universal mobile communication system (UMTS) and a long-term evolution (LTE) system resource aggregation, and includes:
- UMTS universal mobile communication system
- LTE long-term evolution
- a first generating module configured to: according to the non-access stratum root key of the LTE system and a current non-access stratum count value of the LTE system, or according to the non-access stratum root key and the LTE system
- the random number generated by the core network node device is derived into an integrity key and an encryption key of the UMTS;
- a first sending module configured to send an integrity key and an encryption key of the UMTS generated by the first generating module to a control node device of the UMTS, so that the control node device of the UMTS passes the integrity of the UMTS
- the key and encryption key are encrypted and integrity protected.
- the embodiment of the present invention further provides an access network node device, which is used in a scenario where a base station is used as an anchor for a universal mobile communication system (UMTS) and a long-term evolution (LTE) system resource aggregation, and includes:
- UMTS universal mobile communication system
- LTE long-term evolution
- a second generation module configured to calculate, according to an access layer root key of the LTE system, a packet data aggregation protocol count value of the LTE system, or according to an access layer root key of the LTE system, and the access
- the random number generated by the network node is derived into an integrity key and an encryption key of the UMTS;
- a second sending module configured to send the integrity key and the encryption key of the UMTS generated by the second generating module to the control node device of the UMTS, so that the control node device of the UMTS passes the integrity of the UMTS
- the key and encryption key are encrypted and integrity protected.
- the embodiment of the present invention further provides an access network node device, which is used in a scenario where a base station is used as an anchor for a universal mobile communication system (UMTS) and a long-term evolution (LTE) system resource aggregation, and includes:
- UMTS universal mobile communication system
- LTE long-term evolution
- a third sending module configured to send a UMTS key derivation indication message to the control node device of the UMTS, where the UMTS key derivation indication message carries a random number generated by the access network node device, so that the UMTS
- the control node device derives the integrity key and the encryption key of the UMTS according to the Internet Protocol security key and the random number;
- a third generating module configured to derive an integrity key and an encryption key of the UMTS according to the Internet Protocol security key and the random number.
- the embodiment of the present invention further provides a user equipment, which is used in a scenario where a base station is used as an anchor for a universal mobile communication system (UMTS) and a long-term evolution (LTE) system resource aggregation, and includes:
- UMTS universal mobile communication system
- LTE long-term evolution
- a fourth receiving module configured to receive a UMTS key derivation indication message
- a fourth generating module configured to perform, according to the counting value of the LTE system, a root key of the LTE system, or a random number carried according to the root key of the LTE system and the UMTS key derivation indication message Derived into UMTS Integrity key and encryption key.
- the embodiment of the present invention further provides a control node device, which is used in a scenario where a base station is used as an anchor for a universal mobile communication system (UMTS) and a long-term evolution (LTE) system resource aggregation, and includes:
- UMTS universal mobile communication system
- LTE long-term evolution
- a fifth receiving module configured to receive an integrity key and an encryption key of the UMTS sent by an access network node device of the LTE system, and a security capability of the user equipment;
- a fourth sending module configured to send, by using an access network node device of the LTE system, an integrity-protected security mode command message to the user equipment, where the security mode command message carries the control node device according to the user An integrity algorithm and encryption algorithm selected by the security capability of the device, a security capability of the user equipment, and a parameter value generated by the control node device, and the control node device according to the integrity key of the UMTS, the control The parameter value generated by the node device, the integrity sequence number, the security mode command message, and the integrity information authentication code generated by the direction identifier.
- the embodiment of the present invention may be derived into a UMTS integrity key and an encryption key according to a root key of the LTE system and a count value of the LTE system, or according to a random number and a root key of the LTE system;
- the security key and the random number generated by the access network node of the LTE system are derived into the integrity key and the encryption key of the UMTS; thus, the integrity of the UMTS can be derived in the UL Boosting scenario with the eNB as an anchor.
- the key and the encryption key enable the user equipment to communicate securely through UMTS, thereby improving the security of the data transmitted on the UMTS.
- Embodiment 1 is a flowchart of Embodiment 1 of a key generation method according to the present invention
- Embodiment 2 is a flowchart of Embodiment 2 of a method for generating a key according to the present invention
- Embodiment 3 is a flowchart of Embodiment 1 of a message sending method according to the present invention.
- Embodiment 4 is a flowchart of Embodiment 3 of a method for generating a key according to the present invention
- FIG. 5 is a flowchart of Embodiment 4 of a method for generating a key according to the present invention.
- Embodiment 5 is a flowchart of Embodiment 5 of a method for generating a key according to the present invention
- Embodiment 8 of a key generation method according to the present invention is a flowchart of Embodiment 8 of a key generation method according to the present invention.
- Embodiment 10 is a flowchart of Embodiment 2 of a message sending method according to the present invention.
- Embodiment 1 is a schematic structural diagram of Embodiment 1 of a core network node device according to the present invention.
- Embodiment 12 is a schematic structural diagram of Embodiment 2 of a core network node device according to the present invention.
- Embodiment 13 is a schematic structural diagram of Embodiment 1 of an access network node device according to the present invention.
- Embodiment 2 is a schematic structural diagram of Embodiment 2 of an access network node device according to the present invention.
- Embodiment 3 is a schematic structural diagram of Embodiment 3 of an access network node device according to the present invention.
- Embodiment 4 of an access network node device according to the present invention.
- Embodiment 17 is a schematic structural diagram of Embodiment 1 of a user equipment according to the present invention.
- FIG. 18 is a schematic structural diagram of Embodiment 1 of a control node device according to the present invention.
- the purpose of the present invention is to clearly and completely describe the technical solutions in the embodiments of the present invention, and it is obvious that the technical solutions in the embodiments of the present invention are clearly and completely described.
- the described embodiments are a part of the embodiments of the invention, and not all of the embodiments. All other embodiments obtained by a person of ordinary skill in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention.
- FIG. 1 is a flowchart of a method for generating a key according to a first embodiment of the present invention.
- the key generation method provided in this embodiment can be applied to a UL Boosting scenario.
- the key generation method may include:
- Step 101 Deriving the integrity key and the encryption key of the UMTS according to the root key of the LTE system and the count value of the LTE system, or according to the random number and the root key of the LTE system.
- Step 102 Send the integrity key and the encryption key of the UMTS to the control node of the UMTS, so that the control node of the UMTS performs encryption and integrity protection through the integrity key and the encryption key of the UMTS.
- the root key of the LTE system may be a non-access stratum root key of the LTE system
- the count value of the LTE system may be a current non-access stratum count value of the LTE system
- the core network node can receive the access of the LTE system before the root key of the LTE system and the count value of the LTE system, or according to the random number and the root key of the LTE system, which are derived into the integrity key and the encryption key of the UMTS a UMTS key derivation indication message sent by the network node; according to the root key of the LTE system and the count value of the LTE system, or according to The number of machines and the root key of the LTE system are derived into the integrity key and the encryption key of the UMTS.
- the core network node may be based on the current non-access stratum count value of the LTE system and the non-access stratum root density of the LTE system.
- the key is derived from the non-access stratum root key of the LTE system and the random number generated by the core network node to derive the integrity key and encryption key of the UMTS.
- the core network node may send a UMTS key deduction indication message to the user equipment, so that the user equipment is configured according to the LTE.
- the core network node generates according to the current non-access stratum count value of the LTE system and the non-access stratum root key of the LTE system, or according to the non-access stratum root key and the core network node of the LTE system.
- the core network node may also send the integrity key and the encryption key of the UMTS to the user equipment through the non-access stratum message, so that the user The device stores the integrity key and encryption key of the UMTS.
- the control node that sends the integrity key and the encryption key of the UMTS to the UMTS may be: the core network node sends the integrity key and the encryption key of the UMTS to the access network node of the LTE system, The access network node of the LTE system sends the integrity key and the encryption key of the UMTS to the control node of the UMTS, and the control node of the UMTS saves the integrity key and the encryption key of the UMTS.
- the core network node may receive the UMTS key update request message sent by the user equipment, according to the current non-access stratum count value of the LTE system, and the The non-access stratum root key of the LTE system is re-derived into the integrity key and the encryption key of the UMTS; or
- the core network node may generate a new random number after receiving the UMTS key update request message sent by the user equipment, and according to the new random number and the LTE system.
- the ingress root key is re-derived into the integrity key and encryption key of the UMTS; or
- the UMTS integrity key and encryption key can be re-derived by re-authenticating and key-negotiation processes.
- the root key of the LTE system may be an access layer root key of the LTE system
- the count value of the LTE system may be a packet data aggregation protocol count value of the LTE system, according to the LTE system.
- the integrity key and the encryption key may be: an access network node of the LTE system according to an access layer root key of the LTE system and a packet data aggregation protocol count value of the LTE system, or according to an access layer root of the LTE system
- the key and the random number generated by the access network node are derived into an integrity key and an encryption key of the UMTS.
- the LTE system may send a UMTS key derivation indication message to the user equipment, so that the user equipment can aggregate the protocol count value according to the access layer root key of the LTE system and the packet data of the LTE system, or according to the LTE system.
- the access layer root key and the random number generated by the access network node carried in the UMTS key derivation indication message are derived into the integrity key and the encryption key of the UMTS.
- the access network node of the LTE system according to the access layer root key of the LTE system and the packet data aggregation protocol count value of the LTE system, or according to the access layer root key of the LTE system and the access network
- the access network node of the LTE system may also pass the integrity key of the UMTS and the access layer message protected by the encryption and integrity.
- the encryption key is sent to the user equipment such that the user equipment stores the integrity key and encryption key of the UMTS.
- control node that sends the integrity key and the encryption key of the UMTS to the UMTS may be:
- the access network node of the LTE system sends the integrity key and the encryption key of the UMTS to the control node of the UMTS, So that the control node of the UMTS saves the integrity key and encryption key of the UMTS.
- the access network node of the LTE system may update the packet data aggregation protocol count value and the access network node according to the LTE system. a subsequent access layer root key, or derived into a UMTS integrity key and an encryption key according to the updated access layer root key of the access network node and the newly generated random number of the access network node; or ,
- the access network node of the LTE system may generate a new random number after receiving the UMTS key update request message sent by the user equipment, and according to the new random number and The access layer root key is re-derived into the integrity key and encryption key of the UMTS; or
- the integrity key and the encryption key of the UMTS can be re-derived by re-authenticating and key-recognition processes after receiving the notification from the user equipment.
- the control node of the UMTS may receive the security capability of the user equipment in the process of receiving the integrity key and the encryption key of the UMTS, and then the control node of the UMTS may send the user equipment to the user equipment.
- the security mode command message of the integrity protection, the security mode command message carrying the integrity algorithm and encryption algorithm selected by the control node according to the security capability of the user equipment, the security capability of the user equipment, and the control The parameter value generated by the node, and the integrity information authentication code generated by the control node according to the integrity key of the UMTS, the parameter value generated by the control node, the integrity sequence number, the security mode command message, and the direction identifier.
- the control node may receive an integrity-protected security mode command completion message sent by the user equipment, where the security mode command completion message is after the user equipment receives the security mode command message, according to the UMTS integrity key of the user equipment, complete
- the integrity sequence number, the direction identifier, the security mode command message, and the parameter value carried in the security mode command message generate an integrity information authentication code, and determine the integrity information authentication code generated by the user equipment and the security mode command message.
- the integrity information authentication code carried in the security mode command is consistent, and the security capability of the user equipment carried in the security mode command message is consistent with the security capability of the user equipment itself, and then sent to the control node.
- control node of the UMTS may also receive the security capability of the user equipment in the process of receiving the integrity key and the encryption key of the UMTS, and then the control node of the UMTS may send the user equipment to the user equipment through the access network node of the LTE system.
- a security mode command message of integrity protection the security mode command message carrying an integrity algorithm and an encryption algorithm selected by the control node according to a security capability of the user equipment, a security capability of the user equipment, and a parameter value generated by the control node
- the node generates an integrity information authentication code according to the UMTS integrity key, the parameter value generated by the control node, the integrity sequence number, the security mode command message, and the direction identifier.
- the control node may receive an integrity-protected security mode command completion message sent by the user equipment through the access network node of the LTE system, where the security mode command completion message is after the user equipment receives the security mode command message, according to the user equipment.
- the UMTS integrity key, the integrity sequence number, the direction identifier, the security mode command message, and the parameter value carried in the security mode command message generate an integrity information authentication code, and determine the integrity information generated by the user equipment.
- the weight code is consistent with the integrity information authentication code carried in the security mode command message, and the security capability of the user equipment carried in the security mode command message is consistent with the security capability of the user equipment itself, and then passes through the access network of the LTE system.
- the node sends it to the control node of the UMTS.
- the core network node or the access network node may derive the integrity key of the UMTS according to the root key of the LTE system and the count value of the LTE system, or according to the random number and the root key of the LTE system. Encrypting the key, so that the integrity key and the encryption key of the UMTS can be derived in the UL Boosting scenario with the eNB as an anchor, so that the user equipment can communicate securely through the UMTS, thereby improving the data transmitted on the UMTS. Security.
- the access network node may be a node with an access function, for example, a base station, etc., where the base station may include an eNB, and the eNB may be an ordinary macro base station, or may be some small base stations, including a home base station.
- the base station may include an eNB
- the eNB may be an ordinary macro base station, or may be some small base stations, including a home base station.
- the relay node (Home enhanced NodeB; hereinafter referred to as: HeNB/Home NodeB; hereinafter referred to as: HNB) or medium
- the relay node (hereinafter referred to as: RN) and the like;
- the core network node may be a node providing a core network function, for example: a Mobility Management Entity (hereinafter referred to as MME);
- the control node of the UMTS may have An entity that controls a function, for example, an RNC or the like; the specific form of the access network node, the control node of the UMTS, and the core network node is not limited in the embodiment of the present invention.
- the access network node of the LTE system is the eNB
- the core network node is the MME
- the control node of the UMTS is the RNC.
- FIG. 2 is a flowchart of Embodiment 2 of a method for generating a key according to the present invention. As shown in FIG. 2, the method for generating a key may include:
- Step 201 The UE sends an attach request message to the MME, requesting access to the LTE network.
- step 202 the LTE AKA process is performed between the UE and the MME, and the two-way authentication between the UE and the MME is completed, and the key of the LTE system is generated.
- the key of the LTE system may include a non-access stratum (Non Access Stratum; NAS) root key of the LTE system, where the NAS root key is stored in the UE and the MME.
- NAS Non Access Stratum
- Step 203 After the UE and the MME are successfully authenticated, the MME allocates an Evolved Universal Terrestrial Radio Access Network Radio Access Bearer (E-RAB) to the eNB.
- E-RAB Evolved Universal Terrestrial Radio Access Network Radio Access Bearer
- Step 204 The eNB selects a radio access technology (Radio Access Technology; hereinafter referred to as RAT) of the LTE system and the UMTS according to the allocated E-RAB.
- RAT Radio Access Technology
- Step 205 Establish an evolved universal terrestrial radio access network radio bearer between the UE and the eNB (Evolved
- Step 206 The UE performs measurement on the UMTS cell that may cooperate, obtains a measurement report, and sends the measurement report to the eNB.
- Step 207 The eNB selects an RNC participating in the aggregation according to the measurement result of the UMTS cell reported by the UE.
- Step 209 Establish a radio bearer (Radio Bearer; hereinafter referred to as RB) between the UE and the RNC.
- Radio Bearer Radio Bearer
- Step 211 After receiving the UMTS key derivation indication message, the MME derives an UMTS integrity key (Integrity Key; hereinafter referred to as IK) and an encryption key (Cipher Key; hereinafter referred to as CK).
- IK UMTS integrity key
- CK Cipher Key
- the key derivation indication message is sent to the UE.
- the MME may not perform any processing.
- Step 212 The MME sends a UMTS key derivation indication message to the UE.
- IKIICK KDF (Kasme, NAS)
- Step 213 After receiving the UMTS key derivation indication message, the UE derives the UMTS keys CK and IK. Specifically, the following two methods can be used:
- the UE needs to use non-access when deriving the UMTS key in step 213.
- the layer count value (NAS Count) which enables the MME and the UE to use the same non-access stratum count value when deriving the UMTS key, so that the MME and the UE derived UMTS key can be synchronized.
- Step 214 The MME sends the derived IK and CK to the eNB.
- Step 215 The eNB sends the IK, CK, and UE security capability to the RNC.
- the RNC stores the received IK and CK.
- Step 217 The RNC sends a Security Mode Command (SMC) message to the UE, where the SMC message carries an encryption and integrity algorithm selected by the RNC according to the security capability of the UE, and a parameter value generated by the RNC. And the UE security capability, and the integrity information authentication code (Message) generated by the F9 algorithm according to IK, integrity sequence number, SMC message, direction identifier (B) Authentication Code for Integrity; hereinafter referred to as: MAC-I), the SMC message is integrity protected.
- Step 218 After receiving the SMC message, the UE checks the MAC-I and UE security capabilities.
- the UE may generate the integrity information authentication by using the F9 algorithm according to the IK, the integrity sequence number, the direction identifier, the SMC message, and the parameter value carried in the SMC message.
- the X message is in the XMAC-I and the SMC message.
- the UE may determine that the SMC message is complete.
- the UE also checks whether the UE security capability carried in the SMC message is consistent with the security capability of the UE itself.
- step 219 is performed; if the UE determines that the SMC message is incomplete, or the UE security capability carried in the SMC message and If the security capabilities of the UE are inconsistent, the process ends.
- Step 219 The UE sends an SMC complete message to the MME, where the SMC completion message is integrity protected.
- the UMTS key needs to be updated in the following cases:
- the UE When the UMTS key lifetime (START) value reaches a preset threshold, the UE notifies the network side to perform a new AKA procedure, and re-infers the UMTS keys IK and CK;
- the UE When the UMTS key lifetime (START) value reaches a preset threshold, the UE sends a UMTS key update request message to the MME, and after the MME receives the UMTS key update request message, according to the current non-access of the LTE system.
- Layer count value (NAS Count I (NAS Count + 1 ) ) and Kasme generate new UMTS keys IK and CK;
- the UE sends a UMTS key update request message to the MME, and after receiving the UMTS key update request message, the MME generates a new random number Nonce, and Generate new UMTS keys IK and CK based on this new Nonce and Kasme.
- the MME and the UE may be based on the current non-access stratum count value of the LTE system and the non-access stratum root key (Kasme) of the LTE system, or according to the non-access stratum root key (Kasme) of the LTE system.
- the random number generated by the MME and the MME are derived into UMTS keys IK and CK, so that the integrity key and the encryption key of the UMTS can be derived in the UL Boosting scenario with the eNB as an anchor, so that the UE can perform the UMTS through the UMTS.
- Secure communication which in turn increases the security of data transmitted over UMTS.
- FIG. 3 is a flowchart of Embodiment 1 of a message sending method according to the present invention, as shown in FIG. Can include:
- Step 301 The RNC sends an SMC message to the eNB, where the SMC message carries an encryption and integrity algorithm selected by the RNC according to the UE security capability, a parameter value (Fresh) generated by the RNC, and a UE security capability, and an IK, integrity sequence.
- the number, the SMC message, the direction identifier, and Fresh are calculated by the F9 algorithm to generate the MAC-I; wherein the SMC message is integrity protected.
- Step 302 The eNB sends the foregoing SMC message to the UE, where the SMC message carries an encryption and integrity algorithm selected by the RNC according to the security capability of the UE, a parameter value (Fresh) generated by the RNC, and a UE security capability, and according to IK, complete.
- the sequence number, the SMC message, the direction identifier, and Fresh are calculated by the F9 algorithm to generate the step 303, and the UE checks the MAC-I and UE security capabilities.
- the UE may generate an XMAC-I by using an F9 algorithm according to the IK, the integrity sequence number, the direction identifier, the SMC message, and the parameter value (Fresh) carried in the SMC message, and then The SMC message is determined to be complete when the XMAC-I is equal to the MAC-I carried in the SMC message.
- the UE may determine that the SMC message is complete. The UE also checks whether the security capability of the UE carried in the SMC message is consistent with the security capability of the UE itself.
- step 304 After the UE determines that the SMC message is complete, and the UE security capability carried in the SMC message is consistent with the security capability of the UE itself, step 304 and subsequent steps are performed; if the UE determines that the SMC message is incomplete, or is carried in the SMC message If the UE security capability is inconsistent with the security capability of the UE itself, the process ends.
- Step 304 The UE sends an SMC complete message to the eNB, where the SMC completion message is integrity protected.
- Step 305 The eNB sends an SMC complete message to the RNC, where the SMC completion message is integrity protected.
- the RNC sends an SMC message to the UE through the eNB, and receives the SMC complete message sent by the UE through the eNB, so that when the LTE system and the UMTS share one SRB, the RNC and the UE can perform the SMC process, and negotiate the encryption. And integrity algorithms.
- Embodiment 4 is a flowchart of Embodiment 3 of a method for generating a key according to the present invention.
- the MME will be derived.
- the UMTS key IK and CK are directly sent to the UE through the NAS message, and the UE does not need to derive the UMTS key.
- the key generation method may include:
- Step 401 The UE sends an attach request message to the MME, requesting access to the LTE network.
- Step 402 Perform a LTE AKA process between the UE and the MME, complete two-way authentication between the UE and the MME, and generate a key of the LTE system.
- the key of the LTE system may include a NAS root key of the LTE system, where the NAS root key is stored in the UE and the MME.
- Step 403 After the authentication succeeds, the MME allocates an E-RAB to the eNB.
- Step 404 The eNB selects an LTE system and a RAT of the UMTS according to the allocated E-RAB.
- Step 405 Establish an E-RB between the UE and the eNB.
- Step 406 The UE performs measurement on the UMTS cell that may cooperate, obtains a measurement report, and sends the measurement report to the eNB.
- Step 407 The eNB selects an RNC participating in the aggregation according to the measurement result of the UMTS cell reported by the UE.
- Step 408 The eNB sends a reconfiguration request message to the RNC.
- Step 409 Establish an RB between the UE and the RNC.
- Step 410 The eNB sends a UMTS key derivation indication message to the MME.
- Step 411 After receiving the UMTS key derivation indication message, the MME derives the UMTS keys IK and CK. Specifically, the following methods can be used:
- Step 412 The MME sends the UMTS keys IK and CK to the UE through the NAS message, and the NAS message is protected by encryption and integrity.
- Step 413 After receiving the NAS message, the UE stores the UMTS keys IK and CK.
- Step 414 The MME sends the derived UMTS keys IK and CK to the eNB.
- Step 415 The eNB sends the UMTS key IK, CK, and UE security capabilities to the RNC.
- Step 416 the RNC stores the received UMTS keys IK and CK.
- Step 417 The RNC sends an SMC message to the UE, where the SMC message carries an encryption and integrity algorithm selected by the RNC, a parameter value (Fresh) generated by the RNC, and a UE security capability, and an IK, an integrity sequence number, and an SMC message.
- the direction identifier and Fresh the generated MAC-I is calculated by the F9 algorithm, and the SMC message is protected by integrity.
- Step 418 After receiving the SMC message, the UE checks the MAC-I and UE security capabilities.
- the UE may generate the XMAC-I by using the F9 algorithm according to the IK, the integrity sequence number, the direction identifier, the SMC message, and the parameter value carried in the SMC message. Then, it is determined whether the SMC message is complete by comparing whether the MAC-I carried in the SMC message is equal to the MAC-I carried in the SMC message. When the X-MAC-I is equal to the MAC-I carried in the SMC message, the UE may determine that the SMC message is complete. The UE also checks whether the UE security capability carried in the SMC message is consistent with the security capability of the UE itself.
- step 419 is performed; if the UE determines that the SMC message is incomplete, or the UE security capability carried in the SMC message and If the security capabilities of the UE are inconsistent, the process ends.
- Step 419 The UE sends an SMC complete message to the MME, where the SMC completion message is integrity protected.
- the UMTS key needs to be updated in the following cases:
- the UE When the UMTS key lifetime (START) value reaches a preset threshold, the UE notifies the network side to perform a new AKA procedure, and re-infers the UMTS keys IK and CK;
- the UE When the UMTS key lifetime value reaches a preset threshold, the UE sends a UMTS key update request message to the MME, and after the MME receives the UMTS key update request message, according to the current non-access stratum count value of the LTE system.
- NAS Count Wo B Kasme generates new UMTS keys IK and CK;
- the UE sends a UMTS key update request message to the MME, and after receiving the UMTS key update request message, the MME generates a new random number Nonce, and according to the new Nonce and Kasme generate new UMTS keys IK and CK.
- LTE and UMTS each have their own SRBs.
- the SMC message sending process may be as shown in FIG. 3, and details are not described herein.
- the MME may be based on the current non-access stratum count value of the LTE system and the non-access stratum root key (Kasme) of the LTE system, or according to the non-access stratum root key (Kasme) and the MME of the LTE system.
- the generated random number is derived into UMTS keys IK and CK, and then the MME can send the UMTS keys IK and CK to the UE, so that the integrity of the UMTS can be derived in the UL Boosting scenario with the eNB as an anchor.
- the key and the encryption key enable the UE to communicate securely through UMTS, thereby improving the security of data transmitted on the UMTS.
- FIG. 5 is a flowchart of Embodiment 4 of a method for generating a key according to the present invention. As shown in FIG. 5, the method for generating a key may include:
- Step 501 The UE sends an attach request message to the MME, requesting access to the LTE network.
- Step 502 Perform a LTE AKA process between the UE and the MME, complete two-way authentication between the UE and the MME, and generate a key of the LTE system.
- the key of the LTE system may include an access layer root key of the LTE system.
- Step 503 After the authentication succeeds, the MME allocates an E-RAB to the eNB.
- Step 504 The eNB selects an LTE system and a RAT of the UMTS according to the allocated E-RAB.
- Step 505 Establish an E-RB between the UE and the eNB.
- Step 506 The UE performs measurement on the UMTS cell that may cooperate, obtains a measurement report, and sends the measurement report to the eNB.
- Step 507 The eNB selects an RNC participating in the aggregation according to the measurement result of the UMTS cell reported by the UE.
- Step 508 The eNB sends a reconfiguration request message to the RNC.
- Step 509 Establish an RB between the UE and the RNC.
- Step 510 The eNB sends a UMTS key derivation indication message to the UE, instructing the UE to start deriving the UMTS key.
- the eNB may send the Nonce value generated by the eNB to the UMTS key derivation indication message to
- Step 512 After receiving the UMTS key derivation indication message, the UE derives the UMTS keys IK and CK. Specifically, the following methods can be used:
- Step 513 The eNB sends the derived UMTS key IK, CK, and UE security capabilities to the RNC.
- the RNC stores the UMTS keys IK and CK.
- Step 515 The RNC sends an SMC message to the UE, where the SMC message carries an encryption and integrity algorithm selected by the RNC according to the UE security capability, a parameter value (Fresh) generated by the RNC, and a UE security capability, and an IK, integrity sequence.
- the number, the SMC message, the direction identifier, and Fresh calculate the generated MAC-I through the F9 algorithm, and the SMC message is integrity protected.
- Step 516 After receiving the SMC message, the UE checks the MAC-I and UE security capabilities.
- the UE may generate an XMAC-I by using an F9 algorithm according to the IK, the integrity sequence number, the direction identifier, the SMC message, and the parameter value (Fresh) carried in the SMC message, and then The SMC message is determined to be complete when the XMAC-I is equal to the MAC-I carried in the SMC message.
- the UE may determine that the SMC message is complete. The UE also checks whether the security capability of the UE carried in the SMC message is consistent with the security capability of the UE itself.
- step 517 is performed; if the UE determines that the SMC message is incomplete, or the UE security capability carried in the SMC message and If the security capabilities of the UE are inconsistent, the process ends.
- Step 517 The UE sends an SMC complete message to the RNC, where the SMC complete message is integrity protected.
- the UMTS key needs to be updated in the following cases:
- the UE When the UMTS key lifetime (START) value reaches a preset threshold, the UE notifies the network side to perform a new AKA procedure, and re-infers the UMTS keys IK and CK;
- the UE sends a UMTS key update request message to the eNB, and the eNB generates a new Nonce value after receiving the UMTS key update request message, and then according to the new Nonce value.
- K eNB re-derived into new UMTS keys IK and CK.
- the eNB and the UE may push according to the PDCP count value and the access layer root key (K eNB ) of the LTE system, or according to the access layer root key (K eNB ) of the LTE system and the random number generated by the eNB.
- K eNB access layer root key
- K eNB access layer root key
- the eNB and the UE may be deduced into UMTS keys IK and CK respectively, or the UMTS keys IK and CK may be derived in the eNB, and then passed through the access layer (Access Stratum; The abbreviated as follows: AS) The message is sent to the UE.
- FIG. 6 is a flowchart of Embodiment 5 of the method for generating a key according to the present invention.
- the method for generating a key may include: Step 601: The eNB derives the UMTS key IK according to the access layer root key (Ke NB ) of the LTE system.
- the eNB has the following methods when deriving the UMTS keys IK and CK:
- Step 602 The eNB sends the derived UMTS keys IK and CK to the UE by using an AS message, where the AS message is protected by encryption and integrity.
- Step 603 the UE stores the UMTS keys IK and CK.
- Step 604 The eNB sends the derived UMTS key IK, CK, and UE security capabilities to the RNC.
- the RNC stores the UMTS keys IK and CK.
- the steps 602 to 603 and the steps 604 to 605 may be performed sequentially or in parallel.
- Step 606 to step 608 the same steps 515 to 517, and details are not described herein again.
- the LTE system and the UMTS each have their own SRBs.
- the SMC message sending process can be as shown in FIG. 3 , and details are not described herein again. .
- the eNB may be derived according to the PDCP count value and the access layer root key (K eNB ) of the LTE system, or according to the access layer root key (K eNB ) of the LTE system and the random number generated by the eNB.
- UMTS key IK and B CK then the eNB can send the UMTS keys IK and CK to the UE, so that the integrity key and the encryption key of the UMTS can be derived in the UL Boosting scenario with the eNB as an anchor.
- the UE can perform secure communication through UMTS, thereby improving the security of data transmitted on the UMTS.
- FIG. 7 is a flowchart of Embodiment 6 of a key generation method according to the present invention. As shown in FIG. 7, the key generation method may include:
- Step 701 The access network node of the LTE system sends a UMTS key derivation indication message to the control node of the UMTS, where the UMTS key derivation indication message carries a random number generated by the access network node, so that the control node according to the Internet protocol
- the security key and the above random number are derived into the integrity key and encryption key of the UMTS.
- Step 702 The access network node of the LTE system derives the integrity key and the encryption key of the UMTS according to the Internet Protocol security key and the random number.
- the access network node of the LTE system derives according to the Internet protocol security key and the foregoing random number. After the integrity key and the encryption key of the UMTS, the access network node of the LTE system may also send the integrity key and the encryption key of the UMTS to the user through the access layer message protected by the encryption and integrity.
- the device is configured to cause the user equipment to store the integrity key and encryption key of the UMTS described above.
- the access network node of the LTE system may also perform a certificate-based authentication process with the UMTS control node to generate the foregoing Internet. Protocol security key and random number.
- the access network node of the LTE system may generate a new random number after receiving the UMTS key update request message sent by the user equipment. And then re-introduced into the UMTS integrity key and encryption key according to the new random number and the Internet Protocol security key.
- the control node of the UMTS may send a security mode command message to the user equipment, where the security is
- the mode command message carries an integrity algorithm and an encryption algorithm selected by the control node according to the security capability of the user equipment, a security capability of the user equipment, and a parameter value generated by the control node, and the integrity key of the control node according to the UMTS, the control The node generated parameter value, the integrity sequence number, the security mode command message, and the integrity information generated by the direction identifier; wherein the security mode command message is integrity protected.
- the control node may receive a security mode command completion message sent by the user equipment, where the security mode command completion message is after the user equipment receives the security mode command message, according to the UMTS integrity key, integrity sequence number, and direction of the user equipment.
- the identifier, the security mode command message, and the parameter value carried in the security mode command message generate an integrity information authentication code, and determine integrity integrity carried in the integrity information authentication code generated by the user equipment and the security mode command message.
- the information authentication code is consistent, and the security capability of the user equipment carried in the security mode command message is consistent with the security capability of the user equipment, and then sent to the control node; wherein the security mode command completion message is integrity protected.
- the control node of the UMTS may also access the user through the access network node of the LTE system.
- the device sends a security mode command message, where the security mode command message carries an integrity algorithm and an encryption algorithm selected by the control node according to the security capability of the user equipment, a security capability of the user equipment, and a parameter value generated by the control node, and the control node is configured according to the The integrity key of the UMTS, the parameter value generated by the control node, the integrity sequence number, the security mode command message, and the integrity information authentication code generated by the direction identifier; wherein the security mode command message is integrity protected.
- the control node of the UMTS may receive a security mode command completion message sent by the user equipment through the access network node of the LTE system, where the security mode command completion message is after the user equipment receives the security mode command message, according to the integrity of the UMTS of the user equipment.
- the integrity key, the integrity sequence number, the direction identifier, the security mode command message, and the parameter value carried in the security mode command message generate an integrity information authentication code, and determine the integrity information authentication code generated by the user equipment.
- the integrity information authentication code carried in the security mode command message is consistent, and the security capability of the user equipment carried in the security mode command message is consistent with the security capability of the user equipment, and then sent to the access network node of the LTE system. Controlling the node; wherein the security mode command completion message is integrity protected.
- the access network node of the LTE system may derive the integrity key and the encryption key of the UMTS according to the Internet Protocol security key and the random number generated by the access network node of the LTE system, thereby implementing The UL Boosting scenario with the eNB as the anchor is derived into the integrity key and the encryption key of the UMTS, so that the user equipment can perform secure communication through the UMTS, thereby improving the security of the data transmitted on the UMTS.
- FIG. 8 is a flowchart of Embodiment 7 of a key generation method according to the present invention. This embodiment assumes that the connection between the eNB and the RNC is insecure, requires certificate-based authentication, and then establishes a secure channel to generate an Internet Protocol security key p. Sec .
- the key generation method may include:
- Step 801 The UE sends an attach request message to the MME, requesting access to the LTE network.
- Step 802 The LTE AKA process is performed between the UE and the MME, and the two-way authentication between the UE and the MME is completed, and the key of the LTE system is generated.
- Step 803 After the authentication succeeds, the MME allocates an E-RAB to the eNB.
- Step 804 The eNB selects an LTE system and a RAT of the UMTS according to the allocated E-RAB.
- Step 805 Establish an E-RB between the UE and the eNB.
- Step 806 The UE performs measurement on the UMTS cell that may cooperate, obtains a measurement report, and sends the measurement report to the eNB.
- Step 807 The eNB selects an RNC participating in the aggregation according to the measurement result of the UMTS cell reported by the UE.
- Step 808 A certificate-based authentication process is required between the eNB and the RNC to ensure that the channel between the eNB and the RNC is secure.
- Step 809 The eNB generates an Internet Protocol security key (K IPsec ) through an authentication process between the eNB and the RNC, and generates a random number Nonce.
- K IPsec Internet Protocol security key
- Step 810 The RNC also generates K IPsec through an authentication process between the eNB and the RNC.
- step 809 and step 810 may be performed sequentially or in parallel.
- Step 811 establishing an RB between the UE and the RNC.
- Step 812 The eNB sends a UMTS key derivation indication message to the RNC, where the UMTS key derivation indication message carries a random number Nonce.
- step 814 the eNB derives the UMTS keys IK and CK according to the K IP ⁇ and the random number Nonce.
- Step 815 The eNB sends the derived UMTS keys IK and CK to the UE through an AS message, where the AS message is protected by encryption and integrity.
- Step 816 the UE stores the received UMTS keys IK and CK.
- Step 817 The RNC sends an SMC message to the UE, where the SMC message carries an encryption and integrity algorithm selected by the RNC according to the UE security capability, a generated parameter value (Fresh) and a UE security capability, and an IK, an integrity sequence number, and The SMC message, the direction identifier, and Fresh calculate the generated MAC-I through the F9 algorithm, and the SMC message is integrity protected.
- the SMC message carries an encryption and integrity algorithm selected by the RNC according to the UE security capability, a generated parameter value (Fresh) and a UE security capability, and an IK, an integrity sequence number, and The SMC message, the direction identifier, and Fresh calculate the generated MAC-I through the F9 algorithm, and the SMC message is integrity protected.
- Fresh generated parameter value
- IK an integrity sequence number
- Step 818 After receiving the SMC message, the UE checks the MAC-I and UE security capabilities.
- the UE may generate an XMAC-I by using an F9 algorithm according to the IK, the integrity sequence number, the direction identifier, the SMC message, and the parameter value (Fresh) carried in the SMC message, and then The SMC message is determined to be complete when the XMAC-I is equal to the MAC-I carried in the SMC message.
- the UE may determine that the SMC message is complete. The UE also checks whether the security capability of the UE carried in the SMC message is consistent with the security capability of the UE itself.
- step 819 is performed; if the UE determines that the SMC message is incomplete, or the UE security capability carried in the SMC message is If the security capabilities of the UE are inconsistent, the process ends.
- Step 819 The UE sends an SMC complete message to the MME, where the SMC completion message is integrity protected.
- the UMTS key needs to be updated in the following cases:
- the UE When the UMTS key lifetime (START) value reaches a preset threshold, the UE sends a UMTS key update request message to the eNB, and the eNB generates a new Nonce after receiving the UMTS key update request message, and then according to the new The Nonce and K IPs are re-derived into new UMTS keys IK and CK.
- the UMTS key lifetime (START) value reaches a preset threshold
- each of LTE and UMTS has its own SRB, when LTE and UMTS are common.
- SRB the sending process of the SMC message can be as shown in FIG. 3, and details are not described herein again.
- the eNB and the RNC may derive the UMTS keys IK and CK according to ⁇ and the random number generated by the eNB, and then the eNB may send the generated UMTS keys IK and CK to the UE, so that The eNB is an UMTS integrity key and an encryption key in the UL Boosting scenario of the anchor, so that the UE can perform secure communication through the UMTS, thereby improving the security of data transmitted on the UMTS.
- FIG. 9 is a flowchart of Embodiment 8 of a key generation method according to the present invention. As shown in FIG. 9, the key generation method may include:
- Step 901 The user equipment receives the UMTS key derivation indication message.
- Step 902 The user equipment derives the integrity key of the UMTS according to the count value of the LTE system and the root key of the LTE system, or according to the root key of the LTE system and the random number carried by the UMTS key derivation indication message. Encryption key.
- the root key of the LTE system includes a non-access stratum root key of the LTE system
- the count value of the LTE system includes a current non-access stratum count value of the LTE system
- the UMTS key push The random number carried by the indication indication message includes a random number generated by the core network node
- the user equipment receiving the UMTS key derivation indication message may be: the user equipment receives the UMTS key derivation indication message sent by the core network node;
- the user equipment derives the integrity key and the encryption key of the UMTS according to the count value of the LTE system and the root key of the LTE system, or according to the root key of the LTE system and the random number carried by the UMTS key derivation indication message.
- the user equipment may be derived according to the current non-access stratum count value of the LTE system and the non-access stratum root key of the LTE system, or according to the non-access stratum root key of the LTE system and the random number generated by the core network node. Integrity key and encryption key into UMTS.
- the root key of the LTE system includes an access layer root key of the LTE system
- the count value of the LTE system includes a packet data aggregation protocol count value of the LTE system
- the UMTS key derivation indication The random number carried by the message includes the random number generated by the access network node of the LTE system
- the user equipment receiving the UMTS key derivation indication message may be: the user equipment receiving the UMTS key derivation indication sent by the access network node of the LTE system a message, the UMTS key derivation indication message carries a random number generated by an access network node of the LTE system; the user equipment according to a count value of the LTE system and a root key of the LTE system, or according to a root key and a UMTS of the LTE system
- the integrity key and the encryption key derived from the random number carried by the key derivation indication message into the UMTS may be: the user equipment according to the packet data aggregation protocol count value of the L
- the user equipment may derive the integrity of the UMTS according to the count value of the LTE system and the root key of the LTE system, or according to the root key of the LTE system and the random number carried by the UMTS key derivation indication message.
- the key and the encryption key so that the integrity key and the encryption key of the UMTS can be derived in the UL Boosting scenario with the eNB as an anchor, so that the UE can perform secure communication through the UMTS, thereby improving the transmission on the UMTS.
- the security of the data may be performed by the UMTS according to the count value of the LTE system and the root key of the LTE system, or according to the root key of the LTE system and the random number carried by the UMTS key derivation indication message.
- FIG. 10 is a flowchart of Embodiment 2 of a message sending method according to the present invention. As shown in FIG. 10, the message sending method may include:
- Step 1001 The control node of the UMTS receives the integrity key and the encryption key of the UMTS sent by the access network node of the LTE system, and the security capability of the user equipment.
- Step 1002 The control node of the UMTS sends an integrity-protected security mode command message to the user equipment by using the access network node of the LTE system, where the security mode command message carries an integrity algorithm selected by the control node according to the security capability of the user equipment.
- the control node of the UMTS can also receive the access network node of the user equipment through the LTE system.
- the integrity-protected security mode command completion message sent, the security mode command completion message is after the user equipment receives the security mode command message, according to the UMTS integrity key, integrity sequence number, direction identifier, security of the user equipment.
- the mode command message and the parameter value carried in the security mode command message generate an integrity information authentication code, and determine that the integrity information authentication code generated by the user equipment is consistent with the integrity information authentication code carried in the security mode command message.
- the security capability of the user equipment carried in the security mode command message is sent to the control node of the UMTS through the access network node of the LTE system after being consistent with the security capability of the user equipment.
- the control node of the UMTS may send a security mode command message to the user equipment through the access network node of the LTE system, and receive a security mode command completion message sent by the user equipment through the access network node of the LTE system, thereby implementing
- the SMC process can be performed between the control node of the UMTS and the user equipment to negotiate the encryption and integrity algorithms.
- FIG. 11 is a schematic structural diagram of Embodiment 1 of a core network node device according to the present invention.
- the core network node device in this embodiment may be applied to a UL Boosting scenario in which a base station is used as an anchor to implement the process of the embodiment shown in FIG. 1 of the present invention.
- the core network node device may include: a first generation module 1101 and a first sending module 1102; wherein, the first generation module 1101 is configured to use a non-access stratum root key and an LTE system according to the LTE system.
- the first sending module 1102 is configured to send the integrity key and the encryption key of the UMTS generated by the first generating module 1101 to the control node device of the UMTS, so that the control node device of the UMTS passes the integrity key of the UMTS. Encryption and integrity protection with encryption keys.
- the core network node device in this embodiment may be a node device that provides a core network function, such as an MME, but the specific form of the core network node device is not limited in this embodiment.
- the first generation module 1101 may be based on the non-access stratum root key of the LTE system and the current non-access stratum count value of the LTE system, or according to the non-access stratum root key of the LTE system and the The random number generated by the core network node device is derived into the integrity key and the encryption key of the UMTS, so that the integrity key and the encryption key of the UMTS can be derived in the UL Boosting scenario with the eNB as an anchor.
- the user equipment can communicate securely through UMTS, thereby improving the security of data transmitted on the UMTS.
- FIG. 12 is a schematic structural diagram of Embodiment 2 of a core network node device according to the present invention.
- the core network node device shown in FIG. 12 may further include:
- the first receiving module 1103 is configured to receive a UMTS key derivation indication message sent by the access network node device of the LTE system, where the UMTS key derivation indication message is used to trigger the first generation module 1101 to generate an integrity key of the UMTS And encryption key.
- the first sending module 1102 may further send a UMTS key derivation indication message to the user equipment, so that the user equipment according to the current non-access stratum count value of the LTE system and the non-LTE system
- the access layer root key is derived into a UMTS integrity key and an encryption key according to the non-access stratum root key of the LTE system and the random number carried in the UMTS key derivation indication message.
- the first sending module 1102 may further send, by using a non-access stratum message, the integrity key and the encryption key of the UMTS generated by the first generating module 1101 to the user equipment, so that the The user equipment stores the integrity key and encryption key of the UMTS.
- the first sending module 1102 can send the integrity key and the encryption key of the UMTS to the LTE.
- the access network node device of the system so that the access network node device sends the integrity key and the encryption key of the UMTS to the control node device of the UMTS.
- the first receiving module 1103 in this embodiment may also receive a UMTS key update request message or notification sent by the user equipment when the UMTS key life cycle reaches a preset threshold.
- the first generation module 1101 may further re-reset the current non-access stratum count value of the LTE system and the non-access stratum root key of the LTE system after the first receiving module 1103 receives the UMTS key update request message. Deriving the integrity key and encryption key derived into UMTS; or
- the first generation module 1101 may further generate a new random number after the first receiving module 1103 receives the UMTS key update request message, and re-derive the derivative according to the new random number and the non-access stratum root key of the LTE system. Integrity key and encryption key into UMTS; or,
- the first generation module 1101 may further re-infer the integrity key and the encryption key of the UMTS by re-initiating the authentication and key agreement process after the first receiving module 1103 receives the above notification.
- the core network node device can implement the UMTS integrity key and the encryption key in the UL Boosting scenario with the eNB as an anchor, so that the user equipment can perform secure communication through the UMTS, thereby improving the data transmitted on the UMTS. Security.
- FIG. 13 is a schematic structural diagram of Embodiment 1 of an access network node device according to the present invention.
- the access network node device in this embodiment may be applied to a UL Boosting scenario in which a base station is used as an anchor point to implement the embodiment shown in FIG. 1 of the present invention. Process.
- the access network node device may include:
- the second generation module 1301 is configured to: according to an access layer root key of the LTE system and a packet data aggregation protocol count value of the LTE system, or according to an access layer root key of the LTE system and a random number generated by the access network node Derived into UMTS integrity key and encryption key;
- the second sending module 1302 is configured to send the integrity key and the encryption key of the UMTS generated by the second generating module 1301 to the control node device of the UMTS, so that the control node device of the UMTS passes the integrity key and encryption of the UMTS.
- the key is encrypted and integrity protected.
- the access network node device in this embodiment may be a node device with an access function, for example, a base station, etc., where the base station may include an eNB, and the eNB may be an ordinary macro base station, or may be a small base station, including a HeNB. /HNB or RN and so on.
- the specific form of the access network node device is not limited in this embodiment.
- the second generation module 1301 may be configured according to an access layer root key of the LTE system and a packet data aggregation protocol of the LTE system, or according to an access layer root key and an access network of the LTE system.
- the random number generated by the node is derived into the integrity key and the encryption key of the UMTS;
- the UL Boosting scenario of the anchor is derived into the integrity key and encryption key of the UMTS, so that the user equipment can communicate securely through the UMTS, thereby improving the security of the data transmitted on the UMTS.
- FIG. 14 is a schematic structural diagram of Embodiment 2 of an access network node device according to the present invention. Compared with the access network node device shown in FIG. 13, the difference is that an implementation manner of the access network node device shown in FIG. Medium,
- the second sending module 1302 may further send a UMTS key derivation indication message to the user equipment, so that the user equipment aggregates the protocol count value according to the access layer root key of the LTE system and the packet data of the LTE system, or according to the LTE system.
- the access layer root key and the random number generated by the access network node device carried in the UMTS key derivation indication message are derived into the integrity key and the encryption key of the UMTS.
- the second sending module 1302 may further send the integrity key and the encryption key of the UMTS generated by the second generating module 1301 to the access layer message protected by the encryption and integrity.
- User equipment such that the user equipment stores the integrity key and encryption key of the UMTS.
- the access network node device in this embodiment may further include:
- the second receiving module 1303 is configured to receive a UMTS key update request message or a notification sent by the user equipment when the UMTS key life cycle reaches a preset threshold.
- the second generation module 1301 may further update the packet data aggregation protocol count value according to the LTE system and the access network node device update when the packet data aggregation protocol count value of the LTE system overflows or the user equipment enters the connection state from the idle state.
- the second generation module 1301 may further generate a new random number after the second receiving module 1303 receives the UMTS key update request message, and re-derive the UMTS according to the new random number and the access layer root key. Sex key and encryption key; or,
- the second generation module 1301 may further re-infer the integrity key and the encryption key of the UMTS by re-initiating the authentication and key agreement process after the second receiving module 1303 receives the above notification.
- the foregoing access network node device can be implemented in a UL Boosting scenario with an eNB as an anchor point.
- the integrity key and encryption key of UMTS enable user equipment to communicate securely through UMTS, which in turn improves the security of data transmitted over UMTS.
- FIG. 15 is a schematic structural diagram of Embodiment 3 of an access network node device according to the present invention.
- the access network node device in this embodiment may be applied to a UL Boosting scenario in which a base station is used as an anchor point to implement the embodiment shown in FIG. 7 of the present invention.
- the process of the access network node device may include:
- the third sending module 1501 is configured to send, to the UMTS control node device, a UMTS key derivation indication message, where the UMTS key derivation indication message carries a random number generated by the access network node device, so that the UMTS control node device is configured according to The Internet Protocol security key and the above random number are derived into an integrity key and an encryption key of the UMTS;
- the third generation module 1502 is configured to derive an integrity key and an encryption key of the UMTS according to the Internet Protocol security key and the random number.
- the access network node device in this embodiment may be a node device with an access function, for example, a base station, etc., where the base station may include an eNB, and the eNB may be an ordinary macro base station, or may be a small base station, including a HeNB. /HNB or RN and so on.
- the specific form of the access network node device is not limited in this embodiment.
- the third generation module 1502 may derive the integrity key and the encryption key of the UMTS according to the Internet Protocol security key and the random number generated by the access network node device, so that the The eNB is derived from the UL Boosting scenario of the anchor into the UMTS integrity key and the encryption key, so that the user equipment can perform secure communication through the UMTS, thereby improving the security of the data transmitted on the UMTS.
- FIG. 16 is a schematic structural diagram of Embodiment 4 of an access network node device according to the present invention. Compared with the access network node device shown in FIG. 15, the difference is that, in the access network node device shown in FIG.
- the third sending module 1501 may further send the integrity key and the encryption key of the UMTS to the user equipment by using an encryption and integrity protected access layer message, so that the user equipment stores the integrity key and the encryption of the UMTS. Key.
- the access network node device in this embodiment may further include:
- the authentication module 1503 is configured to perform a certificate-based authentication process with the control node device of the UMTS to generate the foregoing Internet protocol security key and a random number.
- the third receiving module 1504 is configured to receive a UMTS key update request message sent by the user equipment when the UMTS key life cycle reaches a preset threshold;
- the third generation module 1502 may further generate a new random number after the third receiving module 1504 receives the UMTS key update request message, and re-derive the UMTS according to the new random number and the Internet protocol security key. Integrity key and encryption key.
- the foregoing access network node device can implement the UMTS integrity key and the encryption key in the UL Boosting scenario with the eNB as an anchor, so that the user equipment can perform secure communication through the UMTS, thereby improving the transmission on the UMTS.
- the security of the data can implement the UMTS integrity key and the encryption key in the UL Boosting scenario with the eNB as an anchor, so that the user equipment can perform secure communication through the UMTS, thereby improving the transmission on the UMTS.
- the security of the data can be implemented using the UMTS integrity key and the encryption key in the UL Boosting scenario with the eNB as an anchor, so that the user equipment can perform secure communication through the UMTS, thereby improving the transmission on the UMTS. The security of the data.
- FIG. 17 is a schematic structural diagram of Embodiment 1 of a user equipment according to the present invention.
- the user equipment in this embodiment may be applied.
- the flow of the embodiment shown in FIG. 9 of the present invention is implemented.
- the user equipment may include:
- the fourth receiving module 1701 is configured to receive a UMTS key derivation indication message.
- the fourth generation module 1702 is configured to derive the integrity of the UMTS according to the count value of the LTE system and the root key of the LTE system, or according to the root key of the LTE system and the random number carried by the UMTS key derivation indication message. Key and encryption key.
- the fourth receiving module 1701 may be a non-access stratum root key of the LTE system in the root key of the LTE system, and the count value of the LTE system is the current non-access stratum of the LTE system.
- the fourth generation module 1702 may be based on the current non-access stratum count value of the LTE system and the non-access stratum root key of the LTE system, or according to the non-access stratum root key and the core network node device of the LTE system.
- the generated random number is derived into the integrity key and encryption key of the UMTS.
- the fourth receiving module 1701 may be that the root key is an access layer root key of the LTE system, and the counting value of the LTE system is a packet data aggregation protocol count value of the LTE system, and the UMTS key is used.
- the random number carried by the key derivation indication message is a random number generated by the access network node of the LTE system
- the UMTS key derivation indication message sent by the access network node device of the LTE system is received;
- the fourth generation module 1702 may aggregate the protocol count value according to the packet data of the LTE system and the access layer root key of the LTE system, or the access layer root key of the LTE system and the access network node device of the LTE system.
- the generated random number is derived into the integrity key and encryption key of the UMTS.
- the fourth generation module 1702 may derive the UMTS according to the LTE system's count value and the root key of the LTE system, or according to the root key of the LTE system and the random number carried by the UMTS key derivation indication message.
- the integrity key and the encryption key so that the integrity key and the encryption key of the UMTS can be derived in the UL Boosting scenario with the eNB as an anchor, so that the UE can communicate securely through the UMTS, thereby improving The security of data transmitted over UMTS.
- FIG. 18 is a schematic structural diagram of Embodiment 1 of a control node device according to the present invention.
- the control node device in this embodiment may be applied to a UL Boosting scenario in which a base station is used as an anchor to implement the embodiment shown in FIG. 3 or FIG. 10 of the present invention. Process.
- the control node device may include:
- a fifth receiving module 1801 configured to receive an integrity key and an encryption key of the UMTS sent by the access network node device of the LTE system, and a security capability of the user equipment;
- the fourth sending module 1802 is configured to send, by using an access network node device of the LTE system, an integrity-protected security mode command message to the user equipment, where the security mode command message carries the integrity of the control node device according to the security capability of the user equipment.
- the fifth receiving module 1801 may further receive the integrity-protected security mode command sent by the user equipment through the access network node device of the LTE system after the fourth sending module 1802 sends the security mode command message to the user equipment.
- the completion message, the security mode command completion message is after the user equipment receives the security mode command message, according to the UMTS integrity key, the integrity sequence number, the direction identifier, the security mode command message, and the security mode command message of the user equipment.
- the carried parameter value generates an integrity information authentication code, and determines that the integrity information authentication code generated by the user equipment is consistent with the integrity information authentication code carried in the security mode command message, and the user carried in the security mode command message After the security capability of the device is consistent with the security capability of the user equipment, the device is sent to the control node device through the access network node device of the LTE system.
- the control node device in this embodiment may be used as a control node device of the UMTS, and the control node device may be a physical device having a control function, such as an RNC or the like.
- the fourth sending module 1802 may send a security mode command message to the user equipment through the access network node of the LTE system
- the fifth receiving module 1801 may receive the security mode sent by the user equipment through the access network node of the LTE system.
- the command completion message can be implemented.
- the SMC process can be performed between the control node device and the user equipment, and the encryption and integrity algorithms are negotiated.
- modules in the apparatus in the embodiments may be distributed in the apparatus of the embodiment according to the description of the embodiments, or may be correspondingly changed in one or more apparatuses different from the embodiment.
- the modules of the above embodiments may be combined into one module, or may be further split into a plurality of sub-modules.
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computer Hardware Design (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Mobile Radio Communication Systems (AREA)
Abstract
本发明实施例提供一种密钥生成方法和设备,该密钥生成方法应用在以基站为锚点的UMTS与LTE***资源聚合的场景中,包括:根据所述LTE***的根密钥和所述LTE***的计数值,或者根据随机数和所述LTE***的根密钥推衍生成UMTS的完整性密钥和加密密钥;将所述UMTS的完整性密钥和加密密钥发送给UMTS的控制节点,以使所述UMTS的控制节点通过所述UMTS的完整性密钥和加密密钥进行加密和完整性保护。本发明实施例可以实现在在以基站为锚点的UMTS与LTE***资源聚合的场景中推衍生成UMTS的完整性密钥和加密密钥,使得用户设备可以通过UMTS进行安全通信,进而可以提高UMTS上传输的数据的安全性。
Description
密钥生成方法和设备 本申请要求于 2011年 01月 28日提交中国专利局、 申请号为 CN 201110031924.4、 发明名称为 "密钥生成方法和设备"的中国专利申请的优先权, 其全部内容通过引用结 合在本申请中。 技术领域 本发明实施例涉及通信技术领域, 尤其涉及一种密钥生成方法和设备。 背景技术 随着长期演进 (Long Term Evolution; 以下简称: LTE) 的发展, 将会出现 LTE系 统与通用移动通信***(Universal Mobile Telecommunications System;以下简称: UMTS) 混合组网的场景, 在 LTE***与 UMTS混合组网的场景下可以利用 LTE***和 UMTS 联合对用户的业务进行传输, 从而提高传输速率。
在以基站 (evolved NodeB; 以下简称: eNB) 为锚点的 UMTS与 LTE***资源聚合 (UMTS LTE Boosting; 以下简称: UL Boosting) 场景中, LTE***不变, UMTS的接 入网节点无线网络控制器 (Radio Network Controller; 以下简称: RNC) 通过 eNB接入 到 LTE***的核心网。 这种场景中存在 UMTS和 LTE***这两个***的接入网, 但是只 存在 LTE这一个***的核心网, 用户设备 (User Equipment; 以下简称: UE) 可以同时 通过 UMTS和 LTE***这两个***的接入网元将数据传送给核心网, 从而提高业务的传 输速率。
在以 eNB为锚点的 UL Boosting场景中, RNC和 eNB较完整的保留了现存协议,
LTE***和 UMTS的数据汇聚于分组数据聚合协议 (Packet Data Convergence Protocol; 以下简称: PDCP) 层之上。 现有技术中, LTE***和 UMTS采用各自的安全协议层对 业务数据进行安全保护。
但是在以 eNB为锚点的 UL Boosting场景中, UE通过 LTE***, 与核心网进行认 证与密钥协商 (Authentication and Key Agreement; 以下简称: AKA), 生成 LTE***的 密钥。但是在以 eNB为锚点的 UL Boosting场景中只存在 UMTS的接入网,不存在 UMTS 的核心网, 因此 UMTS不能通过与核心网的认证来生成 UMTS密钥。 如果 UMTS没有 安全密钥,则在 UMTS上传输的数据将不受安全保护,容易被攻击者窃听,安全性较低。
发明内容
本发明实施例提供一种密钥生成方法和设备, 以实现在以 eNB 为锚点的 UL Boosting场景中生成 UMTS的密钥, 提高 UMTS上传输的数据的安全性。
本发明实施例提供一种密钥生成方法, 应用在以基站为锚点的通用移动通信*** (UMTS) 与长期演进 (LTE) ***资源聚合的场景中, 包括:
根据所述 LTE***的根密钥和所述 LTE***的计数值,或者根据随机数和所述 LTE ***的根密钥推衍生成 UMTS的完整性密钥和加密密钥;
将所述 UMTS的完整性密钥和加密密钥发送给 UMTS的控制节点, 以使所述 UMTS 的控制节点通过所述 UMTS的完整性密钥和加密密钥进行加密和完整性保护。
本发明实施例还提供一种密钥生成方法, 应用在以基站为锚点的通用移动通信***
(UMTS) 与长期演进 (LTE) ***资源聚合的场景中, 包括:
LTE***的接入网节点向 UMTS的控制节点发送 UMTS密钥推衍指示消息, 所述 UMTS密钥推衍指示消息携带所述接入网节点生成的随机数, 以使所述 UMTS 的控制 节点根据因特网协议安全密钥和所述随机数推衍生成 UMTS的完整性密钥和加密密钥; 所述 LTE***的接入网节点根据所述因特网协议安全密钥和所述随机数推衍生成
UMTS的完整性密钥和加密密钥。
本发明实施例还提供一种密钥生成方法, 应用在以基站为锚点的通用移动通信*** (UMTS) 与长期演进 (LTE) ***资源聚合的场景中, 包括:
用户设备接收 UMTS密钥推衍指示消息;
所述用户设备根据所述 LTE***的计数值和所述 LTE***的根密钥, 或者根据所述
LTE***的根密钥和所述 UMTS密钥推衍指示消息携带的随机数推衍生成 UMTS的完整 性密钥和加密密钥。
本发明实施例还提供一种消息发送方法, 应用在以基站为锚点的通用移动通信*** (UMTS) 与长期演进 (LTE) ***资源聚合的场景中, 包括:
UMTS的控制节点接收 LTE***的接入网节点发送的所述 UMTS的完整性密钥和 加密密钥, 以及用户设备的安全能力;
所述 UMTS的控制节点通过所述 LTE***的接入网节点向所述用户设备发送受完整 性保护的安全模式命令消息,所述安全模式命令消息携带所述控制节点根据所述用户设 备的安全能力选择的完整性算法和加密算法、所述用户设备的安全能力和所述控制节点 生成的参数值, 以及所述控制节点根据所述 UMTS的完整性密钥、 所述控制节点生成的
参数值、 完整性序列号、 所述安全模式命令消息和方向标识生成的完整性信息鉴权码。 本发明实施例还提供一种核心网节点设备, 应用在以基站为锚点的通用移动通信系 统 (UMTS) 与长期演进 (LTE) ***资源聚合的场景中, 包括:
第一生成模块, 用于根据所述 LTE***的非接入层根密钥和所述 LTE***当前的 非接入层计数值, 或者根据所述 LTE ***的非接入层根密钥和所述核心网节点设备生 成的随机数推衍生成 UMTS的完整性密钥和加密密钥;
第一发送模块, 用于将所述第一生成模块生成的 UMTS的完整性密钥和加密密钥发 送给 UMTS的控制节点设备, 以使所述 UMTS的控制节点设备通过所述 UMTS的完整性 密钥和加密密钥进行加密和完整性保护。
本发明实施例还提供一种接入网节点设备, 应用在以基站为锚点的通用移动通信系 统 (UMTS) 与长期演进 (LTE) ***资源聚合的场景中, 包括:
第二生成模块, 用于根据所述 LTE***的接入层根密钥和所述 LTE***的分组数 据聚合协议计数值, 或者根据所述 LTE ***的接入层根密钥和所述接入网节点生成的 随机数推衍生成 UMTS的完整性密钥和加密密钥;
第二发送模块, 用于将所述第二生成模块生成的 UMTS的完整性密钥和加密密钥发 送给 UMTS的控制节点设备, 以使所述 UMTS的控制节点设备通过所述 UMTS的完整性 密钥和加密密钥进行加密和完整性保护。
本发明实施例还提供一种接入网节点设备, 应用在以基站为锚点的通用移动通信系 统 (UMTS) 与长期演进 (LTE) ***资源聚合的场景中, 包括:
第三发送模块, 用于向 UMTS的控制节点设备发送 UMTS密钥推衍指示消息, 所 述 UMTS密钥推衍指示消息携带所述接入网节点设备生成的随机数, 以使所述 UMTS 的控制节点设备根据因特网协议安全密钥和所述随机数推衍生成 UMTS 的完整性密钥 和加密密钥;
第三生成模块, 用于根据所述因特网协议安全密钥和所述随机数推衍生成 UMTS的 完整性密钥和加密密钥。
本发明实施例还提供一种用户设备, 应用在以基站为锚点的通用移动通信*** (UMTS) 与长期演进 (LTE) ***资源聚合的场景中, 包括:
第四接收模块, 用于接收 UMTS密钥推衍指示消息;
第四生成模块, 用于根据所述 LTE***的计数值和所述 LTE***的根密钥, 或者根 据所述 LTE***的根密钥和所述 UMTS密钥推衍指示消息携带的随机数推衍生成 UMTS
的完整性密钥和加密密钥。
本发明实施例还提供一种控制节点设备, 应用在以基站为锚点的通用移动通信*** (UMTS) 与长期演进 (LTE) ***资源聚合的场景中, 包括:
第五接收模块, 用于接收 LTE***的接入网节点设备发送的所述 UMTS的完整性 密钥和加密密钥, 以及用户设备的安全能力;
第四发送模块, 用于通过所述 LTE***的接入网节点设备向所述用户设备发送受完 整性保护的安全模式命令消息,所述安全模式命令消息携带所述控制节点设备根据所述 用户设备的安全能力选择的完整性算法和加密算法、所述用户设备的安全能力和所述控 制节点设备生成的参数值, 以及所述控制节点设备根据所述 UMTS的完整性密钥、 所述 控制节点设备生成的参数值、 完整性序列号、 所述安全模式命令消息和方向标识生成的 完整性信息鉴权码。
本发明实施例可以根据 LTE***的根密钥和 LTE***的计数值, 或者根据随机数和 该 LTE***的根密钥推衍生成 UMTS的完整性密钥和加密密钥; 也可以根据因特网协议 安全密钥和 LTE***的接入网节点生成的随机数推衍生成 UMTS的完整性密钥和加密密 钥; 从而可以实现在以 eNB为锚点的 UL Boosting场景中推衍生成 UMTS的完整性密钥和 加密密钥, 使得用户设备可以通过 UMTS进行安全通信, 进而可以提高 UMTS上传输的 数据的安全性。 附图说明 为了更清楚地说明本发明实施例或现有技术中的技术方案, 下面将对实施例或现有 技术描述中所需要使用的附图作一简单地介绍, 显而易见地, 下面描述中的附图是本发 明的一些实施例, 对于本领域普通技术人员来讲, 在不付出创造性劳动的前提下, 还可 以根据这些附图获得其他的附图。
图 1为本发明密钥生成方法实施例一的流程图;
图 2为本发明密钥生成方法实施例二的流程图;
图 3为本发明消息发送方法实施例一的流程图;
图 4为本发明密钥生成方法实施例三的流程图;
图 5为本发明密钥生成方法实施例四的流程图;
图 6为本发明密钥生成方法实施例五的流程图;
图 7为本发明密钥生成方法实施例六的流程图;
图 8为本发明密钥生成方法实施例七的流程图;
图 9为本发明密钥生成方法实施例八的流程图;
图 10为本发明消息发送方法实施例二的流程图;
图 11为本发明核心网节点设备实施例一的结构示意图;
图 12为本发明核心网节点设备实施例二的结构示意图;
图 13为本发明接入网节点设备实施例一的结构示意图;
图 14为本发明接入网节点设备实施例二的结构示意图;
图 15为本发明接入网节点设备实施例三的结构示意图;
图 16为本发明接入网节点设备实施例四的结构示意图;
图 17为本发明用户设备实施例一的结构示意图;
图 18为本发明控制节点设备实施例一的结构示意图。 具体实肺式 为使本发明实施例的目的、 技术方案和优点更加清楚, 下面将结合本发明实施例中 的附图, 对本发明实施例中的技术方案进行清楚、 完整地描述, 显然, 所描述的实施例 是本发明一部分实施例, 而不是全部的实施例。 基于本发明中的实施例, 本领域普通技 术人员在没有做出创造性劳动的前提下所获得的所有其他实施例, 都属于本发明保护的 范围。
图 1为本发明密钥生成方法实施例一的流程图,本实施例提供的密钥生成方法可以 应用在 UL Boosting场景中。
如图 1所示, 该密钥生成方法可以包括:
步骤 101,根据 LTE***的根密钥和 LTE***的计数值,或者根据随机数和该 LTE ***的根密钥推衍生成 UMTS的完整性密钥和加密密钥。
步骤 102, 将 UMTS的完整性密钥和加密密钥发送给 UMTS的控制节点, 以使该 UMTS的控制节点通过 UMTS的完整性密钥和加密密钥进行加密和完整性保护。
本实施例的一种实现方式中, LTE***的根密钥可以为 LTE***的非接入层根密 钥, LTE***的计数值可以为该 LTE***当前的非接入层计数值, 则根据 LTE***的 根密钥和 LTE***的计数值, 或者根据随机数和该 LTE***的根密钥推衍生成 UMTS 的完整性密钥和加密密钥之前, 核心网节点可以接收 LTE ***的接入网节点发送的 UMTS密钥推衍指示消息; 根据 LTE***的根密钥和 LTE***的计数值, 或者根据随
机数和该 LTE***的根密钥推衍生成 UMTS的完整性密钥和加密密钥可以为: 核心网 节点根据 LTE***当前的非接入层计数值和 LTE***的非接入层根密钥,或者根据 LTE ***的非接入层根密钥和核心网节点生成的随机数推衍生成 UMTS 的完整性密钥和加 密密钥。
本实现方式中, 核心网节点接收 LTE***的接入网节点发送的 UMTS密钥推衍指 示消息之后,核心网节点可以向用户设备发送 UMTS密钥推衍指示消息, 以使该用户设 备根据 LTE***当前的非接入层计数值和 LTE***的非接入层根密钥, 或者根据 LTE ***的非接入层根密钥和 UMTS密钥推衍指示消息中携带的随机数推衍生成 UMTS的 完整性密钥和加密密钥。
另外, 本实现方式中, 核心网节点根据 LTE***当前的非接入层计数值和 LTE系 统的非接入层根密钥, 或者根据 LTE ***的非接入层根密钥和核心网节点生成的随机 数推衍生成 UMTS的完整性密钥和加密密钥之后,该核心网节点也可以通过非接入层消 息将 UMTS的完整性密钥和加密密钥发送给用户设备, 以使该用户设备存储 UMTS的 完整性密钥和加密密钥。
本实现方式中, 将 UMTS的完整性密钥和加密密钥发送给 UMTS的控制节点可以 为: 核心网节点将 UMTS的完整性密钥和加密密钥发送给 LTE***的接入网节点, 以 使该 LTE***的接入网节点将 UMTS的完整性密钥和加密密钥发送给 UMTS的控制节 点, 再由 UMTS的控制节点保存该 UMTS的完整性密钥和加密密钥。
本实现方式中, 当 UMTS密钥生命周期达到预设的阈值时,核心网节点可以在接收 到用户设备发送的 UMTS密钥更新请求消息之后, 根据 LTE***当前的非接入层计数 值和该 LTE***的非接入层根密钥重新推衍生成 UMTS的完整性密钥和加密密钥; 或 者,
当 UMTS密钥生命周期达到预设的阈值时,核心网节点可以在接收到用户设备发送 的 UMTS密钥更新请求消息之后, 生成新的随机数, 并根据新的随机数和 LTE***的 非接入层根密钥重新推衍生成 UMTS的完整性密钥和加密密钥; 或者,
当 UMTS密钥生命周期达到预设的阈值时,接收到用户设备的通知之后,可以通过 重新进行认证与密钥协商过程, 重新推衍生成 UMTS的完整性密钥和加密密钥。
本实施例的另一种实现方式中, LTE***的根密钥可以为 LTE***的接入层根密 钥, LTE***的计数值可以为 LTE***的分组数据聚合协议计数值, 根据 LTE***的 根密钥和该 LTE***的计数值,或者根据随机数和该 LTE***的根密钥推衍生成 UMTS
的完整性密钥和加密密钥可以为: LTE***的接入网节点根据 LTE***的接入层根密 钥和该 LTE***的分组数据聚合协议计数值, 或者根据 LTE***的接入层根密钥和该 接入网节点生成的随机数推衍生成 UMTS的完整性密钥和加密密钥。
本实现方式中, 根据 LTE***的根密钥和该 LTE***的计数值, 或者根据随机数 和该 LTE***的根密钥推衍生成 UMTS的完整性密钥和加密密钥之前, LTE***的接 入网节点可以向用户设备发送 UMTS密钥推衍指示消息,以使该用户设备可以根据 LTE ***的接入层根密钥和该 LTE***的分组数据聚合协议计数值, 或者根据 LTE***的 接入层根密钥和 UMTS 密钥推衍指示消息中携带的接入网节点生成的随机数推衍生成 UMTS的完整性密钥和加密密钥。
本实现方式中, LTE***的接入网节点根据 LTE***的接入层根密钥和该 LTE系 统的分组数据聚合协议计数值, 或者根据 LTE ***的接入层根密钥和该接入网节点生 成的随机数推衍生成 UMTS 的完整性密钥和加密密钥之后, LTE***的接入网节点也 可以通过受加密和完整性保护的接入层消息将上述 UMTS 的完整性密钥和加密密钥发 送给用户设备, 以使该用户设备存储 UMTS的完整性密钥和加密密钥。
本实现方式中, 将 UMTS的完整性密钥和加密密钥发送给 UMTS的控制节点可以 为: LTE***的接入网节点将 UMTS的完整性密钥和加密密钥发送给 UMTS的控制节 点, 以使该 UMTS的控制节点保存 UMTS的完整性密钥和加密密钥。
本实现方式中, 当分组数据聚合协议计数值溢出或者用户设备从空闲状态进入连接 状态时, 该 LTE***的接入网节点可以根据 LTE***的分组数据聚合协议计数值和该 接入网节点更新后的接入层根密钥, 或者根据接入网节点更新后的接入层根密钥和该接 入网节点新生成的随机数推衍生成 UMTS的完整性密钥和加密密钥; 或者,
当 UMTS密钥生命周期达到预设的阈值时, 该 LTE***的接入网节点可以在接收 到用户设备发送的 UMTS密钥更新请求消息之后,生成新的随机数,并根据新的随机数 和接入层根密钥重新推衍生成 UMTS的完整性密钥和加密密钥; 或者,
当 UMTS密钥生命周期达到预设的阈值时,可以在接收到用户设备的通知之后,通 过重新进行认证与密钥协商过程, 重新推衍生成 UMTS的完整性密钥和加密密钥。
本实施例上述两种实现方式中, UMTS 的控制节点可以在接收 UMTS 的完整性密 钥和加密密钥的过程中,还接收用户设备的安全能力,然后 UMTS的控制节点可以向用 户设备发送受完整性保护的安全模式命令消息, 该安全模式命令消息携带该控制节点根 据该用户设备的安全能力选择的完整性算法和加密算法、用户设备的安全能力和该控制
节点生成的参数值, 以及该控制节点根据 UMTS的完整性密钥、该控制节点生成的参数 值、 完整性序列号、 该安全模式命令消息和方向标识生成的完整性信息鉴权码。
然后, 控制节点可以接收用户设备发送的受完整性保护的安全模式命令完成消息, 该安全模式命令完成消息是用户设备接收到安全模式命令消息之后, 根据用户设备的 UMTS的完整性密钥、 完整性序列号、 方向标识、 上述安全模式命令消息和该安全模式 命令消息中携带的参数值生成完整性信息鉴权码, 并在确定用户设备生成的完整性信息 鉴权码与上述安全模式命令消息中携带的完整性信息鉴权码一致, 且该安全模式命令消 息中携带的用户设备的安全能力与该用户设备自身的安全能力一致后发送给上述控制 节点的。
另外, UMTS 的控制节点可以在接收 UMTS 的完整性密钥和加密密钥的过程中, 还接收用户设备的安全能力, 然后 UMTS的控制节点可以通过 LTE***的接入网节点 向用户设备发送受完整性保护的安全模式命令消息, 该安全模式命令消息携带该控制节 点根据用户设备的安全能力选择的完整性算法和加密算法、用户设备的安全能力和该控 制节点生成的参数值, 以及该控制节点根据 UMTS的完整性密钥、该控制节点生成的参 数值、 完整性序列号、 该安全模式命令消息和方向标识生成的完整性信息鉴权码。
然后, 控制节点可以接收用户设备通过 LTE ***的接入网节点发送的受完整性保 护的安全模式命令完成消息, 该安全模式命令完成消息是用户设备接收到安全模式命令 消息之后, 根据用户设备的 UMTS的完整性密钥、 完整性序列号、 方向标识、 上述安全 模式命令消息和该安全模式命令消息中携带的参数值生成完整性信息鉴权码, 并在确定 用户设备生成的完整性信息鉴权码与上述安全模式命令消息中携带的完整性信息鉴权 码一致, 且该安全模式命令消息中携带的用户设备的安全能力与该用户设备自身的安全 能力一致后通过 LTE***的接入网节点发送给 UMTS的控制节点的。
上述实施例中, 核心网节点或接入网节点可以根据 LTE***的根密钥和 LTE*** 的计数值, 或者根据随机数和该 LTE***的根密钥推衍生成 UMTS的完整性密钥和加 密密钥,从而可以实现在以 eNB为锚点的 UL Boosting场景中推衍生成 UMTS的完整性 密钥和加密密钥, 使得用户设备可以通过 UMTS进行安全通信, 进而可以提高 UMTS 上传输的数据的安全性。
本发明实施例中, 接入网节点可以为具有接入功能的节点, 例如: 基站等, 其中该 基站可以包括 eNB, 该 eNB可以为普通的宏基站, 也可以是一些小型基站, 包括家庭 基站 (Home enhanced NodeB; 以下简称: HeNB/Home NodeB; 以下简称: HNB) 或中
继站 (Relay Node; 以下简称: RN) 等等; 核心网节点可以为提供核心网功能的节点, 例如: 移动管理实体 (Mobility Management Entity; 以下简称: MME)等; UMTS的控 制节点可以为具有控制功能的实体,例如: RNC等;本发明实施例对接入网节点、 UMTS 的控制节点和核心网节点的具体形式不作限定。
但本发明以下实施例以 LTE***的接入网节点为 eNB、核心网节点为 MME、UMTS 的控制节点为 RNC 为例进行说明; 本发明以下实施例提供的方法均可应用于 UL Boosting场景中
图 2为本发明密钥生成方法实施例二的流程图, 如图 2所示, 该密钥生成方法可以 包括:
步骤 201, UE向 MME发送附着请求消息, 请求接入 LTE网络。
步骤 202, UE与 MME之间进行 LTE AKA的流程, 完成 UE与 MME之间的双向 认证, 生成 LTE***的密钥。
其中, 该 LTE***的密钥可以包括 LTE***的非接入层 (Non Access Stratum; 以 下简称: NAS) 根密钥, 该 NAS根密钥保存在 UE与 MME中。
步骤 203, UE与 MME认证成功之后, MME向 eNB分配演进通用陆地无线接入网 无线接入承载 (Evolved Universal Terrestrial Radio Access Network Radio Access Bearer; 以下简称: E-RAB) 。
步骤 204, eNB根据分配的 E-RAB选择 LTE***和 UMTS的无线接入技术(Radio Access Technology; 以下简称: RAT) 。
步骤 205, 建立 UE 与 eNB 之间的演进通用陆地无线接入网无线承载 (Evolved
Universal Terrestrial Radio Access Network Radio Bearer; 以下简禾尔: E-RB) 。
步骤 206, UE对可能协作的 UMTS小区进行测量, 获得测量报告, 并将测量报告 发送给 eNB。
步骤 207, eNB根据 UE上报的 UMTS小区的测量结果, 选择参与聚合的 RNC。 步骤 208, eNB向 RNC发送重配置请求消息。
步骤 209, 建立 UE与 RNC之间的无线承载 (Radio Bearer; 以下简称: RB) 。 步骤 210, eNB向 MME发送 UMTS密钥推衍指示消息。
步骤 211, 接收到 UMTS密钥推衍指示消息之后, MME推衍 UMTS的完整性密钥 (Integrity Key; 以下简称: IK) 和加密密钥 (Cipher Key; 以下简称: CK) 。 具体可 以采用如下几种方法:
a)根据 NAS根密钥(Kasme)和 LTE***当前的非接入层计数值(Non Access Stratum Count + 1; 以下简称: NAS Count + 1 )推衍生成 UMTS密钥 IK和 CK,即 IKIICK = KDF (Kasme, NAS Count + 1 ) , 其中 KDF为密钥推衍函数 (Key Derivation Function) 的 縮写; 或者,
b) MME生成一个随机数 (Nonce) , 然后根据 Kasme禾 B Nonce推衍生成 UMTS 密钥 IK和 CK, 即 IKIICK = KDF(Kasme, Nonce); 然后在步骤 212中, MME将 Nonce 值附带在 UMTS密钥推衍指示消息中发送给 UE。
另外,本实施例步骤 211中, MME收到来自 eNB的 UMTS密钥推衍指示消息之后, 也可以不进行任何处理。
步骤 212, MME向 UE发送 UMTS密钥推衍指示消息。
具体地, 如果 MME在步骤 211中未进行任何处理, 则 MME在发送 UMTS密钥推 衍指示消息给 UE后,还需要在本地推衍 UMTS密钥 IK和 CK,即 IKIICK=KDF(Kasme, NAS Count)
步骤 213, UE收到 UMTS密钥推衍指示消息后, 推衍 UMTS密钥 CK和 IK。 具体 可以采用以下两种方法:
a) 根据 Kasme和 LTE***当前的非接入层计数值 (NAS Count) 推衍生成 UMTS 密钥 IK和 CK, W IKIICK=KDF(Kasme, NAS Count); 或者,
b) UE根据 Kasme和 Nonce推衍生成 UMTS密钥 IK和 CK,即 IKIICK=KDF( Kasme, Nonce) ;
需要说明的是,如果 MME在步骤 211中推衍 UMTS密钥时使用的非接入层计数值 是 (NAS Count + 1 ) , 则 UE在步骤 213中推衍 UMTS密钥时需要使用非接入层计数 值 (NAS Count) , 这样可以使得 MME和 UE在推衍 UMTS密钥时使用相同的非接入 层计数值, 可以使 MME和 UE推衍的 UMTS密钥保持同步。
步骤 214, MME将推衍生成的 IK和 CK发送给 eNB。
步骤 215, eNB将 IK、 CK和 UE安全能力 (UE security capability) 发送给 RNC。 步骤 216, RNC存储接收到的 IK和 CK。
步骤 217, RNC向 UE发送安全模式命令( Security Mode Command;以下简称: SMC) 消息,该 SMC消息中携带有 RNC根据 UE安全能力选择的加密和完整性算法、该 RNC 生成的参数值 (Fresh) 和 UE安全能力, 以及根据 IK、 完整性序列号、 SMC消息、 方 向标识 (direction) 禾 B Fresh, 通过 F9 算法计算生成的完整性信息鉴权码 (Message
Authentication Code for Integrity; 以下简称: MAC-I) , 该 SMC消息受完整性保护。 步骤 218, UE收到 SMC消息后, 检查 MAC-I和 UE安全能力。
具体地, UE接收到 SMC消息之后, 可以根据该 UE的 IK、 完整性序列号、 方向 标识、 该 SMC消息和该 SMC消息中携带的参数值(Fresh) , 通过 F9算法生成完整性 信息鉴权码 (X Message Authentication Code for Integrity; 以下简称: XMAC-I) , 然后 通过比较 XMAC-I与 SMC消息中携带的 MAC-I是否相等来确定该 SMC消息是否完整, 当 XMAC-I与 SMC消息中携带的 MAC-I相等时, UE可以确定该 SMC消息完整。 并 且 UE还会检查该 SMC消息中携带的 UE安全能力和该 UE自身的安全能力是否一致。
当 UE确定 SMC消息完整, 且该 SMC消息中携带的 UE安全能力和该 UE自身的 安全能力一致之后, 执行步骤 219; 如果 UE确定 SMC消息不完整, 或者该 SMC消息 中携带的 UE安全能力和该 UE自身的安全能力不一致, 则结束本次流程。
步骤 219, UE向 MME发送 SMC完成消息, 该 SMC完成消息受完整性保护。 本实施例中, 在以下情况下, UMTS密钥需要进行更新:
1 ) 当 UMTS密钥生命周期 (START) 值达到预设的阈值时, UE通知网络侧进行 新的 AKA过程, 重新推衍 UMTS密钥 IK和 CK;
2)当 UMTS密钥生命周期(START)值达到预设的阈值时, UE向 MME发送 UMTS 密钥更新请求消息, MME收到该 UMTS密钥更新请求消息之后,根据 LTE***当前的 非接入层计数值 (NAS Count I (NAS Count + 1 ) ) 禾卩 Kasme生成新的 UMTS密钥 IK 和 CK;
3 )当 UMTS密钥生命周期(START)值达到预设的阈值时, UE向 MME发送 UMTS 密钥更新请求消息, MME收到该 UMTS密钥更新请求消息之后,生成新的随机数 Nonce, 并根据这个新的 Nonce和 Kasme生成新的 UMTS密钥 IK和 CK。
上述实施例中, MME和 UE可以根据 LTE***当前的非接入层计数值和 LTE*** 的非接入层根密钥(Kasme), 或者根据 LTE***的非接入层根密钥(Kasme)和 MME 生成的随机数推衍生成 UMTS密钥 IK和 CK, 从而可以实现在以 eNB 为锚点的 UL Boosting场景中推衍生成 UMTS的完整性密钥和加密密钥, 使得 UE可以通过 UMTS 进行安全通信, 进而可以提高 UMTS上传输的数据的安全性。
本发明图 2所示实施例中, LTE***和 UMTS各自有各自的无线信令承载( Signaling Radio Bearer; 以下简称: SRB ) , 当 LTE***和 UMTS共用一个 SRB时, SMC消息 的发送流程如图 3所示, 图 3为本发明消息发送方法实施例一的流程图, 如图 3所示,
可以包括:
步骤 301, RNC向 eNB发送 SMC消息, 该 SMC消息中携带有 RNC根据 UE安全 能力选择的加密和完整性算法、 该 RNC生成的参数值 (Fresh) 和 UE安全能力, 以及 根据 IK、完整性序列号、 SMC消息、方向标识和 Fresh,通过 F9算法计算生成的 MAC-I; 其中, 该 SMC消息受完整性保护。
步骤 302, eNB将上述 SMC消息发送给 UE, 该 SMC消息中携带有 RNC根据 UE 安全能力选择的加密和完整性算法、 该 RNC生成的参数值 (Fresh) 和 UE安全能力, 以及根据 IK、 完整性序列号、 SMC消息、 方向标识和 Fresh, 通过 F9算法计算生成的 步骤 303, UE检查 MAC-I和 UE安全能力。
具体地, UE接收到 SMC消息之后, 可以根据该 UE的 IK、 完整性序列号、 方向 标识、该 SMC消息和该 SMC消息中携带的参数值(Fresh),通过 F9算法生成 XMAC-I, 然后通过比较 XMAC-I与 SMC消息中携带的 MAC-I是否相等来确定该 SMC消息是否 完整, 当 XMAC-I与 SMC消息中携带的 MAC-I相等时, UE可以确定该 SMC消息完 整。并且 UE还会检查该 SMC消息中携带的 UE安全能力和该 UE自身的安全能力是否 一致。
当 UE确定 SMC消息完整, 且该 SMC消息中携带的 UE安全能力和该 UE自身的 安全能力一致之后, 执行步骤 304及其后续步骤; 如果 UE确定 SMC消息不完整, 或 者该 SMC消息中携带的 UE安全能力和该 UE自身的安全能力不一致,则结束本次流程。
步骤 304, UE向 eNB发送 SMC完成消息, 该 SMC完成消息受完整性保护。
步骤 305, eNB将 SMC完成消息发送给 RNC, 该 SMC完成消息受完整性保护。 上述实施例中, RNC通过 eNB向 UE发送 SMC消息, 并接收 UE通过 eNB发送的 SMC完成消息, 从而可以实现当 LTE***和 UMTS共用一个 SRB时, RNC与 UE之 间可以进行 SMC流程, 协商加密和完整性算法。
图 4为本发明密钥生成方法实施例三的流程图, 本实施例中, MME将推衍生成的
UMTS密钥 IK和 CK通过 NAS消息直接发送给 UE, UE无须再推衍 UMTS密钥。
如图 4所示, 该密钥生成方法可以包括:
步骤 401, UE向 MME发送附着请求消息, 请求接入 LTE网络。
步骤 402, UE与 MME之间进行 LTE AKA的流程, 完成 UE与 MME之间的双向 认证, 生成 LTE***的密钥。
其中, LTE***的密钥可以包括 LTE***的 NAS根密钥, 该 NAS根密钥保存在 UE与 MME中。
步骤 403, 认证成功后, MME向 eNB分配 E-RAB。
步骤 404, eNB根据分配的 E-RAB选择 LTE***和 UMTS的 RAT。
步骤 405, 建立 UE与 eNB之间的 E-RB。
步骤 406, UE对可能协作的 UMTS小区进行测量, 获得测量报告, 并将测量报告 发送给 eNB。
步骤 407, eNB根据 UE上报的 UMTS小区的测量结果, 选择参与聚合的 RNC。 步骤 408, eNB向 RNC发送重配置请求消息。
步骤 409, 建立 UE与 RNC之间的 RB。
步骤 410, eNB向 MME发送 UMTS密钥推衍指示消息。
步骤 411,接收到 UMTS密钥推衍指示消息之后, MME推衍 UMTS密钥 IK和 CK。 具体可以采用如下几种方法:
a) 根据 NAS根密钥 (Kasme) 和当前的非接入层计数值 (NAS Count) 推衍生成 UMTS密钥 IK和 CK, 即 IKIICK = KDF(Kasme, NAS Count); 或者,
b) MME生成一个随机数 (Nonce) , 然后根据 Kasme禾 B Nonce推衍生成 UMTS 密钥 IK和 CK, 即 IKIICK = KDF(Kasme, Nonce)。
步骤 412, MME通过 NAS消息将 UMTS密钥 IK和 CK发送给 UE, 该 NAS消息 受加密和完整性保护。
步骤 413, UE收到 NAS消息后, 存储 UMTS密钥 IK和 CK。
步骤 414, MME将推衍生成的 UMTS密钥 IK和 CK发送给 eNB。
步骤 415, eNB将 UMTS密钥 IK、 CK和 UE安全能力发送给 RNC。
步骤 416, RNC存储接收到的 UMTS密钥 IK和 CK。
步骤 417, RNC向 UE发送 SMC消息, 该 SMC消息中携带有 RNC选择的加密和 完整性算法、 该 RNC生成的参数值 (Fresh) 和 UE安全能力, 以及根据 IK、 完整性序 列号、 SMC消息、 方向标识和 Fresh, 通过 F9算法计算生成的 MAC-I, 该 SMC消息受 完整性保护。
步骤 418, UE收到 SMC消息后, 检查 MAC-I和 UE安全能力。
具体地, UE接收到 SMC消息之后, 可以根据该 UE的 IK、 完整性序列号、 方向 标识、该 SMC消息和该 SMC消息中携带的参数值(Fresh),通过 F9算法生成 XMAC-I,
然后通过比较 XMAC-I与 SMC消息中携带的 MAC-I是否相等来确定该 SMC消息是否 完整, 当 XMAC-I与 SMC消息中携带的 MAC-I相等时, UE可以确定该 SMC消息完 整。并且 UE还会检查该 SMC消息中携带的 UE安全能力和该 UE自身的安全能力是否 一致。
当 UE确定 SMC消息完整, 且该 SMC消息中携带的 UE安全能力和该 UE自身的 安全能力一致之后, 执行步骤 419; 如果 UE确定 SMC消息不完整, 或者该 SMC消息 中携带的 UE安全能力和该 UE自身的安全能力不一致, 则结束本次流程。
步骤 419, UE向 MME发送 SMC完成消息, 该 SMC完成消息受完整性保护。 本实施例在以下情况下, UMTS密钥需要进行更新:
1 ) 当 UMTS密钥生命周期 (START) 值达到预设的阈值时, UE通知网络侧进行 新的 AKA过程, 重新推衍 UMTS密钥 IK和 CK;
2) 当 UMTS密钥生命周期值达到预设的阈值时, UE向 MME发送 UMTS密钥更 新请求消息, MME收到该 UMTS密钥更新请求消息之后,根据 LTE***当前的非接入 层计数值 (NAS Count) 禾 B Kasme生成新的 UMTS密钥 IK和 CK;
3) 当 UMTS密钥生命周期值达到预设的阈值时, UE向 MME发送 UMTS密钥更 新请求消息, MME收到该 UMTS密钥更新请求消息之后, 生成新的随机数 Nonce, 并 根据这个新的 Nonce和 Kasme生成新的 UMTS密钥 IK和 CK。
本发明图 4所示实施例中, LTE和 UMTS各自有各自的 SRB, 当 LTE和 UMTS共 用一个 SRB时, SMC消息的发送流程可以如图 3所示, 在此不再赘述。
上述实施例中, MME可以根据 LTE***当前的非接入层计数值和 LTE***的非 接入层根密钥 (Kasme) , 或者根据 LTE***的非接入层根密钥 (Kasme) 和 MME生 成的随机数推衍生成 UMTS密钥 IK和 CK,然后 MME可以将 UMTS密钥 IK和 CK发 送给 UE, 从而可以实现在以 eNB为锚点的 UL Boosting场景中推衍生成 UMTS的完整 性密钥和加密密钥, 使得 UE可以通过 UMTS进行安全通信, 进而可以提高 UMTS上 传输的数据的安全性。
图 5为本发明密钥生成方法实施例四的流程图, 如图 5所示, 该密钥生成方法可以 包括:
步骤 501, UE向 MME发送附着请求消息, 请求接入 LTE网络。
步骤 502, UE与 MME之间进行 LTE AKA的流程, 完成 UE与 MME之间的双向 认证, 生成 LTE***的密钥。
本实施例中, 该 LTE***的密钥可以包括 LTE***的接入层根密钥。
步骤 503, 认证成功后, MME向 eNB分配 E-RAB。
步骤 504, eNB根据分配的 E-RAB选择 LTE***和 UMTS的 RAT。
步骤 505, 建立 UE与 eNB之间的 E-RB。
步骤 506, UE对可能协作的 UMTS小区进行测量, 获得测量报告, 并将测量报告 发送给 eNB。
步骤 507, eNB根据 UE上报的 UMTS小区的测量结果, 选择参与聚合的 RNC。 步骤 508, eNB向 RNC发送重配置请求消息。
步骤 509, 建立 UE与 RNC之间的 RB。
步骤 510, eNB向 UE发送 UMTS密钥推衍指示消息, 指示 UE开始推衍 UMTS密 钥。
可选地, eNB可以通过 UMTS密钥推衍指示消息将该 eNB生成的 Nonce值发送给
UE。
步骤 511, eNB推衍 UMTS密钥 IK和 CK。 具体可以采用以下几种方法: a) 根据 LTE***的接入层根密钥 (KeNB) 和 PDCP计数值 (PDCP Count) 推衍生 成 UMTS密钥 IK和 CK, 即 IKIICK = KDF(KeNB, PDCP Count);
b) eNB生成一个 Nonce值, 然后根据 KeNB和 Nonce值推衍生成 UMTS的密钥 IK 禾口 CK, 即 IKIICK=KDF(KeNB, Nonce)。
步骤 512, 接收到 UMTS密钥推衍指示消息之后, UE推衍 UMTS密钥 IK和 CK。 具体可以采用以下几种方法:
b)根据 KeNB和 Nonce值推衍生成 UMTS密钥 IK和 CK, 即 IKIICK = KDF ( KeNB, Nonce) 。
步骤 513, eNB将推衍生成的 UMTS密钥 IK、 CK和 UE安全能力发送给 RNC。 步骤 514, RNC存储 UMTS密钥 IK和 CK。
步骤 515, RNC向 UE发送 SMC消息, 该 SMC消息中携带有 RNC根据 UE安全 能力选择的加密和完整性算法、 该 RNC生成的参数值 (Fresh) 和 UE安全能力, 以及 根据 IK、完整性序列号、 SMC消息、方向标识和 Fresh,通过 F9算法计算生成的 MAC-I, 该 SMC消息受完整性保护。
步骤 516, UE收到 SMC消息之后, 检查 MAC-I和 UE安全能力。
具体地, UE接收到 SMC消息之后, 可以根据该 UE的 IK、 完整性序列号、 方向 标识、该 SMC消息和该 SMC消息中携带的参数值(Fresh),通过 F9算法生成 XMAC-I, 然后通过比较 XMAC-I与 SMC消息中携带的 MAC-I是否相等来确定该 SMC消息是否 完整, 当 XMAC-I与 SMC消息中携带的 MAC-I相等时, UE可以确定该 SMC消息完 整。并且 UE还会检查该 SMC消息中携带的 UE安全能力和该 UE自身的安全能力是否 一致。
当 UE确定 SMC消息完整, 且该 SMC消息中携带的 UE安全能力和该 UE自身的 安全能力一致之后, 执行步骤 517; 如果 UE确定 SMC消息不完整, 或者该 SMC消息 中携带的 UE安全能力和该 UE自身的安全能力不一致, 则结束本次流程。
步骤 517, UE向 RNC发送 SMC完成消息, 该 SMC完成消息受完整性保护。 本实施例以下情况下, UMTS密钥需要更新:
1 ) 当 UMTS密钥生命周期 (START) 值达到预设的阈值时, UE通知网络侧进行 新的 AKA过程, 重新推衍 UMTS密钥 IK和 CK;
2) 当 LTE***的 PDCP Count值溢出时, KeNB需要更新, 此时 UMTS密钥也进行 更新;
3) UE从空闲 (Idle)状态进入连接(connected)状态时, LTE***的 KeNB需要进 行更新, 此时 UMTS密钥也进行更新;
4) 当 UMTS密钥生命周期值达到预设的阈值时, UE向 eNB发送 UMTS密钥更新 请求消息, eNB收到该 UMTS密钥更新请求消息之后生成新的 Nonce值, 然后根据新 的 Nonce值和 KeNB重新推衍生成新的 UMTS密钥 IK和 CK。
上述实施例中, eNB 和 UE可以根据 PDCP计数值和 LTE***的接入层根密钥 (KeNB) , 或者根据 LTE***的接入层根密钥 (KeNB) 和 eNB生成的随机数推衍生成 UMTS密钥 IK和 CK, 从而可以实现在以 eNB为锚点的 UL Boosting场景中推衍生成 UMTS的完整性密钥和加密密钥, 使得 UE可以通过 UMTS进行安全通信, 进而可以提 高 UMTS上传输的数据的安全性。
本发明图 5所示实施例中, eNB和 UE可以分别推衍生成 UMTS密钥 IK和 CK, 也可以在 eNB中推衍出 UMTS密钥 IK和 CK, 然后通过接入层(Access Stratum; 以下 简称: AS) 消息下发给 UE, 如图 6所示, 图 6为本发明密钥生成方法实施例五的流程 图, 该密钥生成方法可以包括:
步骤 601, eNB根据 LTE***的接入层根密钥 (KeNB)推衍生成 UMTS密钥 IK和
CK。
具体地, eNB在推衍 UMTS密钥 IK和 CK时有如下几种方法:
a) 根据 KeNB和 PDCP计数值 (PDCP Count) 推衍生成 UMTS密钥 IK和 CK, 即 IKIICK = KDF(KeNB, PDCP Count);
b) eNB生成一个 Nonce值, 然后根据 KeNB和 Nonce值推衍生成 UMTS的密钥 IK 禾口 CK, 即 IKIICK = KDF(KeNB, Nonce)。
步骤 602, eNB通过 AS消息将推衍生成的 UMTS密钥 IK和 CK发送给 UE, 该 AS消息受加密和完整性保护。
步骤 603, UE存储 UMTS密钥 IK和 CK。
步骤 604, eNB将推衍生成的 UMTS密钥 IK、 CK和 UE安全能力发送给 RNC。 步骤 605, RNC存储 UMTS密钥 IK和 CK。
本实施例中, 步骤 602~步骤 603与步骤 604~步骤 605可以先后执行, 也可以并行 执行。
步骤 606~步骤 608, 同步骤 515~步骤 517, 在此不再赘述。
本发明图 5和图 6所示实施例中, LTE***和 UMTS各自有各自的 SRB, 当 LTE ***和 UMTS共用一个 SRB时, SMC消息的发送流程可以如图 3所示,在此不再赘述。
上述实施例中, eNB可以根据 PDCP计数值和 LTE***的接入层根密钥 (KeNB) , 或者根据 LTE***的接入层根密钥 (KeNB) 和 eNB生成的随机数推衍生成 UMTS密钥 IK禾 B CK, 然后 eNB可以将 UMTS密钥 IK和 CK发送给 UE, 从而可以实现在以 eNB 为锚点的 UL Boosting场景中推衍生成 UMTS的完整性密钥和加密密钥, 使得 UE可以 通过 UMTS进行安全通信, 进而可以提高 UMTS上传输的数据的安全性。
图 7为本发明密钥生成方法实施例六的流程图, 如图 7所示, 该密钥生成方法可以 包括:
步骤 701, LTE***的接入网节点向 UMTS的控制节点发送 UMTS密钥推衍指示 消息,该 UMTS密钥推衍指示消息携带接入网节点生成的随机数, 以使该控制节点根据 因特网协议安全密钥和上述随机数推衍生成 UMTS的完整性密钥和加密密钥。
步骤 702, LTE***的接入网节点根据该因特网协议安全密钥和上述随机数推衍生 成 UMTS的完整性密钥和加密密钥。
本实施例中, LTE***的接入网节点根据因特网协议安全密钥和上述随机数推衍生
成 UMTS的完整性密钥和加密密钥之后, 该 LTE***的接入网节点还可以通过受加密 和完整性保护的接入层消息将上述 UMTS的完整性密钥和加密密钥发送给用户设备,以 使该用户设备存储上述 UMTS的完整性密钥和加密密钥。
本实施例中,接入网节点向 UMTS的控制节点发送 UMTS密钥推衍指示消息之前, 该 LTE***的接入网节点还可以与 UMTS的控制节点进行基于证书的认证过程, 以生 成上述因特网协议安全密钥和随机数。
本实施例中, 当 UMTS密钥生命周期 (START) 值达到预设的阈值时, LTE*** 的接入网节点可以在接收到用户设备发送的 UMTS密钥更新请求消息之后,生成新的随 机数,然后根据新的随机数和因特网协议安全密钥重新推衍生成 UMTS的完整性密钥和 加密密钥。
另外,本实施例中,接入网节点通过接入层消息将上述 UMTS的完整性密钥和加密 密钥发送给用户设备之后, UMTS的控制节点可以向用户设备发送安全模式命令消息, 该安全模式命令消息携带该控制节点根据用户设备的安全能力选择的完整性算法和加 密算法、用户设备的安全能力和该控制节点生成的参数值, 以及该控制节点根据 UMTS 的完整性密钥、 该控制节点生成的参数值、 完整性序列号、 该安全模式命令消息和方向 标识生成的完整性信息鉴权码; 其中, 上述安全模式命令消息受完整性保护。
然后, 控制节点可以接收用户设备发送的安全模式命令完成消息, 该安全模式命令 完成消息是用户设备接收到安全模式命令消息之后,根据用户设备的 UMTS的完整性密 钥、 完整性序列号、 方向标识、 上述安全模式命令消息和该安全模式命令消息中携带的 参数值生成完整性信息鉴权码, 并在确定用户设备生成的完整性信息鉴权码与上述安全 模式命令消息中携带的完整性信息鉴权码一致, 且该安全模式命令消息中携带的用户设 备的安全能力与该用户设备自身的安全能力一致后发送给上述控制节点的; 其中, 该安 全模式命令完成消息受完整性保护。
另外,本实施例中,接入网节点通过接入层消息将上述 UMTS的完整性密钥和加密 密钥发送给用户设备之后, UMTS 的控制节点也可以通过 LTE***的接入网节点向用 户设备发送安全模式命令消息, 该安全模式命令消息携带该控制节点根据用户设备的安 全能力选择的完整性算法和加密算法、 用户设备的安全能力和该控制节点生成的参数 值, 以及该控制节点根据 UMTS的完整性密钥、该控制节点生成的参数值、完整性序列 号、 该安全模式命令消息和方向标识生成的完整性信息鉴权码; 其中, 上述安全模式命 令消息受完整性保护。
然后, UMTS 的控制节点可以接收用户设备通过 LTE***的接入网节点发送的安 全模式命令完成消息, 该安全模式命令完成消息是用户设备接收到安全模式命令消息之 后, 根据用户设备的 UMTS的完整性密钥、 完整性序列号、 方向标识、 上述安全模式命 令消息和该安全模式命令消息中携带的参数值生成完整性信息鉴权码, 并在确定用户设 备生成的完整性信息鉴权码与上述安全模式命令消息中携带的完整性信息鉴权码一致, 且该安全模式命令消息中携带的用户设备的安全能力与该用户设备自身的安全能力一 致后通过 LTE***的接入网节点发送给控制节点的; 其中, 该安全模式命令完成消息 受完整性保护。
上述实施例中, LTE***的接入网节点可以根据因特网协议安全密钥和该 LTE系 统的接入网节点生成的随机数推衍生成 UMTS的完整性密钥和加密密钥,从而可以实现 在以 eNB为锚点的 UL Boosting场景中推衍生成 UMTS的完整性密钥和加密密钥,使得 用户设备可以通过 UMTS进行安全通信,进而可以提高 UMTS上传输的数据的安全性。
图 8为本发明密钥生成方法实施例七的流程图, 本实施例假设 eNB和 RNC之间的连 接是不安全的, 需要基于证书的认证, 进而建立安全通道, 产生因特网协议安全密钥 psec。
如图 8所示, 该密钥生成方法可以包括:
步骤 801, UE向 MME发送附着请求消息, 请求接入 LTE网络。
步骤 802, UE与 MME之间进行 LTE AKA的流程, 完成 UE与 MME之间的双向 认证, 生成 LTE***的密钥。
步骤 803, 认证成功后, MME向 eNB分配 E-RAB。
步骤 804, eNB根据分配的 E-RAB选择 LTE***和 UMTS的 RAT。
步骤 805, 建立 UE与 eNB之间的 E-RB。
步骤 806, UE对可能协作的 UMTS小区进行测量, 获得测量报告, 并将测量报告 发送给 eNB。
步骤 807, eNB根据 UE上报的 UMTS小区的测量结果, 选择参与聚合的 RNC。 步骤 808, eNB和 RNC之间需要进行基于证书的认证过程, 以保证 eNB和 RNC 之间的通道是安全的。
步骤 809,通过 eNB和 RNC之间的认证过程, eNB生成因特网协议安全密钥(KIPsec), 并生成一个随机数 Nonce。
步骤 810, 通过 eNB和 RNC之间的认证过程, RNC也生成 KIPsec。
本实施例中, 步骤 809与步骤 810可以先后执行, 也可以并行执行。
步骤 811, 建立 UE与 RNC之间的 RB。
步骤 812, eNB向 RNC发送 UMTS密钥推衍指示消息, 该 UMTS密钥推衍指示消 息中携带有随机数 Nonce。
步骤 813, RNC收到随机数 Nonce后, 根据 KIPs∞和随机数 Nonce推衍生成 UMTS 密钥 IK和 CK, 即 IKIICK = KDF(Kipsec, Nonce)。
步骤 814, eNB根据 KIP ^和随机数 Nonce推衍生成 UMTS密钥 IK和 CK。
步骤 815, eNB将推衍生成的 UMTS密钥 IK和 CK通过 AS消息发送给 UE, 该 AS消息受加密和完整性保护。
步骤 816, UE存储接收到的 UMTS密钥 IK和 CK。
步骤 817, RNC向 UE发送 SMC消息, 该 SMC消息中携带有 RNC根据 UE安全 能力选择的加密和完整性算法、 生成的参数值 (Fresh) 和 UE安全能力, 以及根据 IK、 完整性序列号、 SMC消息、 方向标识和 Fresh, 通过 F9算法计算生成的 MAC-I, 同时 该 SMC消息受完整性保护。
步骤 818, UE收到 SMC消息后, 检查 MAC-I和 UE安全能力。
具体地, UE接收到 SMC消息之后, 可以根据该 UE的 IK、 完整性序列号、 方向 标识、该 SMC消息和该 SMC消息中携带的参数值(Fresh),通过 F9算法生成 XMAC-I, 然后通过比较 XMAC-I与 SMC消息中携带的 MAC-I是否相等来确定该 SMC消息是否 完整, 当 XMAC-I与 SMC消息中携带的 MAC-I相等时, UE可以确定该 SMC消息完 整。并且 UE还会检查该 SMC消息中携带的 UE安全能力和该 UE自身的安全能力是否 一致。
当 UE确定 SMC消息完整, 且该 SMC消息中携带的 UE安全能力和该 UE自身的 安全能力一致之后, 执行步骤 819; 如果 UE确定 SMC消息不完整, 或者该 SMC消息 中携带的 UE安全能力和该 UE自身的安全能力不一致, 则结束本次流程。
步骤 819, UE向 MME发送 SMC完成消息, 该 SMC完成消息受完整性保护。 本实施例在以下情况下, UMTS密钥需要进行更新:
1 )当 UMTS密钥生命周期(START)值达到预设的阈值时, UE向 eNB发送 UMTS 密钥更新请求消息, eNB接收到该 UMTS密钥更新请求消息后生成新的 Nonce,然后根 据该新的 Nonce和 KIPs∞重新推衍生成新的 UMTS密钥 IK和 CK。
本发明图 8所示实施例中, LTE和 UMTS各自有各自的 SRB, 当 LTE和 UMTS共
用一个 SRB时, SMC消息的发送流程可以如图 3所示, 在此不再赘述。
上述实施例中, eNB和 RNC可以根据 Κπ ^和该 eNB生成的随机数推衍生成 UMTS 密钥 IK和 CK, 然后 eNB可以将生成的 UMTS密钥 IK和 CK发送给 UE, 从而可以实 现在以 eNB为锚点的 UL Boosting场景中推衍生成 UMTS的完整性密钥和加密密钥,使 得 UE可以通过 UMTS进行安全通信, 进而可以提高 UMTS上传输的数据的安全性。
图 9为本发明密钥生成方法实施例八的流程图, 如图 9所示, 该密钥生成方法可以 包括:
步骤 901, 用户设备接收 UMTS密钥推衍指示消息。
步骤 902,用户设备根据 LTE***的计数值和该 LTE***的根密钥,或者根据 LTE ***的根密钥和 UMTS密钥推衍指示消息携带的随机数推衍生成 UMTS的完整性密钥 和加密密钥。
本实施例的一种实现方式中, LTE***的根密钥包括 LTE***的非接入层根密钥, LTE***的计数值包括 LTE***当前的非接入层计数值, 该 UMTS密钥推衍指示消息 携带的随机数包括核心网节点生成的随机数;则用户设备接收 UMTS密钥推衍指示消息 可以为: 用户设备接收核心网节点发送的 UMTS密钥推衍指示消息;
用户设备根据 LTE***的计数值和该 LTE***的根密钥, 或者根据 LTE***的根 密钥和 UMTS密钥推衍指示消息携带的随机数推衍生成 UMTS的完整性密钥和加密密 钥可以为: 用户设备根据 LTE***当前的非接入层计数值和 LTE***的非接入层根密 钥, 或者根据 LTE***的非接入层根密钥和核心网节点生成的随机数推衍生成 UMTS 的完整性密钥和加密密钥。
本实施例的另一种实现方式中, LTE***的根密钥包括 LTE***的接入层根密钥, LTE***的计数值包括 LTE***的分组数据聚合协议计数值, UMTS密钥推衍指示消 息携带的随机数包括 LTE***的接入网节点生成的随机数; 则用户设备接收 UMTS密 钥推衍指示消息可以为: 用户设备接收 LTE***的接入网节点发送的 UMTS密钥推衍 指示消息, 该 UMTS密钥推衍指示消息携带 LTE***的接入网节点生成的随机数; 用户设备根据 LTE***的计数值和该 LTE***的根密钥, 或者根据 LTE***的根 密钥和 UMTS密钥推衍指示消息携带的随机数推衍生成 UMTS的完整性密钥和加密密 钥可以为: 用户设备根据 LTE***的分组数据聚合协议计数值和 LTE***的接入层根 密钥, 或者根据 LTE***的接入层根密钥和 LTE***的接入网节点生成的随机数推衍 生成 UMTS的完整性密钥和加密密钥。
上述实施例中, 用户设备可以根据 LTE***的计数值和该 LTE***的根密钥, 或 者根据 LTE***的根密钥和 UMTS密钥推衍指示消息携带的随机数推衍生成 UMTS的 完整性密钥和加密密钥, 从而可以实现在以 eNB为锚点的 UL Boosting场景中推衍生成 UMTS的完整性密钥和加密密钥, 使得 UE可以通过 UMTS进行安全通信, 进而可以提 高 UMTS上传输的数据的安全性。
图 10为本发明消息发送方法实施例二的流程图, 如图 10所示, 该消息发送方法可 以包括:
步骤 1001, UMTS的控制节点接收 LTE***的接入网节点发送的 UMTS的完整性 密钥和加密密钥, 以及用户设备的安全能力。
步骤 1002, UMTS的控制节点通过 LTE***的接入网节点向用户设备发送受完整 性保护的安全模式命令消息, 该安全模式命令消息携带该控制节点根据用户设备的安全 能力选择的完整性算法和加密算法、 用户设备的安全能力和该控制节点生成的参数值, 以及控制节点根据 UMTS的完整性密钥、该控制节点生成的参数值、完整性序列号、安 全模式命令消息和方向标识生成的完整性信息鉴权码。
本实施例中, UMTS 的控制节点通过 LTE***的接入网节点向用户设备发送受完 整性保护的安全模式命令消息之后,该 UMTS的控制节点还可以接收用户设备通过 LTE ***的接入网节点发送的受完整性保护的安全模式命令完成消息, 该安全模式命令完成 消息是用户设备接收到安全模式命令消息之后, 根据用户设备的 UMTS的完整性密钥、 完整性序列号、 方向标识、 安全模式命令消息和该安全模式命令消息中携带的参数值生 成完整性信息鉴权码, 并在确定用户设备生成的完整性信息鉴权码与安全模式命令消息 中携带的完整性信息鉴权码一致, 且安全模式命令消息中携带的用户设备的安全能力与 该用户设备自身的安全能力一致后通过 LTE***的接入网节点发送给所述 UMTS的控 制节点的。
上述实施例中, UMTS 的控制节点可以通过 LTE***的接入网节点向用户设备发 送安全模式命令消息, 并接收用户设备通过 LTE ***的接入网节点发送的安全模式命 令完成消息, 从而可以实现当 LTE***和 UMTS共用一个 SRB时, UMTS的控制节点 与用户设备之间可以进行 SMC流程, 协商加密和完整性算法。
本领域普通技术人员可以理解: 实现上述方法实施例的全部或部分步骤可以通过程 序指令相关的硬件来完成, 前述的程序可以存储于一计算机可读取存储介质中, 该程序 在执行时, 执行包括上述方法实施例的步骤; 而前述的存储介质包括: ROM、 RAM,
磁碟或者光盘等各种可以存储程序代码的介质。
图 11 为本发明核心网节点设备实施例一的结构示意图, 本实施例中的核心网节点 设备可以应用在以基站为锚点的 UL Boosting场景中, 实现本发明图 1所示实施例的流 程。如图 11所示,该核心网节点设备可以包括:第一生成模块 1101和第一发送模块 1102; 其中, 第一生成模块 1101, 用于根据 LTE***的非接入层根密钥和 LTE***当前 的非接入层计数值, 或者根据 LTE ***的非接入层根密钥和该核心网节点设备生成的 随机数推衍生成 UMTS的完整性密钥和加密密钥;
第一发送模块 1102,用于将第一生成模块 1101生成的 UMTS的完整性密钥和加密 密钥发送给 UMTS的控制节点设备, 以使该 UMTS的控制节点设备通过上述 UMTS的 完整性密钥和加密密钥进行加密和完整性保护。
本实施例中的核心网节点设备可以为提供核心网功能的节点设备,例如: MME等, 但本实施例对核心网节点设备的具体形式不作限定。
上述核心网节点设备中, 第一生成模块 1101可以根据 LTE***的非接入层根密钥 和 LTE***当前的非接入层计数值, 或者根据 LTE***的非接入层根密钥和该核心网 节点设备生成的随机数推衍生成 UMTS 的完整性密钥和加密密钥, 从而可以实现在以 eNB为锚点的 UL Boosting场景中推衍生成 UMTS的完整性密钥和加密密钥,使得用户 设备可以通过 UMTS进行安全通信, 进而可以提高 UMTS上传输的数据的安全性。
图 12为本发明核心网节点设备实施例二的结构示意图, 与图 11所示的核心网节点 设备相比, 不同之处在于, 图 12所示的核心网节点设备还可以包括:
第一接收模块 1103, 用于接收 LTE***的接入网节点设备发送的 UMTS密钥推衍 指示消息,该 UMTS密钥推衍指示消息用于触发第一生成模块 1101生成 UMTS的完整 性密钥和加密密钥。
本实施例的一种实现方式中, 第一发送模块 1102还可以向用户设备发送 UMTS密 钥推衍指示消息, 以使该用户设备根据 LTE***当前的非接入层计数值和 LTE***的 非接入层根密钥, 或者根据 LTE***的非接入层根密钥和 UMTS密钥推衍指示消息中 携带的随机数推衍生成 UMTS的完整性密钥和加密密钥。
本实施例的另一种实现方式中, 第一发送模块 1102还可以通过非接入层消息将第 一生成模块 1101生成的 UMTS的完整性密钥和加密密钥发送给用户设备, 以使该用户 设备存储 UMTS的完整性密钥和加密密钥。
本实施例中,第一发送模块 1102可以将 UMTS的完整性密钥和加密密钥发送给 LTE
***的接入网节点设备,以使该接入网节点设备将上述 UMTS的完整性密钥和加密密钥 发送给 UMTS的控制节点设备。
进一步地, 本实施例中的第一接收模块 1103还可以当 UMTS密钥生命周期达到预 设的阈值时, 接收用户设备发送的 UMTS密钥更新请求消息或通知。
这时,第一生成模块 1101还可以在第一接收模块 1103接收到 UMTS密钥更新请求 消息之后, 根据 LTE***当前的非接入层计数值和该 LTE***的非接入层根密钥重新 推衍生成 UMTS的完整性密钥和加密密钥; 或者,
第一生成模块 1101还可以在第一接收模块 1103接收到 UMTS密钥更新请求消息之 后, 生成新的随机数, 并根据该新的随机数和 LTE***的非接入层根密钥重新推衍生 成 UMTS的完整性密钥和加密密钥; 或者,
第一生成模块 1101还可以在第一接收模块 1103接收到上述通知之后,通过重新进 行认证与密钥协商过程, 重新推衍生成 UMTS的完整性密钥和加密密钥。
上述核心网节点设备可以实现在以 eNB 为锚点的 UL Boosting 场景中推衍生成 UMTS 的完整性密钥和加密密钥, 使得用户设备可以通过 UMTS进行安全通信, 进而 可以提高 UMTS上传输的数据的安全性。
图 13为本发明接入网节点设备实施例一的结构示意图, 本实施例中的接入网节点 设备可以应用在以基站为锚点的 UL Boosting场景中, 实现本发明图 1所示实施例的流 程。 如图 13所示, 该接入网节点设备可以包括:
第二生成模块 1301, 用于根据 LTE***的接入层根密钥和 LTE***的分组数据聚 合协议计数值, 或者根据 LTE***的接入层根密钥和接入网节点生成的随机数推衍生 成 UMTS的完整性密钥和加密密钥;
第二发送模块 1302,用于将第二生成模块 1301生成的 UMTS的完整性密钥和加密 密钥发送给 UMTS的控制节点设备, 以使 UMTS的控制节点设备通过 UMTS的完整性 密钥和加密密钥进行加密和完整性保护。
本实施例中的接入网节点设备可以为具有接入功能的节点设备, 例如: 基站等, 其 中该基站可以包括 eNB, 该 eNB可以为普通的宏基站, 也可以是一些小型基站, 包括 HeNB/HNB或 RN等等。 但本实施例对接入网节点设备的具体形式不作限定。
上述接入网节点设备中, 第二生成模块 1301可以根据 LTE***的接入层根密钥和 LTE***的分组数据聚合协议计数值, 或者根据 LTE***的接入层根密钥和接入网节 点生成的随机数推衍生成 UMTS的完整性密钥和加密密钥; 从而可以实现在以 eNB为
锚点的 UL Boosting场景中推衍生成 UMTS的完整性密钥和加密密钥, 使得用户设备可 以通过 UMTS进行安全通信, 进而可以提高 UMTS上传输的数据的安全性。
图 14为本发明接入网节点设备实施例二的结构示意图, 与图 13所示的接入网节点 设备相比, 不同之处在于, 图 14所示接入网节点设备的一种实现方式中,
第二发送模块 1302还可以向用户设备发送 UMTS密钥推衍指示消息, 以使该用户 设备根据 LTE***的接入层根密钥和 LTE***的分组数据聚合协议计数值, 或者根据 LTE***的接入层根密钥和 UMTS密钥推衍指示消息中携带的接入网节点设备生成的 随机数推衍生成 UMTS的完整性密钥和加密密钥。
本实施例的另一种实现方式中, 第二发送模块 1302还可以通过受加密和完整性保 护的接入层消息将第二生成模块 1301生成的 UMTS的完整性密钥和加密密钥发送给用 户设备, 以使该用户设备存储 UMTS的完整性密钥和加密密钥。
进一步地, 本实施例中的接入网节点设备还可以包括:
第二接收模块 1303, 用于当 UMTS密钥生命周期达到预设的阈值时, 接收用户设 备发送的 UMTS密钥更新请求消息或通知。
这时, 第二生成模块 1301还可以当 LTE***的分组数据聚合协议计数值溢出或者 用户设备从空闲状态进入连接状态时, 根据 LTE ***的分组数据聚合协议计数值和该 接入网节点设备更新后的接入层根密钥, 或者根据接入网节点设备更新后的接入层根密 钥和该接入网节点设备新生成的随机数推衍生成 UMTS 的完整性密钥和加密密钥; 或 者,
第二生成模块 1301还可以在第二接收模块 1303接收到 UMTS密钥更新请求消息之 后,生成新的随机数,并根据该新的随机数和接入层根密钥重新推衍生成 UMTS的完整 性密钥和加密密钥; 或者,
第二生成模块 1301还可以在第二接收模块 1303接收到上述通知之后,通过重新进 行认证与密钥协商过程, 重新推衍生成 UMTS的完整性密钥和加密密钥。
上述接入网节点设备可以实现在以 eNB 为锚点的 UL Boosting 场景中推衍生成
UMTS 的完整性密钥和加密密钥, 使得用户设备可以通过 UMTS进行安全通信, 进而 可以提高 UMTS上传输的数据的安全性。
图 15为本发明接入网节点设备实施例三的结构示意图, 本实施例中的接入网节点 设备可以应用在以基站为锚点的 UL Boosting场景中, 实现本发明图 7所示实施例的流 程, 如图 15所示, 该接入网节点设备可以包括:
第三发送模块 1501,用于向 UMTS的控制节点设备发送 UMTS密钥推衍指示消息, 该 UMTS密钥推衍指示消息携带接入网节点设备生成的随机数, 以使 UMTS的控制节 点设备根据因特网协议安全密钥和上述随机数推衍生成 UMTS 的完整性密钥和加密密 钥;
第三生成模块 1502,用于根据该因特网协议安全密钥和上述随机数推衍生成 UMTS 的完整性密钥和加密密钥。
本实施例中的接入网节点设备可以为具有接入功能的节点设备, 例如: 基站等, 其 中该基站可以包括 eNB, 该 eNB可以为普通的宏基站, 也可以是一些小型基站, 包括 HeNB/HNB或 RN等等。 但本实施例对接入网节点设备的具体形式不作限定。
上述接入网节点设备中, 第三生成模块 1502可以根据因特网协议安全密钥和该接 入网节点设备生成的随机数推衍生成 UMTS的完整性密钥和加密密钥,从而可以实现在 以 eNB为锚点的 UL Boosting场景中推衍生成 UMTS的完整性密钥和加密密钥,使得用 户设备可以通过 UMTS进行安全通信, 进而可以提高 UMTS上传输的数据的安全性。
图 16为本发明接入网节点设备实施例四的结构示意图, 与图 15所示的接入网节点 设备相比, 不同之处在于, 图 16所示的接入网节点设备中,
第三发送模块 1501还可以通过受加密和完整性保护的接入层消息将 UMTS的完整 性密钥和加密密钥发送给用户设备,以使该用户设备存储上述 UMTS的完整性密钥和加 密密钥。
进一步地, 本实施例中的接入网节点设备还可以包括:
认证模块 1503, 用于与上述 UMTS的控制节点设备进行基于证书的认证过程, 以 生成上述因特网协议安全密钥和随机数。
第三接收模块 1504, 用于当 UMTS密钥生命周期达到预设的阈值时, 接收用户设 备发送的 UMTS密钥更新请求消息;
这时,第三生成模块 1502还可以在第三接收模块 1504接收到上述 UMTS密钥更新 请求消息之后, 生成新的随机数, 根据该新的随机数和因特网协议安全密钥重新推衍生 成 UMTS的完整性密钥和加密密钥。
上述接入网节点设备可以实现在以 eNB 为锚点的 UL Boosting 场景中推衍生成 UMTS 的完整性密钥和加密密钥, 使得用户设备可以通过 UMTS进行安全通信, 进而 可以提高 UMTS上传输的数据的安全性。
图 17为本发明用户设备实施例一的结构示意图, 本实施例中的用户设备可以应用
在以基站为锚点的 UL Boosting场景中, 实现本发明图 9所示实施例的流程。如图 17所 示, 该用户设备可以包括:
第四接收模块 1701, 用于接收 UMTS密钥推衍指示消息;
第四生成模块 1702, 用于根据 LTE***的计数值和 LTE***的根密钥, 或者根据 LTE***的根密钥和 UMTS密钥推衍指示消息携带的随机数推衍生成 UMTS的完整性 密钥和加密密钥。
本实施例的一种实现方式中, 第四接收模块 1701可以在 LTE***的根密钥为 LTE ***的非接入层根密钥, LTE ***的计数值为 LTE ***当前的非接入层计数值, 该 UMTS密钥推衍指示消息携带的随机数为核心网节点设备生成的随机数时,接收核心网 节点设备发送的 UMTS密钥推衍指示消息;
这时,第四生成模块 1702可以根据 LTE***当前的非接入层计数值和该 LTE*** 的非接入层根密钥, 或者根据 LTE ***的非接入层根密钥和核心网节点设备生成的随 机数推衍生成 UMTS的完整性密钥和加密密钥。
本实施例的另一种实现方式中, 第四接收模块 1701可以在根密钥为 LTE***的接 入层根密钥, LTE***的计数值为 LTE***的分组数据聚合协议计数值, UMTS密钥 推衍指示消息携带的随机数为 LTE***的接入网节点生成的随机数时, 接收 LTE*** 的接入网节点设备发送的 UMTS密钥推衍指示消息;
这时,第四生成模块 1702可以根据 LTE***的分组数据聚合协议计数值和 LTE系 统的接入层根密钥, 或者根据 LTE***的接入层根密钥和 LTE***的接入网节点设备 生成的随机数推衍生成 UMTS的完整性密钥和加密密钥。
上述用户设备中,第四生成模块 1702可以根据 LTE***的计数值和该 LTE***的 根密钥, 或者根据 LTE***的根密钥和 UMTS密钥推衍指示消息携带的随机数推衍生 成 UMTS的完整性密钥和加密密钥,从而可以实现在以 eNB为锚点的 UL Boosting场景 中推衍生成 UMTS的完整性密钥和加密密钥, 使得 UE可以通过 UMTS进行安全通信, 进而可以提高 UMTS上传输的数据的安全性。
图 18为本发明控制节点设备实施例一的结构示意图, 本实施例中的控制节点设备 可以应用在以基站为锚点的 UL Boosting场景中,实现本发明图 3或图 10所示实施例的 流程。 如图 18所示, 该控制节点设备可以包括:
第五接收模块 1801, 用于接收 LTE***的接入网节点设备发送的 UMTS的完整性 密钥和加密密钥, 以及用户设备的安全能力;
第四发送模块 1802, 用于通过 LTE***的接入网节点设备向用户设备发送受完整 性保护的安全模式命令消息, 该安全模式命令消息携带控制节点设备根据用户设备的安 全能力选择的完整性算法和加密算法、用户设备的安全能力和控制节点设备生成的参数 值, 以及控制节点设备根据 UMTS的完整性密钥、该控制节点设备生成的参数值、完整 性序列号、 安全模式命令消息和方向标识生成的完整性信息鉴权码。
本实施例中,第五接收模块 1801还可以在第四发送模块 1802向用户设备发送安全 模式命令消息之后, 接收用户设备通过 LTE ***的接入网节点设备发送的受完整性保 护的安全模式命令完成消息, 该安全模式命令完成消息是用户设备接收到安全模式命令 消息之后, 根据用户设备的 UMTS的完整性密钥、 完整性序列号、 方向标识、 安全模式 命令消息和该安全模式命令消息中携带的参数值生成完整性信息鉴权码, 并在确定用户 设备生成的完整性信息鉴权码与安全模式命令消息中携带的完整性信息鉴权码一致, 且 安全模式命令消息中携带的用户设备的安全能力与该用户设备自身的安全能力一致后 通过 LTE***的接入网节点设备发送给控制节点设备的。
本实施例中的控制节点设备可以作为 UMTS的控制节点设备,该控制节点设备可以 为具有控制功能的实体设备, 例如: RNC等。
上述控制节点设备中, 第四发送模块 1802可以通过 LTE***的接入网节点向用户 设备发送安全模式命令消息, 第五接收模块 1801可以接收用户设备通过 LTE***的接 入网节点发送的安全模式命令完成消息, 从而可以实现当 LTE***和 UMTS共用一个 SRB时, 控制节点设备与用户设备之间可以进行 SMC流程, 协商加密和完整性算法。
本领域技术人员可以理解附图只是一个优选实施例的示意图, 附图中的模块或流程 并不一定是实施本发明所必须的。
本领域技术人员可以理解实施例中的装置中的模块可以按照实施例描述进行分布 于实施例的装置中, 也可以进行相应变化位于不同于本实施例的一个或多个装置中。 上 述实施例的模块可以合并为一个模块, 也可以进一步拆分成多个子模块。 最后应说明的是: 以上实施例仅用以说明本发明的技术方案, 而非对其限制; 尽管 参照前述实施例对本发明进行了详细的说明, 本领域的普通技术人员应当理解: 其依然 可以对前述各实施例所记载的技术方案进行修改, 或者对其中部分技术特征进行等同替 换; 而这些修改或者替换, 并不使相应技术方案的本质脱离本发明各实施例技术方案的 精神和范围。
Claims
1、 一种密钥生成方法, 其特征在于, 应用在以基站为锚点的通用移动通信*** (UMTS) 与长期演进 (LTE) ***资源聚合的场景中, 包括:
根据所述 LTE***的根密钥和所述 LTE***的计数值,或者根据随机数和所述 LTE ***的根密钥推衍生成 UMTS的完整性密钥和加密密钥;
将所述 UMTS的完整性密钥和加密密钥发送给 UMTS的控制节点,以使所述 UMTS 的控制节点通过所述 UMTS的完整性密钥和加密密钥进行加密和完整性保护。
2、根据权利要求 1所述的方法,其特征在于,所述 LTE***的根密钥包括所述 LTE ***的非接入层根密钥, 所述 LTE***的计数值包括所述 LTE***当前的非接入层计 数值;
所述根据所述 LTE***的根密钥和所述 LTE***的计数值, 或者根据随机数和所 述 LTE***的根密钥推衍生成 UMTS的完整性密钥和加密密钥之前, 还包括:
核心网节点接收所述 LTE***的接入网节点发送的 UMTS密钥推衍指示消息; 所述根据所述 LTE***的根密钥和所述 LTE***的计数值, 或者根据随机数和所 述 LTE***的根密钥推衍生成 UMTS的完整性密钥和加密密钥包括:
所述核心网节点根据所述 LTE***当前的非接入层计数值和所述 LTE***的非接 入层根密钥, 或者根据所述 LTE***的非接入层根密钥和所述核心网节点生成的随机 数推衍生成 UMTS的完整性密钥和加密密钥。
3、 根据权利要求 2所述的方法, 其特征在于, 所述核心网节点接收所述 LTE*** 的接入网节点发送的 UMTS密钥推衍指示消息之后, 还包括:
所述核心网节点向用户设备发送 UMTS密钥推衍指示消息,以使所述用户设备根据 所述 LTE***当前的非接入层计数值和所述 LTE***的非接入层根密钥, 或者根据所 述 LTE***的非接入层根密钥和所述 UMTS密钥推衍指示消息中携带的随机数推衍生 成 UMTS的完整性密钥和加密密钥。
4、 根据权利要求 2所述的方法, 其特征在于, 所述核心网节点根据所述 LTE*** 当前的非接入层计数值和所述 LTE***的非接入层根密钥, 或者根据所述 LTE***的 非接入层根密钥和所述核心网节点生成的随机数推衍生成 UMTS 的完整性密钥和加密 密钥之后, 还包括:
所述核心网节点通过非接入层消息将所述 UMTS 的完整性密钥和加密密钥发送给 用户设备, 以使所述用户设备存储所述 UMTS的完整性密钥和加密密钥。
5、根据权利要求 2、 3或 4所述的方法, 其特征在于, 所述将所述 UMTS的完整性 密钥和加密密钥发送给 UMTS的控制节点包括:
所述核心网节点将所述 UMTS的完整性密钥和加密密钥发送给所述 LTE***的接 入网节点, 以使所述 LTE***的接入网节点将所述 UMTS的完整性密钥和加密密钥发 送给所述 UMTS的控制节点。
6、 根据权利要求 5所述的方法, 其特征在于, 还包括:
当 UMTS密钥生命周期达到预设的阈值时,所述核心网节点接收到用户设备发送的 UMTS密钥更新请求消息之后, 根据所述 LTE***当前的非接入层计数值和所述 LTE ***的非接入层根密钥重新推衍生成 UMTS的完整性密钥和加密密钥; 或者,
当 UMTS密钥生命周期达到预设的阈值时,所述核心网节点接收到用户设备发送的
UMTS 密钥更新请求消息之后, 生成新的随机数, 并根据所述新的随机数和所述 LTE ***的非接入层根密钥重新推衍生成 UMTS的完整性密钥和加密密钥; 或者,
当 UMTS密钥生命周期达到预设的阈值时,接收到用户设备的通知之后,通过重新 进行认证与密钥协商过程, 重新推衍生成 UMTS的完整性密钥和加密密钥。
7、根据权利要求 1所述的方法,其特征在于,所述 LTE***的根密钥包括所述 LTE ***的接入层根密钥, 所述 LTE***的计数值包括所述 LTE***的分组数据聚合协议 计数值;
所述根据所述 LTE***的根密钥和所述 LTE***的计数值, 或者根据随机数和所 述 LTE***的根密钥推衍生成 UMTS的完整性密钥和加密密钥包括:
所述 LTE***的接入网节点根据所述 LTE***的接入层根密钥和所述 LTE***的 分组数据聚合协议计数值, 或者根据所述 LTE ***的接入层根密钥和所述接入网节点 生成的随机数推衍生成 UMTS的完整性密钥和加密密钥。
8、 根据权利要求 7所述的方法, 其特征在于, 所述根据所述 LTE***的根密钥和 所述 LTE***的计数值, 或者根据随机数和所述 LTE***的根密钥推衍生成 UMTS的 完整性密钥和加密密钥之前, 还包括:
所述 LTE***的接入网节点向用户设备发送 UMTS密钥推衍指示消息, 以使所述 用户设备根据所述 LTE***的接入层根密钥和所述 LTE***的分组数据聚合协议计数 值, 或者根据所述 LTE***的接入层根密钥和所述 UMTS密钥推衍指示消息中携带的 所述接入网节点生成的随机数推衍生成 UMTS的完整性密钥和加密密钥。
9、 根据权利要求 7所述的方法, 其特征在于, 所述 LTE***的接入网节点根据所 述 LTE***的接入层根密钥和所述 LTE***的分组数据聚合协议计数值, 或者根据所 述 LTE***的接入层根密钥和所述接入网节点生成的随机数推衍生成 UMTS的完整性 密钥和加密密钥之后, 还包括:
所述 LTE***的接入网节点通过受加密和完整性保护的接入层消息将所述 UMTS 的完整性密钥和加密密钥发送给用户设备,以使所述用户设备存储所述 UMTS的完整性 密钥和加密密钥。
10、 根据权利要求 7、 8或 9所述的方法, 其特征在于, 所述将所述 UMTS的完整 性密钥和加密密钥发送给 UMTS的控制节点包括:
所述 LTE ***的接入网节点将所述 UMTS 的完整性密钥和加密密钥发送给所述 UMTS的控制节点。
11、 根据权利要求 10所述的方法, 其特征在于, 还包括:
当所述 LTE***的分组数据聚合协议计数值溢出或者用户设备从空闲状态进入连 接状态时, 所述 LTE***的接入网节点根据所述 LTE***的分组数据聚合协议计数值 和所述接入网节点更新后的接入层根密钥, 或者根据所述接入网节点更新后的接入层根 密钥和所述接入网节点新生成的随机数推衍生成 UMTS 的完整性密钥和加密密钥; 或 者,
当 UMTS密钥生命周期达到预设的阈值时, 所述 LTE***的接入网节点接收到用 户设备发送的 UMTS密钥更新请求消息之后, 生成新的随机数,根据所述新的随机数和 所述接入层根密钥重新推衍生成 UMTS的完整性密钥和加密密钥; 或者,
当 UMTS密钥生命周期达到预设的阈值时,接收到用户设备的通知之后,通过重新 进行认证与密钥协商过程, 重新推衍生成 UMTS的完整性密钥和加密密钥。
12、 根据权利要求 1所述的方法, 其特征在于, 还包括:
所述 UMTS的控制节点接收所述 UMTS的完整性密钥和加密密钥的过程中, 还接 收用户设备的安全能力;
所述 UMTS的控制节点通过所述 LTE***的接入网节点向所述用户设备发送受完 整性保护的安全模式命令消息,所述安全模式命令消息携带所述控制节点根据所述用户 设备的安全能力选择的完整性算法和加密算法、所述用户设备的安全能力和所述控制节 点生成的参数值, 以及所述控制节点根据所述 UMTS的完整性密钥、所述控制节点生成 的参数值、完整性序列号、所述安全模式命令消息和方向标识生成的完整性信息鉴权码; 所述 UMTS的控制节点接收所述用户设备通过所述 LTE***的接入网节点发送的 受完整性保护的安全模式命令完成消息,所述安全模式命令完成消息是所述用户设备接 收到所述安全模式命令消息之后,根据所述用户设备的 UMTS的完整性密钥、完整性序 列号、 方向标识、 所述安全模式命令消息和所述安全模式命令消息中携带的参数值生成 完整性信息鉴权码, 并在确定所述用户设备生成的完整性信息鉴权码与所述安全模式命 令消息中携带的完整性信息鉴权码一致, 且所述安全模式命令消息中携带的所述用户设 备的安全能力与所述用户设备自身的安全能力一致后通过所述 LTE***的接入网节点 发送给所述 UMTS的控制节点的。
13、 一种密钥生成方法, 其特征在于, 应用在以基站为锚点的通用移动通信*** (UMTS) 与长期演进 (LTE) ***资源聚合的场景中, 包括:
LTE***的接入网节点向 UMTS的控制节点发送 UMTS密钥推衍指示消息, 所述
UMTS密钥推衍指示消息携带所述接入网节点生成的随机数, 以使所述 UMTS 的控制 节点根据因特网协议安全密钥和所述随机数推衍生成 UMTS的完整性密钥和加密密钥; 所述 LTE***的接入网节点根据所述因特网协议安全密钥和所述随机数推衍生成 UMTS的完整性密钥和加密密钥。
14、 根据权利要求 13所述的方法, 其特征在于, 所述 LTE***的接入网节点根据 所述因特网协议安全密钥和所述随机数推衍生成 UMTS的完整性密钥和加密密钥之后, 还包括:
所述 LTE***的接入网节点通过受加密和完整性保护的接入层消息将所述 UMTS 的完整性密钥和加密密钥发送给用户设备,以使所述用户设备存储所述 UMTS的完整性 密钥和加密密钥。
15、 根据权利要求 13或 14所述的方法, 其特征在于, 所述 LTE***的接入网节 点向 UMTS的控制节点发送 UMTS密钥推衍指示消息之前, 还包括:
所述 LTE***的接入网节点与所述 UMTS的控制节点进行基于证书的认证过程, 以生成所述因特网协议安全密钥和所述随机数。
16、 根据权利要求 15所述的方法, 其特征在于, 还包括:
当 UMTS密钥生命周期达到预设的阈值时, 所述 LTE***的接入网节点接收到用 户设备发送的 UMTS密钥更新请求消息之后, 生成新的随机数,根据所述新的随机数和 所述因特网协议安全密钥重新推衍生成 UMTS的完整性密钥和加密密钥。
17、 一种密钥生成方法, 其特征在于, 应用在以基站为锚点的通用移动通信*** (UMTS) 与长期演进 (LTE) ***资源聚合的场景中, 包括: 用户设备接收 UMTS密钥推衍指示消息;
所述用户设备根据所述 LTE***的计数值和所述 LTE***的根密钥, 或者根据所 述 LTE***的根密钥和所述 UMTS密钥推衍指示消息携带的随机数推衍生成 UMTS的 完整性密钥和加密密钥。
18、 根据权利要求 17所述的方法, 其特征在于, 所述 LTE***的根密钥包括所述
LTE***的非接入层根密钥, 所述 LTE***的计数值包括所述 LTE***当前的非接入 层计数值, 所述 UMTS密钥推衍指示消息携带的随机数包括核心网节点生成的随机数; 所述用户设备接收 UMTS密钥推衍指示消息包括:
所述用户设备接收所述核心网节点发送的所述 UMTS密钥推衍指示消息; 所述用户设备根据 LTE***的计数值和所述 LTE***的根密钥,或者根据所述 LTE ***的根密钥和所述 UMTS密钥推衍指示消息携带的随机数推衍生成 UMTS的完整性 密钥和加密密钥包括:
所述用户设备根据所述 LTE***当前的非接入层计数值和所述 LTE***的非接入 层根密钥, 或者根据所述 LTE***的非接入层根密钥和所述核心网节点生成的随机数 推衍生成 UMTS的完整性密钥和加密密钥。
19、 根据权利要求 17所述的方法, 其特征在于, 所述 LTE***的根密钥包括所述 LTE***的接入层根密钥, 所述 LTE***的计数值包括所述 LTE***的分组数据聚合 协议计数值, 所述 UMTS密钥推衍指示消息携带的随机数包括所述 LTE***的接入网 节点生成的随机数;
所述用户设备接收 UMTS密钥推衍指示消息包括:
所述用户设备接收所述 LTE***的接入网节点发送的所述 UMTS密钥推衍指示消 息, 所述 UMTS密钥推衍指示消息携带所述 LTE***的接入网节点生成的随机数; 所述用户设备根据 LTE***的计数值和所述 LTE***的根密钥,或者根据所述 LTE ***的根密钥和所述 UMTS密钥推衍指示消息携带的随机数推衍生成 UMTS的完整性 密钥和加密密钥包括:
所述用户设备根据所述 LTE***的分组数据聚合协议计数值和所述 LTE***的接 入层根密钥, 或者根据所述 LTE***的接入层根密钥和所述 LTE***的接入网节点生 成的随机数推衍生成 UMTS的完整性密钥和加密密钥。
20、 一种消息发送方法, 其特征在于, 应用在以基站为锚点的通用移动通信*** (UMTS) 与长期演进 (LTE) ***资源聚合的场景中, 包括: UMTS的控制节点接收 LTE***的接入网节点发送的所述 UMTS的完整性密钥和 加密密钥, 以及用户设备的安全能力;
所述 UMTS的控制节点通过所述 LTE***的接入网节点向所述用户设备发送受完 整性保护的安全模式命令消息,所述安全模式命令消息携带所述控制节点根据所述用户 设备的安全能力选择的完整性算法和加密算法、所述用户设备的安全能力和所述控制节 点生成的参数值, 以及所述控制节点根据所述 UMTS的完整性密钥、所述控制节点生成 的参数值、完整性序列号、所述安全模式命令消息和方向标识生成的完整性信息鉴权码。
21、 根据权利要求 20所述的方法, 其特征在于, 所述 UMTS的控制节点通过所述 LTE***的接入网节点向所述用户设备发送受完整性保护的安全模式命令消息之后,还 包括:
所述 UMTS的控制节点接收所述用户设备通过所述 LTE***的接入网节点发送的 受完整性保护的安全模式命令完成消息,所述安全模式命令完成消息是所述用户设备接 收到所述安全模式命令消息之后,根据所述用户设备的 UMTS的完整性密钥、完整性序 列号、 方向标识、 所述安全模式命令消息和所述安全模式命令消息中携带的参数值生成 完整性信息鉴权码, 并在确定所述用户设备生成的完整性信息鉴权码与所述安全模式命 令消息中携带的完整性信息鉴权码一致, 且所述安全模式命令消息中携带的所述用户设 备的安全能力与所述用户设备自身的安全能力一致后通过所述 LTE***的接入网节点 发送给所述 UMTS的控制节点的。
22、 一种核心网节点设备, 其特征在于, 应用在以基站为锚点的通用移动通信*** ( UMTS ) 与长期演进 (LTE) ***资源聚合的场景中, 包括:
第一生成模块, 用于根据所述 LTE***的非接入层根密钥和所述 LTE***当前的 非接入层计数值, 或者根据所述 LTE ***的非接入层根密钥和所述核心网节点设备生 成的随机数推衍生成 UMTS的完整性密钥和加密密钥;
第一发送模块,用于将所述第一生成模块生成的 UMTS的完整性密钥和加密密钥发 送给 UMTS的控制节点设备, 以使所述 UMTS的控制节点设备通过所述 UMTS的完整 性密钥和加密密钥进行加密和完整性保护。
23、 根据权利要求 22所述的设备, 其特征在于, 还包括:
第一接收模块, 用于接收所述 LTE***的接入网节点设备发送的 UMTS密钥推衍 指示消息, 所述 UMTS密钥推衍指示消息用于触发所述第一生成模块生成所述 UMTS 的完整性密钥和加密密钥。
24、 根据权利要求 23所述的设备, 其特征在于,
所述第一发送模块,还用于向用户设备发送 UMTS密钥推衍指示消息, 以使所述用 户设备根据所述 LTE***当前的非接入层计数值和所述 LTE***的非接入层根密钥, 或者根据所述 LTE***的非接入层根密钥和所述 UMTS密钥推衍指示消息中携带的随 机数推衍生成 UMTS的完整性密钥和加密密钥。
25、 根据权利要求 23所述的设备, 其特征在于,
所述第一发送模块, 还用于通过非接入层消息将所述第一生成模块生成的 UMTS 的完整性密钥和加密密钥发送给用户设备,以使所述用户设备存储所述 UMTS的完整性 密钥和加密密钥。
26、 根据权利要求 22-25任意一项所述的设备, 其特征在于, 所述第一发送模块具 体用于将所述 UMTS的完整性密钥和加密密钥发送给所述 LTE***的接入网节点设备, 以使所述接入网节点设备将所述 UMTS的完整性密钥和加密密钥发送给 UMTS的控制 节点设备。
27、 根据权利要求 23所述的设备, 其特征在于,
所述第一接收模块,还用于当 UMTS密钥生命周期达到预设的阈值时,接收用户设 备发送的 UMTS密钥更新请求消息或通知;
所述第一生成模块,还用于在所述第一接收模块接收到所述 UMTS密钥更新请求消 息之后, 根据所述 LTE***当前的非接入层计数值和所述 LTE***的非接入层根密钥 重新推衍生成 UMTS的完整性密钥和加密密钥; 或者,
所述第一生成模块,还用于在所述第一接收模块接收到所述 UMTS密钥更新请求消 息之后, 生成新的随机数, 并根据所述新的随机数和所述 LTE***的非接入层根密钥 重新推衍生成 UMTS的完整性密钥和加密密钥; 或者,
所述第一生成模块, 还用于在所述第一接收模块接收到所述通知之后, 通过重新进 行认证与密钥协商过程, 重新推衍生成 UMTS的完整性密钥和加密密钥。
28、 一种接入网节点设备, 其特征在于, 应用在以基站为锚点的通用移动通信***
(UMTS) 与长期演进 (LTE) ***资源聚合的场景中, 包括:
第二生成模块, 用于根据所述 LTE***的接入层根密钥和所述 LTE***的分组数 据聚合协议计数值, 或者根据所述 LTE ***的接入层根密钥和所述接入网节点生成的 随机数推衍生成 UMTS的完整性密钥和加密密钥;
第二发送模块,用于将所述第二生成模块生成的 UMTS的完整性密钥和加密密钥发 送给 UMTS的控制节点设备, 以使所述 UMTS的控制节点设备通过所述 UMTS的完整 性密钥和加密密钥进行加密和完整性保护。
29、 根据权利要求 28所述的设备, 其特征在于,
所述第二发送模块,还用于向用户设备发送 UMTS密钥推衍指示消息, 以使所述用 户设备根据所述 LTE***的接入层根密钥和所述 LTE***的分组数据聚合协议计数值, 或者根据所述 LTE***的接入层根密钥和所述 UMTS密钥推衍指示消息中携带的所述 接入网节点设备生成的随机数推衍生成 UMTS的完整性密钥和加密密钥。
30、 根据权利要求 28所述的设备, 其特征在于,
所述第二发送模块,还用于通过受加密和完整性保护的接入层消息将所述第二生成 模块生成的 UMTS的完整性密钥和加密密钥发送给用户设备,以使所述用户设备存储所 述 UMTS的完整性密钥和加密密钥。
31、 根据权利要求 28-30任意一项所述的设备, 其特征在于, 还包括: 第二接收模 块;
所述第二接收模块,用于当 UMTS密钥生命周期达到预设的阈值时,接收用户设备 发送的 UMTS密钥更新请求消息或通知;
所述第二生成模块, 还用于当所述 LTE ***的分组数据聚合协议计数值溢出或者 用户设备从空闲状态进入连接状态时, 根据所述 LTE***的分组数据聚合协议计数值 和所述接入网节点设备更新后的接入层根密钥, 或者根据所述接入网节点设备更新后的 接入层根密钥和所述接入网节点设备新生成的随机数推衍生成 UMTS 的完整性密钥和 加密密钥; 或者,
所述第二生成模块,还用于在所述第二接收模块接收到所述 UMTS密钥更新请求消 息之后, 生成新的随机数, 根据所述新的随机数和所述接入层根密钥重新推衍生成 UMTS的完整性密钥和加密密钥; 或者,
所述第二生成模块, 还用于在所述第二接收模块接收到所述通知之后, 通过重新进 行认证与密钥协商过程, 重新推衍生成 UMTS的完整性密钥和加密密钥。
32、 一种接入网节点设备, 其特征在于, 应用在以基站为锚点的通用移动通信*** (UMTS) 与长期演进 (LTE) ***资源聚合的场景中, 包括:
第三发送模块, 用于向 UMTS的控制节点设备发送 UMTS密钥推衍指示消息, 所 述 UMTS密钥推衍指示消息携带所述接入网节点设备生成的随机数, 以使所述 UMTS 的控制节点设备根据因特网协议安全密钥和所述随机数推衍生成 UMTS 的完整性密钥 和加密密钥;
第三生成模块, 用于根据所述因特网协议安全密钥和所述随机数推衍生成 UMTS 的完整性密钥和加密密钥。
33、 根据权利要求 32所述的设备, 其特征在于,
所述第三发送模块,还用于通过受加密和完整性保护的接入层消息将所述第三生成 模块生成的 UMTS的完整性密钥和加密密钥发送给用户设备,以使所述用户设备存储所 述 UMTS的完整性密钥和加密密钥; 所述接入层消息。
34、 根据权利要求 32或 33所述的设备, 其特征在于, 还包括:
认证模块,用于与所述 UMTS的控制节点设备进行基于证书的认证过程, 以生成所 述因特网协议安全密钥和所述随机数。
35、 根据权利要求 34所述的设备, 其特征在于, 还包括: 第三接收模块; 所述第三接收模块,用于当 UMTS密钥生命周期达到预设的阈值时,接收用户设备 发送的 UMTS密钥更新请求消息;
所述第三生成模块,还用于在所述第三接收模块接收到所述 UMTS密钥更新请求消 息之后, 生成新的随机数, 根据所述新的随机数和所述因特网协议安全密钥重新推衍生 成 UMTS的完整性密钥和加密密钥。
36、一种用户设备,其特征在于,应用在以基站为锚点的通用移动通信***(UMTS) 与长期演进 (LTE) ***资源聚合的场景中, 包括:
第四接收模块, 用于接收 UMTS密钥推衍指示消息;
第四生成模块, 用于根据所述 LTE***的计数值和所述 LTE***的根密钥, 或者 根据所述 LTE ***的根密钥和所述 UMTS 密钥推衍指示消息携带的随机数推衍生成 UMTS的完整性密钥和加密密钥。
37、 根据权利要求 36所述的用户设备, 其特征在于, 所述第四接收模块具体用于 在所述 LTE***的根密钥为所述 LTE***的非接入层根密钥,所述 LTE***的计数值 为所述 LTE***当前的非接入层计数值, 所述 UMTS密钥推衍指示消息携带的随机数 为核心网节点设备生成的随机数时,接收所述核心网节点设备发送的所述 UMTS密钥推 衍指示消息;
所述第四生成模块具体用于根据所述 LTE***当前的非接入层计数值和所述 LTE ***的非接入层根密钥, 或者根据所述 LTE ***的非接入层根密钥和所述核心网节点 设备生成的随机数推衍生成 UMTS的完整性密钥和加密密钥。
38、 根据权利要求 36所述的用户设备, 其特征在于, 所述第四接收模块具体用于 在所述根密钥为所述 LTE***的接入层根密钥,所述 LTE***的计数值为所述 LTE系 统的分组数据聚合协议计数值,所述 UMTS密钥推衍指示消息携带的随机数为所述 LTE ***的接入网节点生成的随机数时, 接收所述 LTE***的接入网节点设备发送的所述 UMTS密钥推衍指示消息;
所述第四生成模块具体用于根据所述 LTE ***的分组数据聚合协议计数值和所述 LTE***的接入层根密钥, 或者根据所述 LTE***的接入层根密钥和所述 LTE***的 接入网节点设备生成的随机数推衍生成 UMTS的完整性密钥和加密密钥。
39、 一种控制节点设备, 其特征在于, 应用在以基站为锚点的通用移动通信*** (UMTS) 与长期演进 (LTE) ***资源聚合的场景中, 包括:
第五接收模块, 用于接收 LTE***的接入网节点设备发送的所述 UMTS的完整性 密钥和加密密钥, 以及用户设备的安全能力;
第四发送模块, 用于通过所述 LTE ***的接入网节点设备向所述用户设备发送受 完整性保护的安全模式命令消息,所述安全模式命令消息携带所述控制节点设备根据所 述用户设备的安全能力选择的完整性算法和加密算法、所述用户设备的安全能力和所述 控制节点设备生成的参数值, 以及所述控制节点设备根据所述 UMTS的完整性密钥、所 述控制节点设备生成的参数值、 完整性序列号、 所述安全模式命令消息和方向标识生成 的完整性信息鉴权码。
40、 根据权利要求 39所述的设备, 其特征在于,
所述第五接收模块,还用于在所述第四发送模块向所述用户设备发送所述安全模式 命令消息之后, 接收所述用户设备通过所述 LTE***的接入网节点设备发送的受完整性 保护的安全模式命令完成消息,所述安全模式命令完成消息是所述用户设备接收到所述 安全模式命令消息之后, 根据所述用户设备的 UMTS的完整性密钥、 完整性序列号、 方 向标识、所述安全模式命令消息和所述安全模式命令消息中携带的参数值生成完整性信 息鉴权码, 并在确定所述用户设备生成的完整性信息鉴权码与所述安全模式命令消息中 携带的完整性信息鉴权码一致, 且所述安全模式命令消息中携带的所述用户设备的安全 能力与所述用户设备自身的安全能力一致后通过所述 LTE***的接入网节点设备发送 给所述控制节点设备的。
Priority Applications (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
EP12738754.6A EP2663107B1 (en) | 2011-01-28 | 2012-01-29 | Key generating method and apparatus |
US13/952,985 US9049594B2 (en) | 2011-01-28 | 2013-07-29 | Method and device for key generation |
Applications Claiming Priority (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
CN201110031924.4 | 2011-01-28 | ||
CN201110031924.4A CN102625300B (zh) | 2011-01-28 | 2011-01-28 | 密钥生成方法和设备 |
Related Child Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US13/952,985 Continuation US9049594B2 (en) | 2011-01-28 | 2013-07-29 | Method and device for key generation |
Publications (1)
Publication Number | Publication Date |
---|---|
WO2012100749A1 true WO2012100749A1 (zh) | 2012-08-02 |
Family
ID=46564946
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
PCT/CN2012/070743 WO2012100749A1 (zh) | 2011-01-28 | 2012-01-29 | 密钥生成方法和设备 |
Country Status (4)
Country | Link |
---|---|
US (1) | US9049594B2 (zh) |
EP (1) | EP2663107B1 (zh) |
CN (1) | CN102625300B (zh) |
WO (1) | WO2012100749A1 (zh) |
Cited By (1)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
EP3439345A1 (en) * | 2013-03-05 | 2019-02-06 | Huawei Technologies Co., Ltd. | Key exchange method and apparatus |
Families Citing this family (50)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US9532222B2 (en) | 2010-03-03 | 2016-12-27 | Duo Security, Inc. | System and method of notifying mobile devices to complete transactions after additional agent verification |
US9544143B2 (en) | 2010-03-03 | 2017-01-10 | Duo Security, Inc. | System and method of notifying mobile devices to complete transactions |
US9467463B2 (en) | 2011-09-02 | 2016-10-11 | Duo Security, Inc. | System and method for assessing vulnerability of a mobile device |
CN102740289B (zh) * | 2012-06-15 | 2015-12-02 | 电信科学技术研究院 | 一种密钥更新方法、装置及*** |
CN103929740B (zh) * | 2013-01-15 | 2017-05-10 | 中兴通讯股份有限公司 | 数据安全传输方法及lte接入网*** |
US9607156B2 (en) | 2013-02-22 | 2017-03-28 | Duo Security, Inc. | System and method for patching a device through exploitation |
US8893230B2 (en) | 2013-02-22 | 2014-11-18 | Duo Security, Inc. | System and method for proxying federated authentication protocols |
US9338156B2 (en) | 2013-02-22 | 2016-05-10 | Duo Security, Inc. | System and method for integrating two-factor authentication in a device |
CN104349315B (zh) * | 2013-07-31 | 2018-01-05 | 普天信息技术有限公司 | 一种保障基站与用户设备信息安全的方法和*** |
US9092302B2 (en) | 2013-09-10 | 2015-07-28 | Duo Security, Inc. | System and method for determining component version compatibility across a device ecosystem |
US9608814B2 (en) | 2013-09-10 | 2017-03-28 | Duo Security, Inc. | System and method for centralized key distribution |
US9774448B2 (en) | 2013-10-30 | 2017-09-26 | Duo Security, Inc. | System and methods for opportunistic cryptographic key management on an electronic device |
ES2833292T3 (es) * | 2013-10-30 | 2021-06-14 | Nec Corp | Aparato, sistema y método de comunicación directa segura en servicios basados en proximidad |
CN104735626A (zh) * | 2013-12-20 | 2015-06-24 | 中兴通讯股份有限公司 | 集群通信公共安全的实现方法及装置 |
KR102040036B1 (ko) * | 2014-01-28 | 2019-11-04 | 후아웨이 테크놀러지 컴퍼니 리미티드 | 보안 패스워드 변경 방법, 기지국, 및 사용자 기기 |
US9762590B2 (en) | 2014-04-17 | 2017-09-12 | Duo Security, Inc. | System and method for an integrity focused authentication service |
US9768957B2 (en) * | 2014-04-23 | 2017-09-19 | Cryptography Research, Inc. | Generation and management of multiple base keys based on a device generated key |
US9979719B2 (en) | 2015-01-06 | 2018-05-22 | Duo Security, Inc. | System and method for converting one-time passcodes to app-based authentication |
US10375046B1 (en) * | 2015-01-20 | 2019-08-06 | Arsen Samvelian | Anti-spam authentication and validation defense system |
US9641341B2 (en) | 2015-03-31 | 2017-05-02 | Duo Security, Inc. | Method for distributed trust authentication |
EP3304336B1 (en) | 2015-06-01 | 2019-10-09 | Duo Security, Inc. | Method for enforcing endpoint health standards |
CN105005059A (zh) * | 2015-06-26 | 2015-10-28 | 泰斗微电子科技有限公司 | 一种原始观测量数据在android终端中的传输方法及相应的终端 |
US9774579B2 (en) | 2015-07-27 | 2017-09-26 | Duo Security, Inc. | Method for key rotation |
CN106714153B (zh) * | 2015-11-13 | 2022-06-10 | 华为技术有限公司 | 密钥分发、生成和接收方法以及相关装置 |
US20170171752A1 (en) * | 2015-12-14 | 2017-06-15 | Qualcomm Incorporated | Securing signaling interface between radio access network and a service management entity to support service slicing |
EP3410629B1 (en) | 2016-03-01 | 2024-07-10 | Huawei Technologies Co., Ltd. | Data transmission method, device and system |
CN105610872B (zh) * | 2016-03-16 | 2018-09-07 | 中国联合网络通信集团有限公司 | 物联网终端加密方法和物联网终端加密装置 |
US10588019B2 (en) * | 2016-05-05 | 2020-03-10 | Qualcomm Incorporated | Secure signaling before performing an authentication and key agreement |
CN109417539A (zh) * | 2016-07-15 | 2019-03-01 | 华为技术有限公司 | 密钥获取方法及装置 |
WO2018058687A1 (zh) * | 2016-09-30 | 2018-04-05 | 华为技术有限公司 | 一种处理控制信令的方法、设备及*** |
GB201617620D0 (en) * | 2016-10-18 | 2016-11-30 | Cybernetica As | Composite digital signatures |
US10462837B2 (en) * | 2016-11-04 | 2019-10-29 | Qualcomm Incorporated | Method, apparatus, and system for reestablishing radio communication links due to radio link failure |
CN108243144B (zh) * | 2016-12-23 | 2020-07-28 | 大唐移动通信设备有限公司 | 一种lte***中as安全模式过程优化方法 |
EP3566386B1 (en) * | 2017-01-05 | 2020-07-29 | Koninklijke Philips N.V. | Network device and trusted third party device |
CN115474247A (zh) * | 2017-01-30 | 2022-12-13 | 瑞典爱立信有限公司 | 连接模式期间5g中的安全性上下文处理的方法和装置 |
WO2018182759A1 (en) * | 2017-03-30 | 2018-10-04 | Intel IP Corporation | Security for paging messages |
CN108810890B (zh) * | 2017-05-05 | 2019-06-11 | 华为技术有限公司 | 锚密钥生成方法、设备以及*** |
JP7255949B2 (ja) | 2017-06-16 | 2023-04-11 | ホアウェイ・テクノロジーズ・カンパニー・リミテッド | 通信方法および装置 |
CN109511113B (zh) | 2017-07-28 | 2020-04-14 | 华为技术有限公司 | 安全实现方法、相关装置以及*** |
CN107563207B (zh) * | 2017-08-04 | 2019-11-22 | 海光信息技术有限公司 | 加密方法、装置及解密方法、装置 |
US10412113B2 (en) | 2017-12-08 | 2019-09-10 | Duo Security, Inc. | Systems and methods for intelligently configuring computer security |
CN109168161B (zh) * | 2018-08-27 | 2021-11-02 | 创新维度科技(北京)有限公司 | 安全模式激活方法、装置、***和计算机存储介质 |
US11658962B2 (en) | 2018-12-07 | 2023-05-23 | Cisco Technology, Inc. | Systems and methods of push-based verification of a transaction |
CN111404670A (zh) * | 2019-01-02 | 2020-07-10 | ***通信有限公司研究院 | 一种密钥生成方法、ue及网络设备 |
US11470473B2 (en) * | 2019-01-18 | 2022-10-11 | Qualcomm Incorporated | Medium access control security |
US20220167157A1 (en) * | 2019-04-08 | 2022-05-26 | Nec Corporation | Procedure to provide integrity protection to a ue parameter during ue configuration update procedure |
CN110753346B (zh) * | 2019-10-30 | 2021-02-19 | 北京微智信业科技有限公司 | 移动通信专网密钥生成方法、装置及控制器 |
JP7521011B2 (ja) | 2020-05-29 | 2024-07-23 | 華為技術有限公司 | 通信方法及び装置 |
US12028324B1 (en) * | 2020-07-01 | 2024-07-02 | Cable Television Laboratories, Inc. | Systems and methods for advanced chained authentications and authorizations |
EP3952200A1 (en) * | 2020-08-07 | 2022-02-09 | Nokia Technologies Oy | Security procedure |
Citations (3)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN101406024A (zh) * | 2006-03-22 | 2009-04-08 | Lg电子株式会社 | Umts的lte的安全考量 |
CN101754191A (zh) * | 2008-11-27 | 2010-06-23 | 宏达国际电子股份有限公司 | 处理交递保密设定的方法及其相关通讯装置 |
CN101772019A (zh) * | 2009-01-05 | 2010-07-07 | 宏达国际电子股份有限公司 | 处理跨***交递保密的方法及其相关通讯装置 |
Family Cites Families (3)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN101378591B (zh) | 2007-08-31 | 2010-10-27 | 华为技术有限公司 | 终端移动时安全能力协商的方法、***及装置 |
WO2010145685A1 (en) * | 2009-06-15 | 2010-12-23 | Nokia Siemens Networks Oy | Flat architecture in geran |
CN101931951B (zh) | 2009-06-26 | 2012-11-07 | 华为技术有限公司 | 密钥推演方法、设备及*** |
-
2011
- 2011-01-28 CN CN201110031924.4A patent/CN102625300B/zh active Active
-
2012
- 2012-01-29 EP EP12738754.6A patent/EP2663107B1/en active Active
- 2012-01-29 WO PCT/CN2012/070743 patent/WO2012100749A1/zh active Application Filing
-
2013
- 2013-07-29 US US13/952,985 patent/US9049594B2/en active Active
Patent Citations (3)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN101406024A (zh) * | 2006-03-22 | 2009-04-08 | Lg电子株式会社 | Umts的lte的安全考量 |
CN101754191A (zh) * | 2008-11-27 | 2010-06-23 | 宏达国际电子股份有限公司 | 处理交递保密设定的方法及其相关通讯装置 |
CN101772019A (zh) * | 2009-01-05 | 2010-07-07 | 宏达国际电子股份有限公司 | 处理跨***交递保密的方法及其相关通讯装置 |
Non-Patent Citations (1)
Title |
---|
See also references of EP2663107A4 * |
Cited By (1)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
EP3439345A1 (en) * | 2013-03-05 | 2019-02-06 | Huawei Technologies Co., Ltd. | Key exchange method and apparatus |
Also Published As
Publication number | Publication date |
---|---|
CN102625300B (zh) | 2015-07-08 |
US20130310006A1 (en) | 2013-11-21 |
EP2663107B1 (en) | 2019-11-20 |
US9049594B2 (en) | 2015-06-02 |
EP2663107A1 (en) | 2013-11-13 |
EP2663107A4 (en) | 2014-02-26 |
CN102625300A (zh) | 2012-08-01 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
WO2012100749A1 (zh) | 密钥生成方法和设备 | |
US10812256B2 (en) | Method, apparatus, and system for performing an establishment of a security context between user equipment and an access node | |
US20200084631A1 (en) | Key Configuration Method, Apparatus, and System | |
EP2845362B1 (en) | Secure communications for computing devices utilizing proximity services | |
CN109417740B (zh) | 保持相同无线终端的切换期间的安全密钥使用 | |
WO2019019736A1 (zh) | 安全实现方法、相关装置以及*** | |
US8707045B2 (en) | Method and apparatus for traffic count key management and key count management | |
CN110891269B (zh) | 一种数据保护方法、设备及*** | |
CN109314638A (zh) | 密钥配置及安全策略确定方法、装置 | |
WO2019062920A1 (zh) | 数据安全处理方法及装置 | |
WO2013064089A1 (zh) | 生成组密钥的方法和相关设备 | |
US20170359719A1 (en) | Key generation method, device, and system | |
WO2011137805A1 (zh) | 切换过程中的安全处理方法、装置和*** | |
WO2013064041A1 (zh) | 生成组密钥的方法和相关设备 | |
WO2015062097A1 (zh) | 一种双连接模式下的密钥处理方法和设备 | |
WO2011003299A1 (zh) | 无线资源控制(rrc)连接重建立时的安全密钥处理方法、装置及*** | |
WO2011098048A1 (zh) | 无线节点入网方法、***及中继节点 | |
KR102142875B1 (ko) | Scell 및 ue 사이의 암호화 정보 동기 방법 | |
WO2015096138A1 (zh) | 分流方法、用户设备、基站和接入点 | |
WO2013174267A1 (zh) | 无线局域网络的安全建立方法及***、设备 | |
WO2013087010A1 (zh) | 在通信***中生成接入层密钥的方法及其设备 | |
WO2012031510A1 (zh) | 一种实现安全密钥同步绑定的方法及*** | |
EP2648437B1 (en) | Method, apparatus and system for key generation | |
WO2011054288A1 (zh) | 一种中继***的安全密钥获取方法、装置 | |
WO2013029461A1 (zh) | 一种数据安全传输方法及相关设备 |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
121 | Ep: the epo has been informed by wipo that ep was designated in this application |
Ref document number: 12738754 Country of ref document: EP Kind code of ref document: A1 |
|
NENP | Non-entry into the national phase |
Ref country code: DE |
|
WWE | Wipo information: entry into national phase |
Ref document number: 2012738754 Country of ref document: EP |