CN104349311A - Key establishment method and system used for small-data transmission of machine-type communication - Google Patents

Abstract

The invention discloses a key establishment method and system for MTC small data transmission of machine type communication, wherein the method includes: a home subscriber server HSS receiving authentication data request information, and an MTC device sending attachment request information Designate an MTC interworking functional entity MTC-IWF for small data transmission; the HSS generates a shared key K _iwf between the MTC device and the MTC-IWF; the HSS transfers the MTC-IWF information via the mobile management entity MME or general packet The wireless service service support node SGSN sends it to the MTC device; the HSS sends the MTC device information and the generated shared key K _iwf to the designated MTC-IWF; the MTC-IWF stores the received MTC device information and shared key K _iwf ; the MTC device generates a shared key K _iwf . Aiming at the situation of deploying multiple MTC-IWFs in the MTC system, the present invention can establish a shared key between MTC equipment and MTC-IWFs.

Description

A key establishment method and system for machine type communication small data transmission

technical field

The present invention relates to the field of communications, in particular to a key establishment method and system for machine type communication (Machine Type Communication, MTC) small data transmission.

Background technique

MTC refers to the general term for a series of technologies and their combinations that apply wireless communication technology to realize data communication and exchange between machines and machines and between machines and people. MTC includes two layers of meaning: the first layer is the machine itself, which is called a smart device in the embedded field; the second layer means the connection between machines, connecting machines together through the network. MTC has a wide range of applications, such as intelligent measurement, remote monitoring, tracking, medical treatment, etc., making human life more intelligent. Compared with the traditional communication between people, the number of MTC devices (MTC Device) is huge and the application fields are wide.

In the existing MTC system, the MTC device communicates with the Service Capability Server (SCS) through the 3rd Generation Partnership Project (3rd Generation Partnership Project, 3GPP) network and the MTC interworking function entity (MTC InterWorking Function, MTC-IWF), For example, the MTC server communicates.

In a mobile communication system, after the introduction of MTC devices, since there are a large number of MTC devices, and these MTC devices may often receive and send small data, the resource usage efficiency of the mobile communication system is reduced. In order to efficiently use network resources, small data is usually transmitted between the MTC device and the MTC-IWF through signaling.

Currently, the Small Data Transmission (SDT) protocol is deployed between the MTC device and the MTC-IWF, and any data exchange between the MTC device and the SCS needs to go through the MTC-IWF. Each SDT protocol data unit indicates the identity of the sending and receiving parties. The small data service data unit between the MTC device and the mobile management entity (Mobile Management Entity, MME) or general packet radio service (General Packet Radio Service, GPRS) serving support node (Serving GPRS Support Node, SGSN) is encapsulated in a common network interface Incoming service (Network Access Service, NAS) protocol data unit, in the NAS protocol data unit, the protocol type needs to be set to SDT. When transmitting data between MME/SGSN and MTC-IWF, the small data is encapsulated in the Small Data Transmission-Transfer-Protocol Data Unit (SDT-Transfer-PDU) for transmission.

In the above method, to ensure the security between the MTC device and the MTC-IWF, a shared key needs to be established between the MTC device and the MTC-IWF. However, the current technical solution for establishing a shared key between the MTC device and the MTC-IWF is only applicable to the case where only one MTC-IWF is deployed in the MTC system. For the case of deploying multiple MTC-IWFs in the MTC system, it is still impossible to establish a shared key between the MTC device and the MTC-IWF.

Contents of the invention

In view of this, the main purpose of the present invention is to provide a key establishment method and system for MTC small data transmission. For the situation where multiple MTC-IWFs are deployed in the MTC system, the MTC device and the MTC-IWF can Create a shared secret.

In order to achieve the above object, technical solution of the present invention is achieved in that way:

The present invention provides a method for establishing a key for machine type communication (MTC) small data transmission, the method comprising:

The home subscriber server HSS that receives the authentication data request information designates an MTC interworking functional entity MTC-IWF for small data transmission for the MTC device sending the attach request information;

The HSS generates a shared key K _iwf between the MTC device and the MTC-IWF;

The HSS sends the MTC-IWF information to the MTC device via a mobility management entity MME or a general packet radio service support node SGSN;

The HSS sends the MTC device information and the generated shared key _Kiwf to the designated MTC-IWF;

The MTC-IWF stores the received MTC device information and shared key _Kiwf ;

The MTC device generates a shared key K _iwf .

Preferably, after the HSS generates the shared key _Kiwf between the MTC device and the MTC-IWF, the method further includes:

The HSS generates a next-level key through the shared key _Kiwf ;

Correspondingly, after the MTC device generates the shared key _Kiwf , the method further includes:

The MTC device generates the next-level key through the shared key _Kiwf .

Preferably, after the MTC device generates the shared key _Kiwf , the method further includes:

The MTC device sends a security association request message to the MTC-IWF via MME or SGSN;

After receiving the security association request information, the MTC-IWF authenticates the MTC device according to the stored shared key _Kiwf , and generates a next-level key through the shared key _Kiwf ;

The MTC-IWF sends a security association response message to the MTC device;

The MTC device authenticates the MTC-IWF according to the stored shared key _Kiwf , and generates a next-level key through the shared key _Kiwf .

Preferably, the next-level key includes an encryption key and an integrity protection key.

Preferably, the authentication data request information includes the identity information of the MTC device, the MTC capability information of the MTC device and the capability information of sending/receiving small data;

Correspondingly, specifying an MTC-IWF for small data transmission for the MTC device sending the attach request information is:

According to the MTC capability information of the MTC device, the capability information of sending/receiving small data and the information of each MTC-IWF stored in itself, the HSS designates an MTC-IWF for small data transmission for the MTC device sending the attach request information.

The present invention provides a key establishment system for machine type communication (MTC) small data transmission, the system includes: home subscriber server HSS, MTC equipment and multiple MTC interworking functional entities MTC-IWF, wherein,

The HSS is used to specify an MTC-IWF for small data transmission for the MTC device sending the attach request message after receiving the authentication data request information; generate a shared key K _iwf between the MTC device and the MTC-IWF; Send the MTC-IWF information to the MTC device via the mobile management entity MME or the general packet radio service support node SGSN; send the MTC device information and the generated shared key _Kiwf to the designated MTC-IWF;

The MTC-IWF is used to store the received MTC device information and shared key _Kiwf ;

The MTC device is configured to generate a shared key K _iwf .

Preferably, the HSS is also used to generate a next-level key through the shared key _Kiwf ;

The MTC device is further configured to generate a next-level key through the shared key _Kiwf .

Preferably, the MTC device is further configured to send security association request information to the MTC-IWF via MME or SGSN; after receiving the security association response information sent by the MTC-IWF, according to the stored shared key _Kiwf pair MTC-IWF performs authentication and generates a next-level key through the shared key _Kiwf ;

The MTC-IWF is also used to authenticate the MTC device according to the stored shared key _Kiwf after receiving the security association request information, and generate a next-level key through the shared key _Kiwf ; The device sends security association response information.

Preferably, the next-level key includes an encryption key and an integrity protection key.

Preferably, the authentication data request information includes the identity information of the MTC device, the MTC capability information of the MTC device and the capability information of sending/receiving small data;

Correspondingly, the HSS is configured to, according to the MTC capability information of the MTC device, the sending/receiving small data capability information, and the information of each MTC-IWF stored by itself, designate an MTC device that sends the attach request information to perform small data transmission The MTC-IWF.

As can be seen from the above, the technical solution of the present invention includes: the home subscriber server HSS receiving the authentication data request information designates an MTC interworking functional entity MTC-IWF for small data transmission for the MTC device sending the attachment request information; the HSS generates The shared key K _iwf between the MTC device and the MTC-IWF; the HSS sends the MTC-IWF information to the MTC device via the mobile management entity MME or the general packet radio service service support node SGSN; the HSS sends the MTC device information and The generated shared key K _iwf is sent to the designated MTC-IWF; the MTC-IWF stores the received MTC device information and the shared key K _iwf ; the MTC device generates the shared key K _iwf . Thus, for the situation where multiple MTC-IWFs are deployed in the MTC system, the present invention can establish a shared key between the MTC device and the MTC-IWF.

Description of drawings

Fig. 1 is a schematic flow diagram of an embodiment of a key establishment method for MTC small data transmission provided by the present invention;

Fig. 2 is a schematic flow chart of Embodiment 1 of a method for establishing a key for MTC small data transmission provided by the present invention;

Fig. 3 is a schematic flow chart of Embodiment 2 of a method for establishing a key for MTC small data transmission provided by the present invention;

Fig. 4 is a schematic flow chart of Embodiment 3 of a key establishment method for MTC small data transmission provided by the present invention;

Fig. 5 is a schematic structural diagram of an embodiment of a key establishment system for MTC small data transmission provided by the present invention;

Fig. 6 is a schematic structural diagram of another embodiment of a key establishment system for MTC small data transmission provided by the present invention;

FIG. 7 is a schematic diagram of a device structure of a key establishment system for MTC small data transmission provided by the present invention.

Detailed ways

Hereinafter, the present invention will be described in detail with reference to the drawings and examples. It should be noted that, in the case of no conflict, the embodiments in the present application and the features in the embodiments can be combined with each other.

An embodiment of a key establishment method for MTC small data transmission provided by the present invention, as shown in Figure 1, the method includes:

Step 101. The Home Subscriber Server (HSS) that receives the authentication data request information designates an MTC-IWF for small data transmission for the MTC device that sends the attachment request information;

Step 102, the HSS generates a shared key K _iwf between the MTC device and the MTC-IWF;

Step 103, the HSS sends the MTC-IWF information to the MTC device via the mobility management entity MME or the serving general packet radio service support node SGSN;

Step 104, the HSS sends the MTC device information and the generated shared key _Kiwf to the designated MTC-IWF;

Step 105, the MTC-IWF stores the received MTC device information and shared key _Kiwf ;

Step 106, the MTC device generates a shared key K _iwf .

Preferably, after the HSS generates the shared key _Kiwf between the MTC device and the MTC-IWF, the method further includes:

The HSS generates a next-level key through the shared key _Kiwf ;

Correspondingly, after the MTC device generates the shared key _Kiwf , the method further includes:

The MTC device generates the next-level key through the shared key _Kiwf .

Preferably, after the MTC device generates the shared key _Kiwf , the method further includes:

The MTC device sends a security association request message to the MTC-IWF via MME or SGSN;

After receiving the security association request information, the MTC-IWF authenticates the MTC device according to the stored shared key _Kiwf , and generates a next-level key through the shared key _Kiwf ;

The MTC-IWF sends a security association response message to the MTC device;

The MTC device authenticates the MTC-IWF according to the stored shared key _Kiwf , and generates a next-level key through the shared key _Kiwf .

Preferably, the next-level key includes an encryption key and an integrity protection key.

Preferably, the authentication data request information includes the identity information of the MTC device, the MTC capability information of the MTC device and the capability information of sending/receiving small data;

Correspondingly, specifying an MTC-IWF for small data transmission for the MTC device sending the attach request information is:

According to the MTC capability information of the MTC device, the capability information of sending/receiving small data and the information of each MTC-IWF stored in itself, the HSS designates an MTC-IWF for small data transmission for the MTC device sending the attach request information.

Embodiment one

In the first embodiment, when the MTC device is attached, it generates a shared key K _iwf with the MTC-IWF. Specifically, as shown in FIG. 2 , it includes the following steps:

Step 201, the MTC device sends an attach request message to the MME;

Here, the attachment request information includes the identity information of the MTC device, such as the International Mobile Subscriber Identification Number (IMSI), the International Mobile Equipment Identity (IMEI), or other information that can be used to The identity information identifying the MTC device also includes the MTC capability information and the sending/receiving small data capability information of the MTC device.

Step 202, MME sends authentication data request information to HSS;

Here, the authentication data request information includes the identity information of the MTC device, such as IMSI, IMEI, or other identity information that can be used to identify the MTC device, and also includes MTC capability information and sending/receiving small data capability information of the MTC device.

Step 203, the HSS generates authentication response data according to the contract information of the MTC device, and at the same time specifies an MTC-IWF for small data transmission for the MTC device, and generates a shared key K _iwf between the MTC device and the MTC-IWF;

Here, the shared key K _iwf may be generated according to a key generation algorithm, specifically, may be generated by an Access Security Management Entity (ASME) according to a key generation algorithm;

Here, the HSS can determine the MTC-IWF for small data transmission for the attached MTC device according to the MTC capability information of the attached MTC device, the sending/receiving small data capability information and the information of each MTC-IWF stored in itself.

Step 204, the HSS sends the MTC-IWF information together with the authentication response data to the MME;

Here, the MTC-IWF information may be any information used to identify the identity of the MTC-IWF.

Step 205, the HSS sends the MTC device information and the generated shared key _Kiwf to the designated MTC-IWF;

Here, the MTC device information may be identity information of the MTC device, such as IMSI, IMEI or other identity information that can be used to identify the MTC device.

In step 206, the MTC-IWF receives and saves the shared key _Kiwf and MTC device information, and maintains and manages the saved shared key _Kiwf and MTC device information.

In step 207, the MME and the MTC device further complete mutual authentication.

Step 208, the MME sends the MTC-IWF information to the MTC device.

Step 209, the MTC device stores the MTC-IWF information, and maintains and manages the stored MTC-IWF information.

Step 210, the MTC device generates and saves a shared key K _iwf according to a key generation algorithm.

When the MTC device transmits small data, the MTC device needs to indicate that the small data needs to be sent to the designated MTC-IWF to realize the small data transmission according to the association information between the MTC device and the MTC-IWF stored on it. When MTC-IWF receives small data from small data sources, such as MTC servers, network servers, other network entities or other MTC devices, MTC-IWF needs to store the associated information between MTC devices and MTC-IWF, Determine whether the small data can be forwarded to the MTC device, if the small data can be forwarded to the MTC device, then forward the small data to the designated MTC device to realize the transmission of the small data; otherwise, the MTC-IWF does not forward the small data, And further, according to the needs of the system, the small data forwarding failure information can be fed back to the small data source.

Embodiment two

In the second embodiment, according to the needs of the system or according to the security protection needs of small data transmission, the MTC device and the MTC-IWF further generate a small data encryption key and a small data integrity protection key on the basis of the shared key _Kiwf . It can be completed during the attachment process. Compared with Embodiment 1, the difference of Embodiment 2 is that the step of generating the shared key further includes the generation method of the next-level key for the security protection of small data transmission, Specifically, as shown in Figure 3, the following steps are included:

Step 301, the MTC device sends an attach request message to the MME;

Here, the attach request information includes the identity information of the MTC device, such as IMSI, and also includes MTC capability information and sending/receiving small data capability information of the MTC device.

In step 302, the MME sends authentication data request information to the HSS.

Step 303: The HSS generates authentication response data according to the subscription information of the MTC device, and at the same time designates an MTC-IWF for small data transmission for the MTC device, and generates a shared key K _iwf between the MTC device and the MTC-IWF, and passes the shared The key K _iwf generates the next-level key used to protect the safe transmission of small data, such as encryption key and integrity protection key;

Here, the shared key K _iwf may be generated according to a key generation algorithm, specifically, it may be generated by _Kasme according to a key generation algorithm.

Step 304, the HSS sends the MTC-IWF information together with the authentication response data to the MME;

Here, the MTC-IWF information may be any information used to identify the identity of the MTC-IWF.

Step 305, the HSS sends the MTC device information and the generated shared key K _iwf , encryption key and integrity protection key to the designated MTC-IWF.

Step 306, MTC-IWF receives and saves MTC device information and generated shared key K _iwf , encryption key and integrity protection key, and stores MTC device information and generated shared key K _iwf , encrypted key and integrity protection keys for maintenance and management.

In step 307, the MME and the MTC device further complete mutual authentication.

Step 308, the MME sends the MTC-IWF information to the MTC device.

Step 309, the MTC device stores the MTC-IWF information, and maintains and manages the stored MTC-IWF information.

Step 310, the MTC device generates a shared key K _iwf according to the key generation algorithm, and generates a next-level key used to protect the secure transmission of small data through the shared key K _iwf , such as an encryption key and an integrity protection key, And save the shared key K _iwf , encryption key and integrity protection key.

Embodiment three

In this embodiment, when the MTC device attaches, the MTC device and the MTC-IWF generate a shared key K _iwf , and according to system requirements or according to the security protection requirements for small data transmission, after attaching and generating the shared key K _iwf , the MTC device initiates the generation of the shared key K iwf The generation process of the next-level key used for the security protection of small data transmission between MTC-IWF, as shown in Figure 4, the method may include the following steps:

Step 401, after generating the shared key _Kiwf , the MTC device sends security association request information to the MTC-IWF via the MME;

Here, the security association request information may include security algorithm information, MTC device information, and other information used for authentication and key generation;

Specifically, the security association request information may be sent through NAS signaling.

Step 402, after the MTC-IWF receives the security association request information, it authenticates the MTC device according to the stored shared key _Kiwf , and generates a next-level key for protecting the secure transmission of small data through the shared key _Kiwf , Such as encryption keys and integrity protection keys.

Step 403, the MTC-IWF sends security association response information to the MTC device;

Here, the security association response information may include security algorithm information, MTC-IWF information, and other information used for authentication and key generation.

Step 404, the MTC device authenticates the MTC-IWF according to the stored shared key _Kiwf , and generates the next-level key used to protect the safe transmission of small data through the shared key _Kiwf , such as encryption key and integrity protection key.

In step 405, small data is safely transmitted between the MTC device and the MTC-IWF through the generated encryption key and integrity protection key.

In the foregoing embodiments 1, 2, and 3, the SGSN may also be used instead of the MME.

Corresponding to the above key establishment method for MTC small data transmission, an embodiment of a key establishment system for MTC small data transmission provided by the present invention, as shown in Figure 5, the system includes: HSS, MTC device and multiple MTC-IWFs, where,

The HSS is configured to, after receiving the authentication data request information, designate an MTC-IWF for small data transmission for the MTC device sending the attachment request information, establish and store an association relationship between the MTC device and the MTC-IWF; generate The shared key K _iwf between the MTC device and the MTC-IWF; the MTC-IWF information is sent to the MTC device via the mobile management entity MME or the general packet radio service service support node SGSN; the MTC device information and the generated shared key K _iwf sends to the specified MTC-IWF;

The MTC-IWF is used to store the received MTC device information and shared key _Kiwf ;

The MTC device is configured to store received MTC-IWF information and generate a shared key K _iwf .

Preferably, the HSS is also used to generate a next-level key through the shared key _Kiwf ;

The MTC device is further configured to generate a next-level key through the shared key _Kiwf .

Preferably, the MTC device is further configured to send security association request information to the MTC-IWF via MME or SGSN; after receiving the security association response information sent by the MTC-IWF, according to the stored shared key _Kiwf pair MTC-IWF performs authentication and generates a next-level key through the shared key _Kiwf ;

The MTC-IWF is also used to authenticate the MTC device according to the stored shared key _Kiwf after receiving the security association request information, and generate a next-level key through the shared key _Kiwf ; The device sends security association response information.

Preferably, the next-level key includes an encryption key and an integrity protection key.

Preferably, the authentication data request information includes the identity information of the MTC device, the MTC capability information of the MTC device and the capability information of sending/receiving small data;

Correspondingly, the HSS is configured to, according to the MTC capability information of the MTC device, the sending/receiving small data capability information, and the information of each MTC-IWF stored by itself, designate an MTC device that sends the attach request information to perform small data transmission The MTC-IWF establishes, stores and maintains the association relationship between the MTC device and the MTC-IWF.

In practical application, the embodiment of the key establishment system for MTC small data transmission provided by the present invention, as shown in Figure 6, includes: MTC equipment for storing MTC-IWF information and small data transmission shared key information ; MME, used for NAS signaling process; HSS, used to manage and maintain MTC-IWF information, can also be used to manage and maintain MTC equipment information, can also be used to establish, store and maintain the communication between MTC equipment and MTC-IWF Association relationship, designate an MTC-IWF for small data transmission for the MTC device, and generate a shared key between the MTC device and the MTC-IWF; each MTC-IWF, MTC-IWF1 and MTC-IWF2 in this example, is used to Store MTC device information and small data transmission shared key information.

Fig. 7 is a schematic diagram of the equipment structure of the key establishment system for MTC small data transmission according to the present invention. As shown in Fig. 7, the equipment of the system may include: MTC equipment, MME, MTC-IWF and HSS.

Specifically, as shown in Figure 7, the equipment of the system specifically includes:

The first storage management unit is used to store and manage MTC device information and key information;

The second storage management unit is used to store and manage MTC-IWF information and key information;

The third storage management unit is used to store and manage MTC-IWF information and MTC equipment information, and store and manage associated information between MTC-IWF and MTC equipment;

An allocating unit, configured to allocate a specified associated MTC-IWF according to the MTC device attachment information;

The first, second and third sending/receiving units are used for sending and receiving signaling information, key information, device information and small data;

a judging unit, configured to judge whether the MTC-IWF can forward small data information;

The first and second key negotiation units are used to negotiate a shared key, such as an encryption key and an integrity key.

In the above embodiments, the SGSN may also be used instead of the MME.

Obviously, those skilled in the art should understand that each module or each step of the above-mentioned present invention can be realized by a general-purpose computing device, and they can be concentrated on a single computing device, or distributed in a network formed by multiple computing devices Alternatively, they may be implemented in program code executable by a computing device so that they may be stored in a storage device to be executed by a computing device, and in some cases, in an order different from that shown here The steps shown or described are carried out, or they are separately fabricated into individual integrated circuit modules, or multiple modules or steps among them are fabricated into a single integrated circuit module for implementation. As such, the present invention is not limited to any specific combination of hardware and software.

The above descriptions are only preferred embodiments of the present invention, and are not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and changes. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present invention shall be included within the protection scope of the present invention.

Claims (10)

1. for a key establishing method for machine type communication MTC small data transmission, it is characterized in that, described method comprises:

Receive the home subscriber server HSS of authentication data request information, for the MTC device sending attachment solicited message specifies a MTC interworking function entity MTC-IWF carrying out small data transmission;

Described HSS generates the shared key K between MTC device and MTC-IWF _iwf;

MTC-IWF information is issued MTC device via mobile management entity MME or GPRS serving GPRS support node SGSN by described HSS;

Described HSS is by the shared key K of MTC device information and generation _iwfsend to the MTC-IWF specified;

The MTC device information that described MTC-IWF storage receives and shared key K _iwf;

Described MTC device generates shared key K _iwf.

2. method according to claim 1, is characterized in that, generates the shared key K between MTC device and MTC-IWF at described HSS _iwfafterwards, described method also comprises:

Described HSS is by shared key K _iwfgenerate next stage key;

Accordingly, shared key K is generated in MTC device _iwfafterwards, described method also comprises:

MTC device is by shared key K _iwfgenerate next stage key.

3. method according to claim 1, is characterized in that, generates shared key K in MTC device _iwfafterwards, described method also comprises:

MTC device sends security association request information via MME or SGSN to MTC-IWF;

After MTC-IWF receives security association request information, according to the shared key K stored _iwfcertification is carried out to MTC device, and by described shared key K _iwfgenerate next stage key;

MTC-IWF sends security association response message to MTC device;

MTC device is according to the shared key K stored _iwfcertification is carried out to MTC-IWF, and by described shared key K _iwfgenerate next stage key.

4. according to the method in claim 2 or 3, it is characterized in that, described next stage key comprises encryption key and tegrity protection key.

5. method according to claim 1, is characterized in that, described authentication data request information comprises identity information and the MTC device MTC ability information of MTC device and send/receive small data ability information;

Accordingly, the described MTC device for sending attachment solicited message specifies a MTC-IWF carrying out small data transmission to be:

HSS, according to described MTC device MTC ability information, the information that send/receive each MTC-IWF of small data ability information and self storage, specifies a MTC-IWF carrying out small data transmission for sending the MTC device of adhering to solicited message.

6. for a Key Establishing system for machine type communication MTC small data transmission, it is characterized in that, described system comprises: home subscriber server HSS, MTC device and multiple MTC interworking function entity MTC-IWF, wherein,

Described HSS, for after receiving authentication data request information, for the MTC device sending attachment solicited message specifies a MTC-IWF carrying out small data transmission; Generate the shared key K between MTC device and MTC-IWF _iwf; MTC-IWF information is issued MTC device via mobile management entity MME or GPRS serving GPRS support node SGSN; By the shared key K of MTC device information and generation _iwfsend to the MTC-IWF specified;

Described MTC-IWF, for storing the MTC device information and shared key K that receive _iwf;

Described MTC device, for generating shared key K _iwf.

7. system according to claim 6, is characterized in that,

Described HSS, also for passing through shared key K _iwfgenerate next stage key;

Described MTC device, also for passing through shared key K _iwfgenerate next stage key.

8. system according to claim 6, is characterized in that, described MTC device, also for sending security association request information via MME or SGSN to MTC-IWF; After receiving the security association response message that MTC-IWF sends, according to the shared key K stored _iwfcertification is carried out to MTC-IWF, and by described shared key K _iwfgenerate next stage key;

Described MTC-IWF, also for after receiving security association request information, according to the shared key K stored _iwfcertification is carried out to MTC device, and by described shared key K _iwfgenerate next stage key; Security association response message is sent to MTC device.

9. the system according to claim 7 or 8, is characterized in that, described next stage key comprises encryption key and tegrity protection key.

10. system according to claim 6, is characterized in that, described authentication data request information comprises identity information and the MTC device MTC ability information of MTC device and send/receive small data ability information;

Accordingly, described HSS, for according to described MTC device MTC ability information, the information that send/receive each MTC-IWF of small data ability information and self storage, for the MTC device sending attachment solicited message specifies a MTC-IWF carrying out small data transmission.