WO2010078724A1

WO2010078724A1 - Local authentication method in mobile communication system

Info

Publication number: WO2010078724A1
Application number: PCT/CN2009/070083
Authority: WO
Inventors: 和峰; 甘露; 杜忠达
Original assignee: 中兴通讯股份有限公司
Priority date: 2009-01-08
Filing date: 2009-01-08
Publication date: 2010-07-15

Abstract

A local authentication method is provided in the present invention. In a periodic local authentication procedure, an eNB transmits packet data convergence protocol (PDCP) COUNT value of a radio bearer to a UE; the UE compares the PDCP COUNT value of itself with the received PDCP COUNT value; if a tolerance between both exceeds a predetermined tolerance range, the UE transmits the PDCP COUNT value of the radio bearer to the eNB. By applying of the present invention, misdetection which occurs possibly in checking procedure of prior art is improved, stability of the whole system is enhanced, and mistake processing for normal user communication is reduced. By effective system configuration, effective load of system signaling can be reduced.

Description

Method for local authentication in mobile communication system

Technical field

The present invention relates to a wireless cellular communication system, and more particularly to a method for local authentication in a Long Term Evolution (LTE) mobile communication system. Background technique

LTE (Long Term Evolution) network consists of E-UTRAN (Evolved Universal Terrestrial Radio Access Network) base station eNB (Evolved NodeB) and Evolved Packet Core (EPC). Evolved Grouping Center). The security performance of the system in LTE has been mentioned to a very high level, and ensuring network and user security is one of the important tasks of LTE.

During the process of transmitting data, the eNB may have an illegal intrusion attack from the outside of the communication system. The intruder may insert an illegal data packet in the connection between the eNB and the UE (User Equipment), which may threaten the entire connection or system. Security, or affect the overall performance of the system, but also may pose a threat or impact on the user experience.

To this end, the 3GPP (The 3rd Generation Partnership Project) protocol 33401-811 proposes a periodic local authentication process, also known as the Counter Check process. During transmission, the eNB will always monitor the PDCP COUNT value (PDCP: Packet Data Convergence Protocol; COUNT: Counter) for each radio. The PDCP COUNT value is HFN (Hyper Frame Number) and SN. (Session Number) A combination of counts that reflect the amount of data transmitted or received by the radio bearers in each active state. There is a separate counter for the transmitted and received packets: PDCP downlink COUNT (PDCP downlink count) ) and PDCP uplink COUNT (PDCP uplink count). It should be noted that the PDCP COUNT mentioned later is a general term for these two counters. The periodic local authentication process is triggered when the most significant bit of the PDCP COUNT value changes. The specific process is as follows (see Figure 1):

101, when the most significant bit of the PDCP COUNT value of one bearer in the UE transmission bearer occurs When changing, the eNB sends a counter check message to the UE, and the counter check message contains the MSB (most Significant Bits) portion of the PDCP COUNT value of each activated radio bearer.

102. The UE compares the PDCP COUNT value in the received counter check message with the PDCP COUNT MSB value of the corresponding radio bearer (including the PDCP uplink COUNT MSB and the PDCP downlink COUNT MSB). If there is a difference, the PDCP COUNT value of the bearer with the deviation will be included in the counter check reply message.

103. If the eNB receives a counter check response message that does not contain any PDCP COUNT value, the process terminates. If the eNB receives a counter check reply message containing one or several PDCP COUNT values, the eNB may release the connection or report the difference to the serving MME (Mobility Management Entity) or O&M (Operation and Maintenance, Operation and Maintenance) Maintenance) for subsequent transmission security analysis.

The signaling of the periodic local authentication process is transmitted through the control plane. However, since the user plane data transmission is independent of the control plane, the PDCP COUNT value of the eNB may continue to change during the process of receiving the counter check message verification by the UE side. Thus, the PDCP COUNT of the eNB and the UE side is inconsistent. However, the receiving process is relatively short, and the PDCP COUNT value change is limited in a short time. Therefore, the protocol provides some fault-tolerant protection for the process: Only the MSB part of the PDCP COUNT is transmitted, and the change in the least significant bit can be ignored.

However, the above prior art may result in false detection. For example, for another radio bearer, it is possible that the most significant bit of its PDCP COUNT value is positive at a critical threshold, ie, the least significant bit is at the threshold for the carry to the most significant bit, at which time the counter is received at the UE side. During the check of the message verification, even if the PDCP COUNT value change is limited in a short time, the least significant bit may be carried over, resulting in the change of the most significant bit, resulting in the final misdetection. The same error detection condition may also occur between the uplink and downlink counts of the same bearer (ie, between PDCP downlink COUNT and PDCP uplink COUNT). For example, the most significant bit of the PDCP uplink count of a bearer changes at this time. The periodic local authentication process is triggered. At this time, the most significant bit of the PDCP downlink count of the bearer is positively changed at a critical value, and the aforementioned false detection may also occur. Summary of the invention

The technical problem to be solved by the present invention is to provide a method for local authentication in a mobile communication system, which reduces false detection and leakage detection and improves system security.

In order to solve the above problem, the present invention provides a local authentication method. In a periodic local authentication process, an evolved base station transmits a packet data convergence protocol counter value of a radio bearer to a terminal, and the terminal compares its own packet data convergence protocol counter value and And receiving, by the packet data convergence protocol counter value, if the deviation exceeds the set deviation range, the terminal sends the packet data convergence protocol counter value of the radio bearer to the evolved base station.

Further, the above method may further have the following characteristics, wherein the deviation between the two exceeds the set deviation range means that the absolute value of the difference is greater than a deviation value.

Further, the foregoing method may further have the following feature: the deviation value is transmitted to the terminal by the evolved base station when transmitting the packet data convergence protocol counter value, or is transmitted to the terminal through terminal dedicated signaling or system information broadcast, or Fixed configuration.

Further, the above method may further have the following characteristics, the deviation value is 2 to the power of n, and the value of n is any integer value of 0 to 15.

Further, the foregoing method may further have the following feature: the evolved base station sends the packet data convergence protocol counter value of the radio bearer to the terminal, where the all-bit or least significant part of the packet data convergence protocol counter value of the radio bearer is sent. When comparing the terminals to the terminal, the corresponding bits are compared using all bits or the least significant part of the packet data convergence protocol counter value.

Further, the above method may further have the following feature, wherein the least significant bit portion has a bit number ranging from 1 to 32.

Further, the foregoing method may further have the following feature: the packet data convergence protocol counter value includes an uplink packet data convergence protocol counter value, and when the terminal compares, if the terminal's own uplink packet data convergence protocol counter value d is received The uplink packet data convergence protocol counter value is sent, and the terminal sends the packet data convergence protocol counter value of the radio bearer to the evolved base station.

Further, the foregoing method may further have the following feature: the evolved base station divides the radio bearer The sending of the group data convergence protocol counter value to the terminal means that the most significant bit portion of the packet data convergence protocol counter value of the radio bearer is sent to the terminal, and when the terminal compares, the corresponding packet data convergence protocol counter value is used accordingly. The most significant bit portion is compared, and the deviation value is 1.

Further, the foregoing method may further have the following feature: the radio bearer is all activated radio bearers.

Further, the foregoing method may further have the following feature: in the periodic local authentication process, the evolved base station only triggers the high-bit of the uplink or downlink packet data convergence protocol counter value of the radio bearer that triggers the periodic local authentication process. Partially transmitted to the terminal, the deviation range is zero.

Further, the foregoing method may further have the following feature: in the periodic local authentication process, the evolved base station sends a counter check message to the terminal, where the counter check message carries the packet data convergence protocol counter value; If the bearer identifier carried in the counter check message is not established locally, or the bearer identifier of the radio bearer of the terminal is not in the counter check message, the radio bearer is asynchronous.

The invention improves the false detection which may occur in the verification process of the prior art, enhances the stability of the whole system, reduces the error handling of normal user communication, and can also reduce the system signaling through effective system configuration. Payload. BRIEF abstract

Figure 1 is an eNB periodic local verification process;

2 is a signaling flow chart of Embodiment 1 of a periodic local authentication process in the present invention; FIG. 3 is a second implementation manner of the optimized periodic local authentication process of the present invention;

4 is a third implementation manner of the optimized periodic local authentication process of the present invention;

FIG. 5 is a fourth implementation manner of the optimized periodic local authentication process of the present invention; FIG.

6 is a fifth implementation manner of the optimized periodic local authentication process of the present invention;

7 is a sixth implementation manner of the optimized periodic local authentication process of the present invention;

Figure 8 is a flow chart of the counter check comparison judgment of the present invention; 9 is a flow chart of comparing and evaluating the low effective bit of the counter of the present invention;

Fig. 10 is a flow chart showing the comparison judgment of the counter high effective bit of the present invention. Preferred embodiment of the invention

The basic idea of the present invention is to set a deviation range. In the periodic local authentication process, the terminal compares the PDCP COUNT and the local PDCP COUNT received from the evolved base station, if the set deviation range is exceeded (for example, the difference between the two) The absolute value of the radio bearer is greater than a set offset value, and the PDCP COUNT of the non-synchronized radio bearer is sent to the base station.

method one:

(a) The eNB transmits the entire PDCP COUNT value during the periodic local authentication process, ie, transmits

All bits of PDCP COUNT are introduced into a verification tolerance value Tolerance (Tolerance is a non-negative integer. In the implementation, Tolerance can take 2 ^Λ η, where η is the number of bits in Tolerance, such as n. The value is 0, 1, 2, ... 15, and the following conditions are used by Tolerance. In the UE comparison process, as long as the PDCP COUNT value deviation between the eNB side and the UE side is greater than Tolerance, it is considered to be asynchronous. Otherwise, Think it is synchronous.

(b) The eNB only transmits the PDCP COUNT MSB value during the periodic local authentication process. In order to avoid false detection due to the aforementioned delay or other problems during the comparison process, the allowed offset value 1 is verified, ie Tolerance is equal to 1 (ie The value of n is 0, and the default configuration of Tolerance is 1). In the comparison process of the UE, as long as the deviation of the PDCP COUNT MSB value between the eNB side and the UE side is less than or equal to 1, it is considered to be synchronous, otherwise it is considered to be asynchronous.

(c) In order to reduce the signaling load, the eNB may only transmit the LSB (Least Significant Bits) part of the PDCP COUNT during the periodic local authentication process, that is, select the LSB carrying only the PDCP COUNT in the counter check message. In part, the LSB ranges from 1 bit to 32 bits, for example, the LSB can take 7 bits or 12 bits. In the comparison judgment, the UE also uses the LSB part of the PDCP COUNT carried by the UE side. In the comparison process of the UE, the value deviation of the PDCP COUNT LSB part of the eNB side and the UE side is greater than Tolerance, and is considered to be asynchronous, otherwise it is considered to be synchronous. of.

Further, in the above embodiments (a), (b), (c), comparing PDCP COU T In the case of the uplink count in the same bearer, that is, PDCP uplink COUNT (upstream packet data convergence protocol counter), different decision methods are used. For the uplink, because the sender is in the UE, in some cases, the UE can explicitly detect whether an attacker has blocked illegal data on a certain bearer, that is, if the PDCP uplink COUNT value on the UE is greater than or equal to the PDCP uplink in the signaling. COUNT (ie PDCP uplink COUNT on the eNB), which may be due to signaling or other delays; but if the PDCP uplink COUNT value on the UE is less than the PDCP uplink COUNT in the signaling, the base station has received an illegal packet. That is, if an illegal intruder imposes illegal data on the bearer, the UE needs to report the eNB. For the downlink count, that is, the PDCP downlink COUNT value, it is considered to be synchronous as long as the deviation between the PDCP downlink COUNT value on the UE and the PDCP downlink COUNT in the signaling (ie, the PDCP downlink COUNT on the eNB) is less than or equal to the allowed offset value. .

Further, in the above embodiments (a), (b), (c), the tolerance value Tolerance allowed in the verification process may be selected not to be carried by the counter check message, but may be configured by a fixed configuration or by other means, for example The signaling load is reduced by UE-specific signaling or system information broadcasting.

Method Two:

When the eNB initiates a counter check, the message includes only one PDCP COUNT MSB information of the bearer that triggers the message (ie, only PDCP downlink COUNT or only PDCP uplink COUNT value), and only the PDCP of the bearer is verified after receiving the UE. COUNT MSB information, the tolerance value is 0 at this time. If it is not synchronized, the PDCP COUNT value of the bearer is included in the counter check reply message. Other bearers are not of concern, which also ensures the reliability of the verification.

The invention will now be described in further detail by means of the drawings and embodiments.

Referring to FIG. 2, a specific embodiment 1 is described as follows:

201. When the most significant bit of the PDCP COUNT of one bearer in the UE transmission bearer changes, the eNB sends a counter check message to the UE, where the counter check message includes the PDCP COUNT value of each activated radio bearer, and the allowed in the verification. Deviation value Tolerance or the deviation The number of bits corresponding to the value n (for example, Tolerance can be 128, that is, n is 7 bits; or Tolerance takes 4096, that is, n is 12 bits).

202. The UE compares the PDCP COUNT value in the received counter check message with the PDCP COUNT value of the radio bearer saved by the UE side. If the PDCP COUNT value is not synchronized, the UE will include the non-synchronized bearer identity and the bearer PDCP COUNT value saved by the UE in the counter check reply message. See Figure 8 for the principle of judging whether or not to synchronize.

203. If the eNB receives a counter check reply message that does not contain any PDCP COUNT value, the process terminates; if the eNB receives a counter check reply message containing one or several PDCP COUNT values, the eNB may release the connection or report the difference. Serve the MME or O&M for subsequent transmission security analysis.

Referring to FIG. 3, the second embodiment is described as follows:

Step 301: When the most significant bit of the PDCP COUNT of the bearer in the UE transmission bearer changes, the eNB initiates a periodic local authentication process, and the eNB sends a counter check message to the UE, where the counter check message includes each activated radio bearer. The LSB part of the PDCP COUNT value (for example, the LSB is 7 bits or 12 bits), and the tolerance value Tolerance allowed in the verification or its corresponding bit number n (the Tolerance value should be smaller than the LSB, so the corresponding Tolerance can take values 32, that is, n is 5 bits; or Tolerance is 1024, that is, n is taken as 10 bits, or other suitable value).

Step 302: The UE compares the PDCP COUNT LSB value in the received counter check message with the value PDCP COUNT LSB of the radio bearer saved on the UE side. If the two are not synchronized, the UE will include the non-synchronized bearer ID and PDCP COUNT value in the counter check reply message. See Figure 9 for the principle of judging whether or not to synchronize.

Step 303: If the eNB receives a counter check reply message that does not contain any PDCP COUNT value, the process terminates. If the eNB receives a counter check reply message containing one or several PDCP COUNT values, the eNB may release the connection or report the difference to the serving MME or O&M for subsequent transmission security analysis. Referring to FIG. 4, the third embodiment is described as follows:

400, the local verification tolerance value Tolerance is configured by a fixed configuration, or by UE dedicated signaling or system information broadcast (Tolerance can take values of 64, 128, 256...4096, and the corresponding n value is 6, 7, 8, ...12).

401. When the most significant bit of the PDCP COUNT of one bearer in the UE transmission bearer changes, the eNB sends a counter check message to the UE, where the counter check message includes the PDCP COUNT value of each activated radio bearer.

402. The UE compares the PDCP COUNT value in the received counter check message with the counter value PDCP COUNT of the corresponding radio bearer saved by the UE side. If the two are not synchronized, the UE will include the non-synchronized bearer ID and PDCP COUNT value in the counter check reply message. See Figure 8 for the principle of judging whether or not to synchronize.

403. If the eNB receives a counter check response message that does not contain any PDCP COUNT value, the process terminates. If the eNB receives a counter check reply message containing one or several PDCP COUNT values, the eNB may release the connection or report the difference to the serving MME or O&M for subsequent transmission security analysis.

Referring to FIG. 5, the fourth embodiment is described as follows:

500, Local Verification Tolerance Value Tolerance is configured in a fixed configuration, or through UE-specific signaling or system information broadcast (Tolerance can be 64, 128, 256...4096).

501. When the most significant bit of the PDCP COUNT of one bearer in the UE transmission bearer changes, the eNB sends a counter check message to the UE, where the counter check message includes an LSB part (such as an LSB) of the PDCP COUNT value of each activated radio bearer. It is 7 bits or 12 bits).

502. The UE compares the received PDCP COUNT LSB value in the counter check message with the counter value PDCP COUNT LSB of the radio bearer stored on the UE side. If the two are not synchronized, the UE will include the non-synchronized bearer identifier and the PDCP COUNT value of the bearer in the counter check reply message. See Figure 9 for the principle of judging whether or not to synchronize.

503. If the eNB receives a counter check reply message that does not contain any PDCP COUNT value, the process terminates. If the eNB receives a count containing one or several PDCP COUNT values The device checks the reply message, and the eNB may release the connection or report the difference to the serving MME or O&M for subsequent transmission security analysis.

Referring to FIG. 6, the specific embodiment 5 is described as follows:

601. When the most significant bit of the PDCP COUNT of one bearer in the UE transmission bearer changes, the eNB sends a counter check message to the UE, where the counter check message includes the MSB part of the PDCP COUNT value of each activated radio bearer (the MSB may Take 20 bits, or 25 bits, or other values between 1 and 32 bits).

602. The UE compares the received PDCP COUNT MSB value in the counter check message with the PDCP COUNT MSB value of the radio bearer saved by the UE side. If the two are not synchronized, the UE will include the non-synchronized bearer ID and PDCP COUNT value in the counter check reply message. See Figure 10 for the principle of judging whether or not to synchronize. The specific process is as follows.

603. If the eNB receives a counter check response message that does not contain any PDCP COUNT value, the process terminates. If the eNB receives a counter check reply message containing one or several PDCP COUNT values, the eNB may release the connection or report the difference to the serving MME or O&M for subsequent transmission security analysis.

Referring to Figure 7, the specific embodiment 6 is described as follows:

701. When the most significant bit of the PDCP COUNT value (the PDCP downlink COUNT value or the PDCP uplink COUNT value) of the bearer in the UE transmission bearer changes, the eNB sends a counter check message to the UE, where the counter check message only includes the radio bearer. The MSB portion of the PDCP COUNT value (ie, with only the PDCP downlink COUNT or PDCP uplink COUNT value), the MSB may take 20 bits, or 25 bits, or other value between 1 and 32 bits.

702. The UE compares the PDCP COUNT MSB value in the received counter check message with the count value PDCP COUNT MSB of the radio bearer saved by the UE side. If not, the UE will include the PDCP COUNT value of the bearer in the counter check reply message. The principle for judging whether to synchronize is: If the counter checks the PDCP COUNT MSB value in the message (ie, the eNB side) (upstream or If the PDCP COUNT MSB value (upstream or downlink) saved on the UE side is equal, it is considered to be synchronous, otherwise it is considered to be asynchronous, that is, the offset value is 0 at this time.

703. If the eNB receives a counter check response message that does not contain any PDCP COUNT value, the process terminates. If the eNB receives a counter check reply message containing the PDCP COUNT value, the eNB may release the connection or report the difference to the serving MME or O&M for subsequent transmission security analysis.

Referring to FIG. 8, after the UE receives the counter check message, it is determined that the process of whether the PDCP COUNT is synchronized is as follows:

For each dedicated bearer to be compared by the UE,

1) If a bearer identifier is not established on the UE side in the list of the counter check message check, the bearer is considered to be asynchronous, and the bearer comparison ends.

2) If a bearer identifier does not appear in the list of counter check message checks, it is considered that the bearer is asynchronous, and the bearer comparison ends.

3) If the UE side downlink counts the PDCPdownlink COUNT _UE and the eNB side downlink count

The PDCPdownlink COUNT _eNB biases ', is equal to H (fixed configuration, or can be configured by system information broadcast or UE-specific signaling), the allowable deviation value Tolerance, namely:

I PDCPdownlinkCOU TuE - PDCPdownlinkCOU T _eNB I <= Tolerance , then the downlink count is considered to be synchronous.

Otherwise it is considered to be asynchronous, and the bearer comparison ends.

4) If the UE's row i number PDCPuplinkCOUNT is greater than or equal to the uplink PDCPuplmkCOUNT _{eNB on the} eNB side, and the deviation is less than or equal to the set (fixed configuration, or can be configured by system information broadcast or UE-specific signaling), the tolerance value Tolerance is:

0 <= PDCPuplinkCOU TuE - PDCPuplinkCOU T _eNB <= Tolerance is considered to be synchronous,

Otherwise, namely: up count PDCPuplinkCOUNT UE _UE side is smaller than the count up PDCuplinkCOUNT _{eNB eNB} side, or both the deviation is greater than the permissible deviation value setting Tolerance, ie:

PDCPuplinkCOU TuE - PDCPuplinkCOU T _eNB > Tolerance or

PDCPuplinkCOUNTuE - PDCPuplinkCOU T _eNB < 0

It is considered to be asynchronous, and the bearer comparison ends. Referring to FIG. 9, after the UE receives the counter check message, the process of determining whether the bearer counter low effective bit PDCP COUNT LSB is synchronized is as follows:

For each dedicated bearer to be compared by the UE,

3) If the downlink side of the UE downlink significant bits of the count PDCPdownlinkCOUNTLSB _UE and eNB side significant bits of the count is less than equal to the set PDCPdownlinkCOUNTLSB _eNB deviation (fixed configuration, or may be configured through system information broadcast or dedicated signaling UE) permitted deviation The value Tolerance, ie:

PDCPdownlinkCOUNTLSBuE― PDCPdownlinkCOUNTLSB _eNB \ <=

Tolerance, the downlink count is considered to be synchronous.

Otherwise it is considered to be asynchronous, and the bearer comparison ends.

4) If the uplink count low effective bit PDCPuplinkCOUNTLSBuE on the UE side is greater than or equal to the uplink count low on the eNB side, there is an i bit PDCPuplinkCOUNTLSB _eNB , and the deviation is less than or equal to the setting.

(Fixed configuration, or can be configured through system information broadcast or UE-specific signaling) H Tolerance, ie:

0 <= PDCPuplinkCOUNTLSBuE― PDCPuplinkCOUNTLSB _eNB <=

Tolerance Then think it is synchronous,

Otherwise, namely: the upstream side of the UE uplink significant bit of the count is less than the eNB side PDCPuplinkCOUNTLSBuE significant bit count PDCuplinkCOUNTLSB _eNB, or both the permissible deviation is greater than the set value deviation Tolerance, namely:

PDCPuplinkCOUNTLSBuE - PDCPuplinkCOUNTLSB _eNB > Tolerance or

PDCPuplinkCOUNTLSB _UE - PDCPuplinkCOUNTLSB _eNB < 0 is considered to be asynchronous, and the bearer comparison ends.

Referring to FIG. 10, after the UE receives the counter check message, it determines that the bearer counter has a high effective bit.

The process of synchronizing PDCP COUNT MSB is as follows:

For each dedicated bearer to be compared by the UE,

3) If the UE side downlink count high significant bit PDCPdownlink COUNTMSB _UE and the eNB side downlink count high significant bit PDCPdownlink COUNTMSB _eNB deviation is less than or equal to 1, ie: PDCPdownlinkCOUNTMSB _UE - PDCPdownlinkCOUNTMSB _eNB < = 1, then the downlink count is considered to be synchronous.

Otherwise it is considered to be asynchronous, and the bearer comparison ends.

4) If the uplink count high significant bit PDCPuplinkCOUNTMSBuE on the UE side is greater than or equal to the uplink count high significant bit PDCPuplinkCOUNTMSB _{eNB on the} eNB side, and the deviation is less than or equal to 1, that is:

0 <= PDCPuplinkCOUNTMSBuE― PDCPuplinkCOUNTMSB _eNB < = 1 is considered to be synchronous,

Otherwise, that is, the UE has a high row count, and the PDCPuplinkCOUNTMSB _{UE is} smaller than the eNB. The side of the upstream count is the high significant bit ^0^/ « 0 ^ 3⁄4»3⁄4^, or the deviation between the two is greater than 1, ie:

PDCPuplinkCOUNTMSBuE - PDCPuplinkCOUNTMSB _eNB > 1 or

PDCPuplinkCOUNTMSB _UE - PDCPuplinkCOUNTMSB _eNB < 0 is considered to be asynchronous, and the bearer comparison ends.

Finally, the above embodiments are merely illustrative of the invention and are not intended to limit the invention. Modifications or equivalents of the invention are intended to be included within the scope of the appended claims.

Industrial applicability

The invention improves the false detection which may occur in the verification process of the prior art, enhances the stability of the whole system, reduces the error handling of normal user communication, and can also reduce the system signaling through effective system configuration. Payload.

Claims

Claim

A local authentication method, characterized in that, in a periodic local authentication process, an evolved base station transmits a packet data convergence protocol counter value of a radio bearer to a terminal, and the terminal compares its own packet data convergence protocol counter value with the received value. The packet data convergence protocol counter value, if the deviation between the two exceeds the set deviation range, the terminal sends the packet data convergence protocol counter value of the radio bearer to the evolved base station.

2. The method according to claim 1, wherein the deviation between the two exceeds the set deviation range means that the absolute value of the difference is greater than a deviation value.

3. The method according to claim 2, wherein the deviation value is transmitted to the terminal by the evolved base station when transmitting the packet data convergence protocol counter value, or transmitted by terminal dedicated signaling or system information broadcast. Give the terminal, or a fixed configuration.

4. The method of claim 2, wherein the offset value is 2 to the power of n, and the value of n is any integer value from 0 to 15.

The method according to claim 1, wherein the transmitting, by the evolved base station, the packet data convergence protocol counter value of the radio bearer to the terminal refers to all bits or lowest of the packet data convergence protocol counter value of the radio bearer. The valid bit portion is sent to the terminal, and when the terminal compares, the corresponding bit or the least significant bit portion of the own packet data convergence protocol counter value is used for comparison.

The method according to claim 5, wherein the least significant bit portion has a bit number of any one of 1 to 32.

The method according to claim 1 or 2 or 5, wherein the packet data convergence protocol counter value comprises an uplink packet data convergence protocol counter value, and if the terminal compares, if the terminal owns uplink packet data The convergence protocol counter value is smaller than the received uplink packet data convergence protocol counter value, and the terminal sends the packet data convergence protocol counter value of the radio bearer to the evolved base station.

The method according to claim 2, wherein the transmitting, by the evolved base station, the value of the packet data convergence protocol counter of the radio bearer to the terminal means that the packet data of the radio bearer is aggregated to the most significant part of the protocol counter value. Sended to the terminal, when the terminal compares, corresponding The comparison is performed using the most significant bit portion of its own packet data convergence protocol counter value, which is one.

9. The method of any of claims 1 or 2 or 5 wherein the wireless bearer is all active radio bearers.

The method according to claim 1 or 2, wherein in the periodic local authentication process, the evolved base station only transmits an uplink or downlink packet data convergence protocol of the radio bearer that triggers the periodic local authentication process. The high significant bit portion of the counter value is transmitted to the terminal, the offset range being zero.

The method according to claim 1, wherein in the periodic local authentication process, the evolved base station sends a counter check message to the terminal, and the counter check message carries the packet data convergence protocol counter value; When the terminal compares, if the bearer identifier carried in the counter check message is not established locally, or the bearer identifier of the radio bearer of the terminal is not in the counter check message, the radio bearer is asynchronous. .