[go: up one dir, main page]

WO2017117721A1 - 移动通信方法、装置及设备 - Google Patents

移动通信方法、装置及设备 Download PDF

Info

Publication number
WO2017117721A1
WO2017117721A1 PCT/CN2016/070182 CN2016070182W WO2017117721A1 WO 2017117721 A1 WO2017117721 A1 WO 2017117721A1 CN 2016070182 W CN2016070182 W CN 2016070182W WO 2017117721 A1 WO2017117721 A1 WO 2017117721A1
Authority
WO
WIPO (PCT)
Prior art keywords
mme
nas
message
security mode
capability
Prior art date
Application number
PCT/CN2016/070182
Other languages
English (en)
French (fr)
Inventor
陈璟
李琪
舒林
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Priority to EP20192538.5A priority Critical patent/EP3800914B1/en
Priority to CN201680077927.2A priority patent/CN108702624B/zh
Priority to PCT/CN2016/070182 priority patent/WO2017117721A1/zh
Priority to CN202110217166.9A priority patent/CN113271594A/zh
Priority to CN202110217266.1A priority patent/CN113271595B/zh
Priority to CN201910127640.1A priority patent/CN109729096B/zh
Priority to KR1020187022094A priority patent/KR102125826B1/ko
Priority to RU2018128207A priority patent/RU2706173C1/ru
Priority to JP2018553275A priority patent/JP6598225B2/ja
Priority to BR112018013812-6A priority patent/BR112018013812B1/pt
Priority to EP21163083.5A priority patent/EP3873122A1/en
Priority to CN202110217137.2A priority patent/CN113055888B/zh
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP16882868.9A priority patent/EP3393159B1/en
Publication of WO2017117721A1 publication Critical patent/WO2017117721A1/zh
Priority to US16/026,777 priority patent/US10419938B2/en
Priority to US16/552,530 priority patent/US10944786B2/en
Priority to US17/138,498 priority patent/US11310266B2/en
Priority to US17/723,257 priority patent/US11736519B2/en
Priority to US18/355,671 priority patent/US12003533B2/en
Priority to US18/668,898 priority patent/US20240396934A1/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1466—Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1458—Denial of Service
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3236—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions
    • H04L9/3242—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/10—Integrity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/10—Integrity
    • H04W12/106—Packet or message integrity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/12—Detection or prevention of fraud
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/12—Detection or prevention of fraud
    • H04W12/125—Protection against power exhaustion attacks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W8/00—Network data management
    • H04W8/22—Processing or transfer of terminal data, e.g. status or physical capabilities
    • H04W8/24—Transfer of terminal data

Definitions

  • the present invention relates to mobile communication technologies, and in particular, to a mobile communication method, apparatus and device.
  • the user equipment transmits an attach request (Attach Request) message to the MME (Mobility Manage UE Entity) through an eNB (Evolved Node B).
  • the attach request message carries UE Capability information such as network capability and security capability, and the MME provides a service to the UE according to the capability of the received UE.
  • the attach request message has no integrity protection, for example, the attach request message in the scenario where the UE first registers the network has no integrity protection.
  • the attacker implements a man-in-the-middle attack and modifies the UE capability information sent by the UE to the MME, then The MME will provide services to the UE according to the modified UE capability information, which may result in the UE being unable to use certain services. For example, the attacker sets the voice domain priority and user usage in the UE capability information (Voice domain preference). And UE's usage setting), remove the Additional update type (SMS only) parameter, then the UE can only use the short message service, but can not use the voice call service.
  • VoIP domain preference Voice domain preference
  • UE's usage setting remove the Additional update type (SMS only) parameter
  • the embodiment of the invention provides a mobile communication method, device and device to ensure that the MME obtains correct UE capability information.
  • an embodiment of the present invention provides a mobile communication method, including:
  • the user equipment UE receives the non-access stratum NAS security mode command message from the mobility management entity MME, where the NAS security mode command message carries the first verification matching information for verifying the UE capability information that the MME has received. ;
  • the UE sends a NAS security mode complete message to the MME.
  • the first verification matching information is a first hash value of an attach request message that the MME has received before sending the NAS security mode command message to the UE, where the NAS security mode command message is further And including a hash algorithm used by the MME to perform hash calculation on the attached request message, an integrity algorithm used by the MME, a secret key identifier, and a first non-the NAS security mode command message.
  • Access layer message authentication code NAS-MAC Access layer message authentication code
  • the UE calculates a second NAS-MAC of the NAS security mode command message received by the UE;
  • the UE calculates a second hash value of the attach request message sent by the UE to the MME according to the hash algorithm.
  • the UE sends a NAS security mode complete message to the MME.
  • the NAS security mode command message further includes: a UE security capability returned by the MME;
  • the UE sends a NAS security mode complete message to the MME, including:
  • the second hash value is consistent with the first hash value
  • the second NAS-MAC is consistent with the first NAS-MAC
  • the UE security capability returned by the MME is sent to the UE
  • the UE security capability of the MME is consistent, and the UE sends a NAS security mode complete message to the MME.
  • the method further includes:
  • the UE sends a NAS security mode failure message to the MME;
  • the UE security capability returned by the MME is consistent with the security capability of the UE sent by the UE to the MME, and the second hash value is If the first hash value is inconsistent, the UE sends a NAS security mode to the MME.
  • the completion message, the NAS security mode completion message carries an attach request message.
  • the first verification matching information is a third hash value of the UE capability information that the MME has received
  • the NAS security mode command message further includes that the MME performs the UE capability information that has been received.
  • the UE calculates a fourth NAS-MAC of the NAS security mode command message received by the UE; the UE determines whether the fourth NAS-MAC is consistent with the third NAS-MAC;
  • the UE calculates a fourth hash value of the UE capability information sent by the UE to the MME according to the hash algorithm.
  • the UE sends a NAS security mode complete message to the MME.
  • the NAS security mode command message further includes: a UE security capability returned by the MME;
  • the UE sends a NAS security mode complete message to the MME, including:
  • the fourth NAS-MAC is consistent with the third NAS-MAC, and the UE security capability returned by the MME is sent by the UE to The UE security capability of the MME is consistent, and the UE sends a NAS security mode complete message to the MME.
  • the method further includes:
  • the UE sends a NAS security mode failure message to the MME;
  • the fourth NAS-MAC is consistent with the third NAS-MAC
  • the UE security capability returned by the MME is consistent with the security capability of the UE sent by the UE to the MME
  • the fourth hash value is If the third hash value is inconsistent, the UE sends a NAS security mode to the MME.
  • the completion message, the NAS security mode completion message carries UE capability information.
  • the first verification matching information is UE capability information that the MME has received
  • the NAS security mode command message further includes an integrity algorithm, a secret key identifier, and the NAS security adopted by the MME.
  • the UE calculates a sixth NAS-MAC of the NAS security mode command message received by the UE;
  • the UE sends a NAS security mode complete message to the MME.
  • the UE determines whether the sixth NAS-MAC is consistent with the fifth NAS-MAC
  • the UE determines whether the security capability of the UE included in the UE capability information that the MME has received is consistent with the security capability of the UE sent by the UE to the MME;
  • the UE determines whether the other capabilities of the UE capability information, other than the UE security capability, are consistent with the MME sent by the UE;
  • the UE sends a NAS security mode complete message to the MME.
  • the method further includes:
  • the UE sends a NAS security mode complete message to the MME.
  • the NAS security mode completion message carries UE capability information.
  • the NAS security mode command message includes: a UE security capability received by the MME, an integrity algorithm used by the MME, a secret key identifier, and a seventh NAS-MAC of the NAS security mode command message. ;
  • the UE calculates an eighth NAS-MAC of the NAS security mode command message received by the UE;
  • the UE determines whether the security capability of the UE received by the MME is consistent with the security capability of the UE sent by the UE to the MME.
  • the UE sends a NAS security mode complete message to the MME, where the NAS security mode complete message carries the second authentication match information and the NAS-MAC of the NAS security mode complete message.
  • the second verification matching information includes:
  • the second verification matching information includes: UE capability information of the UE.
  • the method further includes:
  • the UE Receiving, by the UE, a downlink NAS transmission message that is sent by the MME, where the downlink NAS transmission message carries a UE capability information request message or a request message requesting the UE to resend an attach request message;
  • the UE sends an uplink information transmission message to the MME, where the uplink information transmission message carries the UE capability information or an attach request message.
  • the method further includes:
  • UE information request message carries a UE capability information request message or a request message requesting the UE to resend an attach request message
  • the UE sends a UE information response message to the MME, where the UE information response message carries a UE capability information or an attach request message.
  • an embodiment of the present invention provides a mobile communication method, including:
  • the MME sends a NAS security mode command message to the UE, where the NAS security mode command message carries the first verification matching information, and the UE determines, according to the first verification matching information, the UE capability information that the MME has received. Whether the UE capability information sent by the UE to the MME is consistent; if they are consistent, the UE sends a NAS security mode complete message to the MME.
  • the first verification matching information is a first hash value of an attach request message that the MME has received
  • the NAS security mode command message further includes the attach request that the MME has received.
  • the hash algorithm used by the message for hash calculation, and the MME adopts The integrity algorithm, the secret key identifier, and the first non-access stratum message authentication NAS-MAC of the NAS security mode command message.
  • the NAS security mode command message further includes: a UE security capability that the MME has received.
  • the method further includes:
  • the second NAS-MAC of the NAS security mode command message generated by the UE is consistent with the first NAS-MAC, the UE security capability returned by the MME, and the UE security sent by the UE to the MME
  • the MME receives a NAS security mode complete message sent by the UE, where the NAS security mode is completed.
  • the message carries an attach request message.
  • the first verification matching information is a third hash value of the UE capability information that the MME has received
  • the NAS security mode command message further includes that the MME performs the UE capability information that has been received.
  • the NAS security mode command message further includes: a UE security capability that the MME has received.
  • the method further includes:
  • the fourth NAS-MAC of the NAS security mode command message generated by the UE is consistent with the third NAS-MAC, the UE security capability returned by the MME, and the UE security sent by the UE to the MME
  • the MME receives the NAS security mode complete message sent by the UE, and the NAS security mode complete message The UE carries the capability information.
  • the first verification matching information is UE capability information that the MME has received
  • the NAS security mode command message further includes an integrity algorithm, a secret key identifier, and the NAS security adopted by the MME.
  • the fifth NAS-MAC of the mode command message is UE capability information that the MME has received
  • the NAS security mode command message further includes an integrity algorithm, a secret key identifier, and the NAS security adopted by the MME.
  • the method further includes:
  • the MME receives the NAS security mode complete message sent by the UE, where the NAS security mode complete message carries the UE capability information.
  • the NAS security mode command message includes: a UE security capability received by the MME, an integrity algorithm used by the MME, a secret key identifier, and a seventh NAS of the NAS security mode command message. -MAC.
  • the method further includes:
  • the MME receives the NAS security mode complete message sent by the UE, where the NAS security mode complete message carries the second authentication match information and the NAS-MAC of the NAS security mode complete message;
  • the second verification matching information includes:
  • the second verification matching information includes: UE capability information of the UE.
  • the method further includes:
  • the MME determines that the UE capability information that the MME has received is inconsistent with that sent by the UE, the MME sends a downlink NAS transmission message to the UE, where the downlink NAS transmission message carries UE capability information. Requesting a message or requesting the UE to resend the request message of the attach request message;
  • the MME receives an uplink information transmission message sent by the UE, where the uplink information transmission message carries the UE capability information or an attach request message.
  • the method further includes:
  • the MME determines that the UE capability information that the MME has received is inconsistent with that sent by the UE, the MME sends a UE information request message to the UE, where the UE information request message carries a UE capability information request. a message or a request message requesting the UE to resend an attach request message;
  • the MME receives the UE information response message sent by the UE, where the UE information response message carries the UE capability information or the attach request message.
  • an embodiment of the present invention provides a mobile communication device, where the device is deployed in a UE, including:
  • a receiving module configured to receive a non-access stratum NAS security mode from a mobility management entity MME a command message, where the NAS security mode command message carries first verification matching information for verifying UE capability information that the MME has received;
  • a verification module configured to determine, according to the first verification matching information, whether the UE capability information that the MME has received is consistent with the UE capability information sent by the UE to the MME;
  • the first sending module is configured to send a NAS security mode complete message to the MME when the UE capability information that the MME has received is consistent with the UE capability information sent by the UE to the MME.
  • the first verification matching information is a first hash value of an attach request message that the MME has received before sending the NAS security mode command message to the UE, where the NAS security mode command message is further And including a hash algorithm used by the MME to perform hash calculation on the attached request message, an integrity algorithm used by the MME, a secret key identifier, and a first non-the NAS security mode command message.
  • Access layer message authentication code NAS-MAC Access layer message authentication code
  • the verification module is specifically configured to:
  • the first sending module is configured to send the NAS to the MME when the two hash values are consistent with the first hash value and the second NAS-MAC is consistent with the first NAS-MAC. Safe mode completion message.
  • the NAS security mode command message further includes: a UE security capability returned by the MME;
  • the verification module is further configured to:
  • the first sending module is specifically configured to:
  • the second hash value is consistent with the first hash value
  • the second NAS-MAC is consistent with the first NAS-MAC
  • the UE security capability returned by the MME is sent to the UE
  • the security capabilities of the MME are the same, the NAS security mode complete message is sent to the MME.
  • the first sending module is further configured to:
  • the method is further configured to: if the second NAS-MAC is consistent with the first NAS-MAC, the security capability of the UE returned by the MME is consistent with the security capability of the UE sent by the UE to the MME, and the second If the hash value is inconsistent with the first hash value, the NAS security mode complete message is sent to the MME, where the NAS security mode complete message carries an attach request message.
  • the first verification matching information is a third hash value of the UE capability information that the MME has received
  • the NAS security mode command message further includes that the MME performs the UE capability information that has been received.
  • the verification module is specifically configured to:
  • the fourth hash value of the UE capability information sent by the UE to the MME is calculated according to the hash algorithm
  • the first sending module is specifically configured to: if the packets are consistent, the UE sends a NAS security mode complete message to the MME.
  • the NAS security mode command message further includes: a UE security capability returned by the MME;
  • the verification module is further configured to:
  • the first sending module is specifically configured to:
  • the fourth hash value is consistent with the third hash value
  • the fourth NAS-MAC is consistent with the third NAS-MAC
  • the UE security capability returned by the MME is sent by the UE to If the security capabilities of the MME are the same, the NAS security mode complete message is sent to the MME.
  • the first sending module is further configured to:
  • the UE sends a NAS security mode failure message to the MME;
  • the first sending module is further configured to: if the fourth NAS-MAC is consistent with the third NAS-MAC, the UE security capability returned by the MME, and the UE security capability sent by the UE to the MME If the fourth hash value is inconsistent with the third hash value, the UE sends a NAS security mode complete message to the MME, where the NAS security mode complete message carries UE capability information.
  • the first verification matching information is UE capability information that the MME has received
  • the NAS security mode command message further includes an integrity algorithm, a secret key identifier, and the NAS security adopted by the MME.
  • the verification module is specifically configured to:
  • the first sending module is specifically configured to send a NAS security mode complete message to the MME if they are consistent.
  • the verification module is specifically configured to:
  • the UE determines whether the other capabilities of the UE capability information, other than the UE security capability, are consistent with the MME sent by the UE;
  • the first sending module is specifically configured to send a NAS security mode complete message to the MME if they are consistent.
  • the first sending module is further configured to:
  • the security mode complete message carries the UE capability information in the NAS security mode complete message.
  • the NAS security mode command message includes: a UE security capability received by the MME, an integrity algorithm used by the MME, a secret key identifier, and a seventh NAS-MAC of the NAS security mode command message. ;
  • the verification module is specifically configured to:
  • the first sending module is configured to send, to the MME, a NAS security mode complete message, where the NAS security mode complete message carries the second authentication match information and the NAS of the NAS security mode complete message.
  • the second verification matching information includes:
  • the second verification matching information includes: UE capability information of the UE.
  • the receiving module is further configured to: after the first sending module sends a NAS security mode complete message to the MME, receive a downlink NAS transport message sent by the MME, where the downlink NAS transport message carries the UE a capability information request message or a request message requesting the UE to resend an attach request message;
  • the first sending module is further configured to send an uplink information transmission message to the MME, where the uplink information transmission message carries the UE capability information or an attach request message.
  • the receiving module is further configured to:
  • the UE After the first sending module sends a NAS security mode complete message to the MME, the UE sends a UE information request message sent by the MME, where the UE information request message carries a UE capability information request message or requests the UE to resend an attach request. Request message of the message;
  • the first sending module is further configured to send a UE information response message to the MME, where the UE information response message carries a UE capability information or an attach request message.
  • an embodiment of the present invention provides a mobile communication device, where the device is deployed in an MME, and includes:
  • a second sending module configured to send a NAS security mode command message to the UE, where the NAS security mode command message carries the first verification matching information, where the UE determines, according to the first verification matching information, Whether the UE capability information that the MME has received is consistent with the UE capability information sent by the UE to the MME; if they are consistent, the UE sends a NAS security mode complete message to the MME.
  • the first verification matching information is a first hash value of an attach request message that the MME has received
  • the NAS security mode command message further includes the attach request that the MME has received.
  • the message performs a hash algorithm, a hash algorithm used by the MME, an integrity algorithm used by the MME, a secret key identifier, and a first non-access stratum message authentication NAS-MAC of the NAS security mode command message.
  • the NAS security mode command message further includes: a UE security capability that the MME has received.
  • the device further includes: a first receiving module, configured to:
  • the second NAS-MAC of the NAS security mode command generated by the UE is consistent with the first NAS-MAC, the UE security capability returned by the MME, and the UE security capability sent by the UE to the MME
  • the first verification matching information is a third hash value of the UE capability information that the MME has received
  • the NAS security mode command message further includes that the MME performs the UE capability information that has been received.
  • the NAS security mode command message further includes: a UE security capability that the MME has received.
  • the device further includes: a second receiving module, configured to:
  • the fourth NAS-MAC of the NAS security mode command message generated by the UE is consistent with the third NAS-MAC, the UE security capability returned by the MME, and the UE security sent by the UE to the MME Receiving a NAS security mode complete message sent by the UE when the fourth hash value of the UE capability information generated by the UE is inconsistent with the third hash value, where the NAS security mode complete message carries the UE Capability information.
  • the first verification matching information is UE capability information that the MME has received
  • the NAS security mode command message further includes an integrity algorithm, a secret key identifier, and the NAS security adopted by the MME.
  • the fifth NAS-MAC of the mode command message is UE capability information that the MME has received
  • the NAS security mode command message further includes an integrity algorithm, a secret key identifier, and the NAS security adopted by the MME.
  • the device further includes: a third receiving module, configured to:
  • the sixth NAS-MAC of the NAS security mode command message generated by the UE is consistent with the fifth NAS-MAC.
  • the UEs that are sent by the UE to the MME have the same security capability and the other capabilities of the UE that are determined by the MME to be received by the MME are other than the UE security capability, and the UE sends the MME to the MME.
  • the NAS security mode complete message sent by the UE is received, where the NAS security mode complete message carries the UE capability information.
  • the NAS security mode command message includes: a UE security capability received by the MME, an integrity algorithm used by the MME, a secret key identifier, and a seventh NAS of the NAS security mode command message. -MAC.
  • the device further includes: a fourth receiving module, configured to receive a NAS security mode complete message sent by the UE, where the NAS security mode complete message carries the second verification matching information, and the NAS security mode is completed.
  • a fourth receiving module configured to receive a NAS security mode complete message sent by the UE, where the NAS security mode complete message carries the second verification matching information, and the NAS security mode is completed.
  • the second verification matching information includes:
  • the second verification matching information includes: UE capability information of the UE.
  • the second sending module is further configured to: if the UE capability information that the MME has received is inconsistent with that sent by the UE, send a downlink NAS transmission message to the UE, where the downlink NAS is Transmitting a message that carries a UE capability information request message or requesting the UE to resend an attach request message;
  • the fourth receiving module is further configured to receive an uplink information transmission message sent by the UE, where the uplink information transmission message carries the UE capability information or an attach request message.
  • the second sending module is further configured to: if the MME determines that the UE capability information that the MME has received is inconsistent with that sent by the UE, send a UE information request message to the UE,
  • the UE information request message carries a UE capability information request message or a request message requesting the UE to resend an attach request message;
  • the fourth receiving module is further configured to receive a UE information response message sent by the UE, where the UE information response message carries a UE capability information or an attach request message.
  • an embodiment of the present invention provides a mobile communication device, where the device is deployed in a UE, including:
  • a communication interface a memory, a processor, and a communication bus, wherein the communication interface, the memory, and the processor communicate via the communication bus;
  • the memory is for storing a program
  • the processor is configured to execute the program stored by the memory; when the mobile communication device is running, the processor runs a program, the program comprising:
  • NAS security mode command message carries first verification matching information for verifying UE capability information that the MME has received;
  • NAS security mode complete message is sent to the MME.
  • an embodiment of the present invention provides a mobile communication device, where the device is deployed in an MME, and includes:
  • a communication interface a memory, a processor, and a communication bus, wherein the communication interface, the memory, and the processor communicate via the communication bus;
  • the memory is for storing a program
  • the processor is configured to execute the program stored by the memory; when the mobile communication device is running, the processor runs a program, the program comprising:
  • NAS security mode command message carries the first verification matching information
  • the UE determines, according to the first verification matching information, whether the UE capability information that the MME has received is And the UE capability information sent by the UE to the MME is consistent; if they are consistent, the UE sends a NAS security mode complete message to the MME.
  • the UE verifies, according to the received first verification matching message, whether the UE capability information that the MME has received is consistent with the capability information of the UE that is sent by the UE to the MME, and the MME returns the verification matching message in the embodiment of the present invention.
  • the method of verifying the UE capability information received by the MME ensures that the MME has the correct UE capability information, and the Attach Request message in the Attach process does not have the NAS security context protection, and the attacker may modify the UE capability. Information, the MME cannot obtain the correct UE capability and the DoS attack problem.
  • DoS is the abbreviation of Denial of Service, that is, denial of service, causing DoS attacks to be called DoS attacks.
  • FIG. 1 is a flow chart showing a mobile communication method according to an embodiment of the present invention.
  • FIG. 2 is a flowchart of a mobile communication method according to Embodiment 2 of the present invention.
  • FIG. 3 is a flowchart of a third mobile communication method according to Embodiment 3 of the present invention.
  • FIG. 4 is a flow chart showing a method for mobile communication according to Embodiment 4 of the present invention.
  • FIG. 5 is a flowchart of a mobile communication method according to Embodiment 5 of the present invention.
  • FIG. 6 is a flow chart showing a sixth method of mobile communication according to Embodiment 6 of the present invention.
  • FIG. 7 is a flow chart showing a method for mobile communication according to Embodiment 7 of the present invention.
  • FIG. 8 is a flowchart of a mobile communication method according to Embodiment 8 of the present invention.
  • FIG. 9 is a flowchart showing a mobile communication method according to Embodiment 9 of the present invention.
  • FIG. 10 is a flowchart showing a ten mobile communication method according to an embodiment of the present invention.
  • FIG. 11 is a flowchart showing a mobile communication method according to Embodiment 11 of the present invention.
  • FIG. 12 is a flowchart showing a mobile communication method according to Embodiment 12 of the present invention.
  • FIG. 13 is a flowchart showing a mobile communication method according to Embodiment 15 of the present invention.
  • FIG. 14 is a flowchart showing a mobile communication method according to Embodiment 16 of the present invention.
  • FIG. 15 is a schematic structural diagram of a mobile communication apparatus according to Embodiment 1 of the present invention.
  • FIG. 16 is a schematic structural diagram of a mobile communication apparatus according to Embodiment 2 of the present invention.
  • FIG. 17 is a schematic structural diagram of a mobile communication device according to Embodiment 1 of the present invention.
  • FIG. 18 is a schematic structural diagram of a mobile communication device according to Embodiment 2 of the present invention.
  • FIG. 1 is a flow chart showing a mobile communication method according to an embodiment of the present invention. As shown in FIG. 1, the main processing steps of Embodiment 1 of the present invention include:
  • Step S11 The UE receives a NAS (Non-Access Stratum) security mode command (NAS Security Mode Command) message from the MME, where the NAS security mode command message carries the UE capability for the MME.
  • the first verification match information for which the information is verified.
  • the UE sends an attach request (Attach Request) message to the MME by using the eNB, where the attach request message carries UE Capability information.
  • the specific UE capability information includes: UE network capability, and the UE network capability is the UE security capability and the mobile network capability (MS network capability, where the English of the MS is the mobile station and the Chinese name is the mobile station). , Mobile station class 2, Mobile station class 3, Supported Codecs, Additional update type, voice domain priority, and user usage settings (Voice domain preference and UE's usage setting), mobile network function support (MS network feature support).
  • the attach request message sent by the UE to the MME may not have integrity protection, and thus may be attacked by a man-in-the-middle, so that the UE capability information in the attach request message received by the MME is inconsistent with that sent by the UE to the MME, so that the MME cannot obtain the MME. Correct UE capability information.
  • the MME sends the first authentication matching information to the UE through the NAS security mode command message during the NAS security activation process, and the UE determines, according to the first verification matching information, the UE capability that the MME has received. Whether the information is consistent with that sent by the UE.
  • Step S12 The UE determines, according to the first verification matching information, whether the UE capability information that the MME has received is consistent with the UE capability information sent by the UE to the MME.
  • Step S13 If they are consistent, the UE sends a NAS security mode complete message to the MME.
  • the UE verifies, according to the received first verification matching message, whether the UE capability information that the MME has received is consistent with the capability information of the UE that is sent by the UE to the MME, and the MME returns the verification matching message in the embodiment of the present invention.
  • the method of verifying the UE capability information received by the MME ensures that the MME has the correct UE capability information, and the Attach Request message in the Attach process does not have the NAS security context protection, and the attacker may modify the UE capability.
  • the information that the MME cannot obtain the correct UE capability causes the DoS attack problem.
  • the DoS is the abbreviation of the Denial of Service, that is, the denial of service, and the DoS attack behavior is called a DoS attack.
  • the first verification matching information may have multiple different implementation manners, which will be described below in conjunction with specific embodiments.
  • an MME performs a hash calculation on a received attach request message to obtain a hash value of an attach request message, and uses a NAS security mode command message to
  • the hash value of the attach request message is sent to the UE to determine whether the UE capability information received by the MME is consistent with that sent by the UE to the MME by using the UE to verify the hash value of the attach request message, as shown in FIG.
  • the main processing steps include:
  • Step S21 The UE receives a NAS security mode command message from the MME.
  • the first authentication matching message carried in the NAS security mode command message is that the MME performs a hash calculation on the attach request message received in the attaching process to obtain a first hash value of the attach request message, where the NAS security mode command message further includes The hash algorithm (optional carrying) used by the MME to perform hash calculation on the already received attach request message, the integrity algorithm used by the MME, the key identifier, and the first NAS-MAC of the NAS security mode command message (Non - Access Stratum UEssage Authentication Code, where the first NAS-MAC is used to protect the integrity of the NAS security mode command message.
  • the NAS security mode command message may further include an encryption algorithm supported by the MME and the UE, optionally carrying an optional [IMEI (International Mobile Equipment Identity) request] and optional carrying. in idle mobile mapped security context [nONCE UE, nONCE MME], wherein, nONCE UE random number selected by the UE, nONCE MME means a random number selected MME.
  • IMEI International Mobile Equipment Identity
  • Step S22 The UE calculates a second NAS-MAC of the NAS security mode command message received by the UE.
  • the UE performs the integrity protection on the sent NAS security mode command message by using the MME, and calculates the NAS security mode command message received by the UE to obtain the second NAS-MAC.
  • the first NAS-MAC will be consistent with the second NAS-MAC.
  • Step S23 The UE determines whether the second NAS-MAC is consistent with the first NAS-MAC. If they are consistent, step S24 is performed. If not, step S27 is performed.
  • Step S24 The UE calculates a second hash value of the attach request message sent by the UE to the MME according to the hash algorithm.
  • the UE uses a hash algorithm to perform an attach request message sent by the UE to the MME in the attach procedure. Hash calculation, if the attach request message is not modified by the intermediary in the attach process, the second hash value calculated by the UE is consistent with the first hash value in the NAS security mode command message.
  • the hash value of the attach request message is carried in the NAS security mode command message, which can shorten the length of the attach request message and improve the information sending rate.
  • Step S25 The UE determines whether the second hash value is consistent with the first hash value. If they are consistent, step S26 is performed, otherwise step S27 is performed.
  • Step S26 The UE sends a NAS Security Mode Complete message to the MME.
  • the NAS security mode completion message may optionally carry [IMEI] and carry the NAS-MAC that secures the NAS security mode completion message.
  • Step S27 The UE sends a NAS Security Mode Reject message to the MME.
  • the UE verifies the integrity of the received NAS security mode command message and the hash value of the attach request message received by the MME, when the second hash value is consistent with the first hash value and the second
  • the UE determines that the NAS security mode command message received by the UE is not modified, and the attach request message received by the MME in the UE attach procedure is consistent with that sent by the UE to the MME, thereby ensuring that the MME receives the message.
  • the UE capability information in the attached attach request message is consistent with the UE capability information sent by the UE.
  • the UE verifies the UE capability received by the MME by verifying the hash value of the MME attachment request message, and ensures that the UE capability information received by the MME is correct UE capability information.
  • the first verification matching message may occupy an IE (Information Element) of the MME backhaul UE security capability in the existing specification, and may also use a new IE for transmission.
  • IE Information Element
  • FIG. 3 is a flowchart of a mobile communication method according to Embodiment 3 of the present invention.
  • the MME sends the received UE security capability and the hash value of the attach request message to the UE through the NAS security mode command message to pass the UE. Verification of the attachment request message hash value and the UE security capability, Determining whether the UE capability information received by the MME is consistent with that sent by the UE to the MME.
  • the main processing steps of the method include:
  • Step S31 The UE receives a NAS security mode command message from the MME.
  • the first authentication matching message carried by the NAS security mode command message is that the MME performs a hash calculation on the attach request message received in the attaching process to obtain a first hash value of the attach request message, where the NAS security mode command message further includes the MME.
  • the first NAS-MAC which identifies the first NAS-MAC of the NAS security mode command message, is used to protect the integrity of the NAS security mode command message.
  • the security mode command message may further include an encryption algorithm supported by the MME and the UE, and optionally may also include [IMEI (International Mobile Equipment Identity) request] and optionally carried [ NONCE UE , NONCE MME ], where the NONCE UE is a random number selected by the UE, and the NONCE MME is a random number selected by the MME.
  • IMEI International Mobile Equipment Identity
  • Step S32 The UE calculates a second NAS-MAC of the NAS security mode command message received by the UE.
  • the UE performs the integrity protection on the sent NAS security mode command message by using the MME, and calculates the NAS security mode command message received by the UE to obtain the second NAS-MAC.
  • the first NAS-MAC will be consistent with the second NAS-MAC.
  • Step S33 The UE determines whether the second NAS-MAC is consistent with the first NAS-MAC. If they are consistent, step S34 is performed. If not, step S36 is performed.
  • Step S34 The UE calculates a second hash value of the attach request message sent by the UE to the MME according to the hash algorithm, determines whether the second hash value is consistent with the first hash value, and whether the UE security capability returned by the MME is related to the UE.
  • the security capabilities of the UEs sent to the MME are the same. (The calculation of the hash value, the confirmation of the hash value, and the confirmation order of the UE security capabilities are not limited.) If both are consistent, step S35 is performed, otherwise step S36 is performed.
  • the UE uses a hash algorithm to perform an attach request message sent by the UE to the MME in the attach procedure. Hash calculation, if the attach request message is not modified by the intermediary in the attach process, the second hash value calculated by the UE is consistent with the first hash value in the NAS security mode command message.
  • the hash value of the attach request message is carried in the NAS security mode command message, which can shorten the length of the attach request message and improve the information sending rate.
  • Step S35 The UE sends a NAS security mode complete message to the MME.
  • the NAS security mode completion message may optionally carry [IMEI] and carry the NAS-MAC that secures the NAS security mode completion message.
  • Step S36 The UE sends a NAS security mode failure message to the MME.
  • the UE verifies the UE capability received by the MME by verifying the hash value of the attach request message received by the MME and the UE security capability, and ensures that the UE capability information received by the MME is the correct UE capability. information,
  • the first verification matching message can only be transmitted by using a new IE.
  • an MME sends a received UE security capability and a hash value of an attach request message to a UE through a NAS security mode command message to pass the UE.
  • a NAS security mode command message For the verification of the attachment request message hash value and the security capability of the UE, it is determined whether the UE capability information received by the MME is consistent with that sent by the UE to the MME.
  • the main processing steps of the method include:
  • Step S41 The UE receives the NAS security mode command message from the MME.
  • the first authentication matching message carried by the NAS security mode command message is that the MME performs a hash calculation on the attach request message received in the attaching process to obtain a first hash value of the attach request message, where the NAS security mode command message further includes the MME.
  • the UE security capability received in the attach procedure, the hash algorithm used by the MME to perform hash calculation on the already received attach request message (optional carrying), the integrity algorithm used by the MME, the secret key identifier, and the NAS security mode The first NAS-MAC of the command message, the first NAS-MAC is used to protect the integrity of the NAS security mode command message.
  • the security mode command message may further include an encryption algorithm supported by the MME and the UE, an optional [IMEI (International Mobile Equipment Identity) request], and an optional [NONCE UE , NONCE MME ], where the NONCE UE is a random number selected by the UE, and the NONCE MME refers to a random number selected by the MME.
  • IMEI International Mobile Equipment Identity
  • NONCE MME refers to a random number selected by the MME.
  • Step S42 The UE calculates the second of the NAS security mode command message received by the UE. NAS-MAC.
  • Step S43 The UE determines whether the second NAS-MAC is consistent with the first NAS-MAC. If they are consistent, step S44 is performed. If not, step S48 is performed.
  • Step S44 The UE determines whether the UE security capability returned by the MME is consistent with the security capability of the UE sent by the UE to the MME. If they are consistent, step S45 is performed; otherwise, step S48 is performed.
  • Step S45 The UE determines whether the second hash value is consistent with the first hash value. If yes, step S46 is performed. If not, step S47 is performed.
  • the calculation of the second hash value is the same as that of the foregoing embodiment, and details are not described herein again.
  • Step S46 The UE sends a NAS security mode complete message to the MME.
  • the NAS security mode completion message may optionally carry [IMEI] and carry the NAS-MAC that secures the NAS security mode completion message.
  • Step S47 The UE sends a NAS security mode complete message to the MME, where the message carries an attach request message or a UE capability.
  • the NAS security mode complete message sent in this step may optionally carry [IMEI] and carry the NAS-MAC that performs security protection on the NAS security mode complete message.
  • Step S48 The UE sends a NAS security mode failure message to the MME.
  • the NAS security context is actually established between the UE and the MME, so when the integrity verification of the hash value of the attach request message fails, The content of the Attach Request can be re-uploaded directly in the integrity-protected NAS Security Mode Complete message.
  • the third embodiment adopts the method: even if the UE security capabilities and the NAS-MAC are complete.
  • the NAS security context has been established between the UE and the MME. If the integrity verification of the hash value of the Attach Request message fails, the UE also sends a NAS Security Mode Reject message.
  • the first verification matching message can only be transmitted by using a new IE.
  • FIG. 5 is a flowchart of a mobile communication method according to Embodiment 5 of the present invention.
  • the MME performs hash calculation on the received UE capability information to obtain a hash value of the UE capability, and uses the NAS security mode command message to send the UE.
  • the hash value of the capability information is sent to the UE to determine whether the UE capability information received by the MME is consistent with that sent by the UE to the MME by using the UE to verify the UE capability hash value.
  • the main processing of the method is performed. The steps include:
  • Step S51 The UE receives a NAS security mode command message from the MME.
  • the first authentication matching message carried by the NAS security mode command message is a third hash value obtained by the MME for performing hash calculation on the UE capability information received in the attaching process, and the NAS security mode command message further includes the MME.
  • a hash algorithm (optional carrying) used for hashing the received UE capability information, an integrity algorithm supported by the MME and the UE, a secret key identifier, and a third NAS of the NAS security mode command message.
  • MAC Non-Access Stratum UEssage Authentication Code
  • the security mode command message may further include an encryption algorithm supported by the MME and the UE, an optional [IMEI (International Mobile Equipment Identity) request], and an optional [NONCE UE , NONCE MME ], where the NONCE UE is a random number selected by the UE, and the NONCE MME refers to a random number selected by the MME.
  • IMEI International Mobile Equipment Identity
  • NONCE MME refers to a random number selected by the MME.
  • Step S52 The UE calculates a fourth NAS-MAC of the NAS security mode command message received by the UE.
  • the UE uses the MME to perform integrity protection on the sent NAS security mode command message, and calculates the NAS security mode command message received by the UE to obtain a fourth NAS-MAC.
  • the third NAS-MAC will be consistent with the fourth NAS-MAC.
  • Step S53 The UE determines whether the fourth NAS-MAC is consistent with the third NAS-MAC. If yes, step S54 is performed. Otherwise, step S57 is performed.
  • Step S54 The UE calculates a fourth hash value of the UE capability information sent by the UE to the MME according to the hash algorithm.
  • the UE uses the hash algorithm to perform hash calculation on the UE capability information that the UE sends to the MME in the attach procedure. If the UE capability information in the UE capability information is not modified by the intermediary in the attach procedure, the UE calculates the fourth hash. The value will match the third hash value in the NAS security mode command message.
  • the hash value of the UE capability information is carried in the NAS security mode command message, which can shorten the capability information length of the UE and improve the information transmission rate.
  • Step S55 The UE determines whether the fourth hash value is consistent with the third hash value. If they are consistent, the step is executed. Step S56, otherwise step S57 is performed.
  • Step S56 The UE sends a NAS Security Mode Complete message to the MME.
  • the NAS security mode completion message may optionally carry [IMEI] and carry the NAS-MAC that secures the NAS security mode completion message.
  • Step S57 The UE sends a NAS Security Mode Reject message to the MME.
  • the UE verifies the integrity of the received NAS security mode command message and the hash value of the UE capability information received by the MME, when the fourth hash value is consistent with the third hash value and fourth.
  • the UE determines that the NAS security mode command message received by the UE is not modified, and the UE capability information received by the MME in the UE attach procedure is consistent with that sent by the UE to the MME, thereby ensuring that the MME receives the MME.
  • the obtained UE capability information is consistent with the UE capability information sent by the UE.
  • the hash value of the UE capability information and the integrity check of the NAS-MAC are at least one failure, it indicates that at least one of the UE capability information and the NAS security mode command received by the MME is modified by the attack, and the UE sends the MME to the MME.
  • NAS Security Mode Reject message When the hash value of the UE capability information and the integrity check of the NAS-MAC are at least one failure, it indicates that at least one of the UE capability information and the NAS security mode command received by the MME is modified by the attack, and the UE sends the MME to the MME.
  • the UE verifies the UE capability information received by the MME by verifying the hash value of the UE capability information of the MME, and ensures that the UE capability information received by the MME is the correct UE capability information.
  • the first verification matching message may occupy the IE of the MME backhaul UE security capability in the existing specification, or may use a new IE for transmission.
  • FIG. 6 is a flowchart of a mobile communication method according to Embodiment 6 of the present invention.
  • an MME sends a received UE security capability and a hash value of UE capability information to a UE through a NAS security mode command message to pass the UE.
  • the main processing steps of the method include:
  • Step S61 The UE receives the NAS security mode command message from the MME.
  • the first authentication matching message carried by the NAS security mode command message is a third hash value obtained by the MME for performing hash calculation on the UE capability information received in the attaching process, and the NAS security mode command message further includes the MME.
  • UE security energy received in the attach process The hash algorithm used by the MME to perform hash calculation on the received UE capability information (optional carrying), an integrity algorithm supported by the MME and the UE, the secret key identifier, and the NAS security mode command message
  • the third NAS-MAC is used to protect the integrity of the NAS security mode command message.
  • the security mode command message may further include an encryption algorithm supported by the MME and the UE, an optional [IMEI (International Mobile Equipment Identity) request], and an optional [NONCE UE , NONCE MME ], where the NONCE UE is a random number selected by the UE, and the NONCE MME refers to a random number selected by the MME.
  • IMEI International Mobile Equipment Identity
  • NONCE MME refers to a random number selected by the MME.
  • Step S62 The UE calculates a fourth NAS-MAC of the NAS security mode command message received by the UE.
  • the UE uses the MME to perform integrity protection on the sent NAS security mode command message, and calculates the NAS security mode command message received by the UE to obtain a fourth NAS-MAC.
  • the third NAS-MAC will be consistent with the fourth NAS-MAC.
  • Step S63 The UE determines whether the fourth NAS-MAC is consistent with the third NAS-MAC. If yes, step S64 is performed; otherwise, step S66 is performed.
  • Step S64 The UE calculates a fourth hash value of the UE capability information sent by the UE to the MME according to the hash algorithm, determines whether the fourth hash value is consistent with the third hash value, and whether the UE security capability returned by the MME is related to the UE.
  • the security capabilities of the UEs sent to the MME are the same (the calculation of the hash value, the confirmation of the hash value, and the confirmation order of the UE security capabilities are not specified). If they are all consistent, step S65 is performed, otherwise step S66 is performed.
  • Step S65 The UE sends a NAS security mode complete message to the MME.
  • the NAS security mode completion message may optionally carry [IMEI] and carry the NAS-MAC that secures the NAS security mode completion message.
  • Step S66 The UE sends a NAS security mode failure message to the MME.
  • the UE verifies the UE capability received by the MME by verifying the hash value of the MME's UE capability information and the UE security capability, and ensures that the UE capability information received by the MME is the correct UE capability information book.
  • the first verification matching message can only Use a new IE for transmission.
  • FIG. 7 is a flowchart of a mobile communication method according to Embodiment 7 of the present invention.
  • the MME sends the received UE security capability and the hash value of the UE capability information to the UE through the NAS security mode command message to pass the UE.
  • the main processing steps of the method include:
  • Step S71 The UE receives the NAS security mode command message from the MME.
  • the first authentication matching message carried by the NAS security mode command message is a third hash value obtained by the MME for performing hash calculation on the UE capability information received in the attaching process, and the NAS security mode command message further includes the MME.
  • a hash algorithm (optional carrying) used by the MME to perform hash calculation on the received UE capability information, an integrity algorithm supported by the MME and the UE, and a secret key
  • the third NAS-MAC which identifies the NAS security mode command message, is used to protect the integrity of the NAS security mode command message.
  • the security mode command message may further include an encryption algorithm supported by the MME and the UE, an optional [IMEI (International Mobile Equipment Identity) request], and an optional [NONCE UE , NONCE MME ].
  • IMEI International Mobile Equipment Identity
  • Step S72 The UE calculates a fourth NAS-MAC of the NAS security mode command message received by the UE.
  • Step S73 The UE determines whether the fourth NAS-MAC is consistent with the third NAS-MAC. If yes, step S74 is performed. Otherwise, step S78 is performed.
  • Step S74 The UE determines whether the UE security capability returned by the MME is consistent with the security capability of the UE sent by the UE to the MME. If they are consistent, step S75 is performed; otherwise, step S78 is performed.
  • Step S75 The UE determines whether the fourth hash value is consistent with the third hash value. If they are consistent, step S76 is performed. If not, step S77 is performed.
  • Step S76 The UE sends a NAS security mode complete message to the MME.
  • the NAS security mode completion message may optionally carry [IMEI] and carry the NAS-MAC that secures the NAS security mode completion message.
  • Step S77 The UE sends a NAS security mode complete message to the MME, where the message carries UE capability information.
  • the NAS security mode completion message sent in this step may optionally carry the [IMEI] and the NAS-MAC carrying the security protection for the NAS security mode completion message, in addition to the UE capability information.
  • Step S78 The UE sends a NAS security mode failure message to the MME.
  • the first verification matching message can only be transmitted by using a new IE.
  • FIG. 8 is a flowchart of a mobile communication method according to Embodiment 8 of the present invention.
  • the MME sends the UE capability information received in the attach procedure to the UE through the NAS security mode command message, so as to implement the UE capability by the UE. Verification of the information, as shown in Figure 8, the main processing steps of the method include:
  • Step S81 The UE receives the NAS security mode command message from the MME.
  • the first authentication matching message carried by the NAS security mode command message is the UE capability information that the MME has received in the attaching process, and the NAS security mode command message further includes an integrity algorithm and a secret key identifier supported by the MME and the UE. And the fifth NAS-MAC of the NAS security mode command message.
  • the security mode command message may further include an encryption algorithm supported by the MME and the UE, an optional [IMEI (International Mobile Equipment Identity) request], and an optional [NONCE UE , NONCE MME ], where the NONCE UE is a random number selected by the UE, and the NONCE MME refers to a random number selected by the MME.
  • IMEI International Mobile Equipment Identity
  • NONCE MME refers to a random number selected by the MME.
  • Step S82 The UE calculates a sixth NAS-MAC of the NAS security mode command message received by the UE.
  • Step S83 The UE determines whether the sixth NAS-MAC is consistent with the fifth NAS-MAC. If yes, step S84 is performed; otherwise, step S86 is performed.
  • Step S84 The UE determines whether the UE capability information that the MME has received is consistent with the UE capability information sent by the UE to the MME.
  • Step S85 If they are consistent, the UE sends a NAS security mode complete message to the MME.
  • the NAS security mode completion message may optionally carry [IMEI] and carry the NAS-MAC that secures the NAS security mode completion message.
  • Step S86 If the inconsistent UE sends a NAS Security Mode Reject message to the MME.
  • the first verification matching message may occupy the IE of the MME backhaul UE security capability in the existing specification, or may use a new IE for transmission, or the first verification match.
  • UE capabilities other than UE security capabilities in the message are transmitted using a new IE.
  • FIG. 9 is a flowchart of a mobile communication method according to Embodiment 9 of the present invention.
  • an MME sends UE capability information received in an attach procedure to a UE through a NAS security mode command message, to implement UE capability information by using the UE.
  • Verification as shown in Figure 9, the main processing steps of the method include:
  • Step S91 The UE receives the NAS security mode command message from the MME.
  • the first authentication matching message carried by the NAS security mode command message is the UE capability information that the MME has received in the attaching process, and the NAS security mode command message further includes an integrity algorithm and a secret key identifier supported by the MME and the UE. And the fifth NAS-MAC of the NAS security mode command message.
  • the security mode command message may further include an encryption algorithm supported by the MME and the UE, an optional [IMEI (International Mobile Equipment Identity) request], and an optional [NONCE UE , NONCE MME ], where the NONCE UE is a random number selected by the UE, and the NONCE MME refers to a random number selected by the MME.
  • IMEI International Mobile Equipment Identity
  • NONCE MME refers to a random number selected by the MME.
  • Step S92 The UE calculates a sixth NAS-MAC of the NAS security mode command message received by the UE.
  • Step S93 The UE determines whether the sixth NAS-MAC is consistent with the fifth NAS-MAC. If they are consistent, step S94 is performed, otherwise step S98 is performed.
  • Step S94 The UE determines whether the security capability of the UE included in the UE capability information returned by the MME is consistent with the security capability of the UE sent by the UE to the MME. If they are consistent, step S95 is performed; otherwise, step S98 is performed.
  • Step S95 The UE determines whether the capabilities of the UE capability information returned by the MME are the same as those of the UE to be sent to the MME respectively. If the process is consistent with the step S96, the process proceeds to step S97.
  • Step S96 The UE sends a NAS security mode complete message to the MME.
  • the NAS security mode completion message may optionally carry [IMEI] and carry the NAS-MAC that secures the NAS security mode completion message.
  • Step S97 The UE sends a NAS security mode complete message to the MME, where the NAS security mode complete message carries the UE capability.
  • the NAS security mode completion message sent in this step can be carried in addition to the UE capability information. [IMEI] and NAS-MAC carrying security protection for NAS security mode completion messages
  • Step S98 The UE sends a NAS Security Mode Reject message to the MME.
  • the first verification matching message may occupy the IE of the MME backhaul UE security capability in the existing specification, or may use a new IE for transmission, or the UE security capability in the first verification matching message.
  • the UE capabilities outside are transmitted using a new IE.
  • FIG. 10 is a flowchart of a tenth mobile communication method according to an embodiment of the present invention.
  • a UE sends a second verification matching message to an MME in a NAS security mode complete message.
  • the tenth embodiment of the present invention is shown in FIG.
  • the main processing steps of the method include:
  • Step S101 The MME receives a NAS (Non-Access Stratum) security mode complete (NAS Security Mode Complete) message from the UE, where the NAS security mode complete message carries the UE capability for the MME.
  • the second verification match information for which the information is verified.
  • Step S102 The MME determines, according to the second verification matching information, whether the UE capability information that the MME has received is consistent with the UE capability information sent by the UE to the MME.
  • the second verification matching information may have multiple different implementation manners, which will be described below in conjunction with specific embodiments.
  • FIG. 11 is a flowchart of a mobile communication method according to an eleventh embodiment of the present invention.
  • the MME sends the UE security capability information received in the attach procedure to the UE through the NAS security mode command message, as shown in FIG.
  • the main processing steps of the method in the eleventh embodiment of the present invention include:
  • Step S111 The UE receives a NAS security mode command message from the MME.
  • the NAS security mode command message carries the UE security capability that the MME has received in the attach procedure, the integrity algorithm used by the MME, and optionally the Hash algorithm, the secret key identifier, and the seventh NAS of the NAS security mode command message. -MAC.
  • the NAS security mode command message may further include an encryption algorithm supported by the MME and the UE, optionally carrying an [IMEI request], and optionally carrying [NONCE UE , NONCE MME ], where the NONCE UE is a UE.
  • the selected random number, NONCE MME refers to the random number selected by the MME.
  • Step S112 The UE calculates an eighth NAS-MAC of the NAS security mode command message received by the UE.
  • Step S113 The UE determines whether the eighth NAS-MAC is consistent with the seventh NAS-MAC. If yes, step S114 is performed; otherwise, step S116 is performed.
  • Step S114 The UE determines whether the UE security capability returned by the MME is consistent with the security capability of the UE sent by the UE to the MME.
  • Step S115 If the UE is consistent, the UE sends a NAS security mode complete message to the MME, where the NAS security mode complete message carries the second verification match information and the NAS security mode complete message for the MME to verify the received UE capability information.
  • NAS-MAC NAS-MAC
  • the second verification matching message is sent to the MME, and the MME may use the received second verification matching information to receive in the attaching process.
  • the UE capability information is verified to ensure that the MME obtains the correct UE capability information.
  • the second verification matching message sent by the UE to the MME may also be a hash value of the attach request message that the UE has sent to the MME in the attach procedure; or the UE capability information that the UE has sent to the MME in the attach procedure.
  • the NAS security mode completion message may optionally carry a hash algorithm (optional carrying) used by the UE, [IMEI], and a NAS-MAC carrying security protection for the NAS security mode completion message.
  • the MME After receiving the hash value of the attach request message sent by the UE or the hash value of the UE capability information, the MME performs a hash calculation on the attach request message or the UE capability information received in the attach process by using a hash algorithm, and uses the calculation The result determines whether the attach request message or UE capability received by the MME in the attach procedure is consistent with that sent by the UE.
  • the MME requests the UE to resend the UE capability information or the attached request content after the NAS is activated.
  • the specific implementation manner includes:
  • the MME sends a Downlink NAS Transport message to the eNB, where the downlink NAS transport message includes a UE Capability Request message or an Attach Request Contents Request message;
  • the eNB sends a downlink information transmission (Downlink Information Transfer) message to the UE, where the downlink information transmission message includes a UE Capability Request message or an Attach Request Contents Request message;
  • Downlink Information Transfer Downlink Information Transfer
  • the UE sends an uplink information transmission (Uplink Information Transfer) message to the eNB.
  • Uplink Information Transfer Contains UE capabilities or Attach request contents;
  • the eNB sends an Uplink NAS Transport message to the MME, including UE capabilities or Attach request contents;
  • the MME sends a UE Information Request (UE Information Request) message to the eNB, where the UE information request includes a UE Capability Request message or an Attach Request Contents Request message;
  • UE Information Request UE Information Request
  • the eNB sends a UE Information Request (UE InformationRequest) message to the UE;
  • the UE sends a UE Information Response (UE InformationResponse) message to the eNB, where the UE information response message carries the UE capability or the Attach request contents;
  • UE Information Response UE InformationResponse
  • the eNB sends a UE Information Response (UE InformationResponse) message to the MME, where the UE information response message carries the UE capabilities or the Attach request contents.
  • UE Information Response UE InformationResponse
  • Step S116 If not, the UE sends a NAS Security Mode Reject message to the MME.
  • FIG. 12 is a flowchart of a mobile communication method according to Embodiment 12 of the present invention.
  • the MME sends the UE security capability information received in the attach procedure to the UE through the NAS security mode command message, as shown in FIG.
  • the main processing steps of the twelfth embodiment of the present invention include:
  • Step S121 The UE receives a NAS security mode command message from the MME.
  • the NAS security mode command message carries the UE security capability that the MME has received in the attach procedure, an integrity algorithm supported by the MME and the UE, an optional Hash algorithm, a secret key identifier, and a NAS security mode command message.
  • the seventh NAS-MAC The seventh NAS-MAC.
  • the NAS security mode command message may further include an encryption algorithm supported by the MME and the UE, an optionally carried [IMEI request], and optionally carried [NONCEUE, NONCEMME].
  • Step S122 The UE calculates an eighth NAS-MAC of the NAS security mode command message received by the UE.
  • Step S123 The UE determines whether the eighth NAS-MAC is consistent with the seventh NAS-MAC, if one Then, step S124 is performed, otherwise, step S126 is performed.
  • Step S124 The UE determines whether the UE security capability returned by the MME is consistent with the security capability of the UE sent by the UE to the MME.
  • Step S125 If they are consistent, the UE sends a NAS security mode complete message to the MME, where the NAS security mode complete message carries the UE capability information and the NAS-MAC of the NAS security mode complete message.
  • the UE capability information is sent to the MME.
  • the NAS security mode completion message may optionally carry the [IMEI] and carry the NAS-MAC that secures the NAS security mode completion message, so that the UE capability information in the NAS security mode completion message is not modified, and the MME is guaranteed to be obtained. Correct UE capability information.
  • Step S126 If not, the UE sends a NAS Security Mode Reject message to the MME.
  • the UE capability information may be transmitted in the second verification matching information IE, but the MME directly saves the UE capability information, and does not verify whether the UE capability information and the UE capability in the attached request have been received again.
  • the information is the same.
  • the present invention also provides a thirteenth embodiment of the mobile communication method.
  • the main processing steps of the method include: the MME sends a NAS security mode command message to the UE, where the NAS security mode command message carries the first verification matching information, and is used by the UE. And determining, according to the first verification matching information, whether the UE capability information that the MME has received is consistent with the UE capability information that is sent by the UE to the MME; if they are consistent, the UE sends a NAS security mode completion message to the MME.
  • the first verification matching information is a first hash value of an attach request message that the MME has received
  • the NAS security mode command message further includes an attach that the MME has received.
  • the request message performs a hash algorithm (optional carrying) used for hash calculation, an integrity algorithm used by the MME, a secret key identifier, and a first non-access stratum message authentication NAS-MAC of the NAS security mode command message.
  • the method further includes:
  • the second NAS-MAC of the NAS security mode command message generated by the UE is consistent with the first NAS-MAC, and the security capability of the MME backhaul is the same as the security capability of the UE sent by the UE to the MME, and the second request of the UE is generated.
  • the MME receives the NAS security mode complete message sent by the UE, where the NAS security mode complete message carries an attach request message or UE capability.
  • the first verification matching information is a third hash value of the UE capability information that the MME has received
  • the NAS security mode command message further includes the UE that the MME has received.
  • the capability information is hash algorithm (optional carrying) used for hash calculation, the integrity algorithm used by the MME, the secret key identifier, and the third NAS-MAC of the NAS security mode command message.
  • the method further includes:
  • the fourth NAS-MAC generated by the UE is consistent with the third NAS-MAC, and the UE security capability of the MME backhaul is the same as the UE's security capability transmitted by the UE to the MME, and the fourth hash value and the third of the UE capability information generated by the UE are the third.
  • the MME receives the NAS security mode complete message sent by the UE, and the NAS security mode complete message carries the UE capability information.
  • the first verification matching information is UE capability information that the MME has received
  • the NAS security mode command message further includes an integrity algorithm, a secret key identifier, and a NAS adopted by the MME.
  • the fifth NAS-MAC of the security mode command message is UE capability information that the MME has received
  • the method further includes:
  • the UE's security capability in the UE capability information that the MME has received is consistent with the security capability of the UE that the UE sends to the MME and the UE capability information that the MME has received.
  • the UE sends a NAS security mode complete message to the MME, and the NAS security mode complete message carries the UE capability information.
  • the present invention further provides Embodiment 14 of the mobile communication method, and the main processing steps of the embodiment include:
  • the MME receives a NAS (Non-Access Stratum) security mode complete (NAS Security Mode Complete) message from the UE, where the NAS security mode complete message carries the UE capability for the MME that has been received.
  • the second verification match information for which the information is verified.
  • the MME determines, according to the second verification matching information, whether the UE capability information that the MME has received is consistent with the UE capability information sent by the UE to the MME.
  • the second verification matching information includes:
  • the hash value of the attach request message that the UE has sent to the MME or
  • the hash value of the UE capability information that the UE has sent to the MME is the hash value of the UE capability information that the UE has sent to the MME.
  • the second verification matching information includes: UE capability information that the UE has sent to the MME.
  • the method further includes:
  • the MME sends a downlink NAS transport message to the UE, where the downlink NAS transport message carries the UE capability information request message or the attach request content request message.
  • the MME receives the uplink information transmission message sent by the UE, where the uplink information transmission message carries the UE capability information or the attached request content.
  • the method further includes:
  • the MME sends a UE information request message to the UE, where the UE information request message carries the UE capability information request message or the attach request content request message.
  • the MME receives the UE information response message sent by the UE, and the UE information response message packet carries the UE capability information or the attached request content.
  • FIG. 13 is a flowchart of a mobile communication method according to Embodiment 15 of the present invention, in which a NAS security activation process (corresponding to step 7 in FIG. 13) is performed according to an existing method, and after the NAS security activation, the MME passes the downlink NAS.
  • the Downlink NAS Transport message requests the UE to re-upload the UE capabilities or the Attach request contents, and the UE uploads the UE capabilities or attaches the request content through the Up NAS Transport message. Attach request contents), so that the MME obtains the correct UE capabilities.
  • the execution process of this embodiment includes:
  • the UE in the RRC_IDLE (Radio Resource Control IDLE) state performs the attach procedure, firstly initiates a random access procedure, that is, sends a first random access message MSG1;
  • the eNB After detecting the MSG1 message, the eNB sends a random access response message, that is, an MSG2 message, to the UE.
  • the eNB sends an RRC Connection Setup message to the UE, including establishing an SRB1 (signaling radio bearer1) and radio resource configuration information.
  • SRB1 signaling radio bearer1
  • the UE After the completion of the SRB1 bearer and the radio resource configuration, the UE sends an RRC Connection Setup Complete message to the eNB, where the RRC update complete message includes an attach request message of the NAS layer.
  • the eNB selects the MME, and sends an initial UE message to the MME, where the initial UE message includes an attach request (Attach Request) message of the NAS layer;
  • the UE and the MME perform an AKA and NAS security activation process
  • the MME sends a Downlink NAS Transport message to the eNB, where the downlink NAS transport message includes a UE Capability Request message or an Attach Request Contents Request message;
  • the eNB sends a downlink information transmission (Downlink Information Transfer) message to the UE, where the downlink information transmission message includes a UE Capability Request message or an Attach Request Contents Request message;
  • Downlink Information Transfer Downlink Information Transfer
  • the UE sends an Uplink Information Transfer message to the eNB, including UE capabilities or Attach request contents.
  • the eNB sends an Up NAS Transport message to the MME, including UE capabilities or Attach request contents.
  • the MME sends an Initial Context Setup Request message to the eNB, requesting to establish a default bearer, where the initial context setup request message includes a NAS layer attach request (Attach Accept) and an Activate Default EPS Bearer Context Request (activate default).
  • the evolved packet core network bears the context request message, wherein the EPS is spelled Evolved Packet Core, and the Chinese name is the evolved packet core network;
  • the eNB After the eNB receives the initial context setup request message, if the initial context setup request message does not include the UE capability information, the eNB sends a UE Capability Enquiry message to the UE to query the UE capability.
  • the UE sends a UE Capability Information message to the eNB, and reports UE capability information.
  • the eNB sends a UE Capability Information Indication message to the MME, and updates the UE capability information of the MME.
  • the eNB sends a security mode command (Security Mode Command) message to the UE according to the security information supported by the UE in the initial context setting request (Initial Context Setup Request) message, and performs security activation;
  • a security mode command Security Mode Command
  • Initial context setting request Initial Context Setup Request
  • the UE sends a Security Mode Complete message to the eNB, indicating that the security activation is completed.
  • the eNB sends an RRC Connection Reconfiguration (RRC Connection Reconfiguration) message to the UE according to the ERAB (Evolved Radio Access Bearer) setup information in the Initial Context Setup Request message.
  • RRC Connection Reconfiguration RRC Connection Reconfiguration
  • ERAB Evolved Radio Access Bearer
  • Resource reconfiguration including reconfiguration of SRB1 and radio resource configuration, establishment of SRB2, DRB (Data Radio Bearer, data radio bearer) (including default bearer), etc.
  • the UE sends an RRC Connection Reconfiguration Complete message to the eNB, indicating that the resource configuration is complete.
  • the eNB sends an Initial Context Setup Response message to the MME, indicating that the UE context establishment is completed.
  • the UE sends an uplink information transmission (Uplink Information Transfer) message to the eNB, including the NAS layer Attach Complete and the Activate Default EPS Bearer Context Accept message.
  • Uplink Information Transfer Uplink Information Transfer
  • the eNB sends an Uplink NAS Transport message to the MME, including the NAS layer Attach Complete and the Activate Default EPS Bearer Context Accept message.
  • step 7 in the embodiment of the present invention corresponds to the NAS security activation process, and the improvement steps 8 to 11 of the embodiment of the present invention are executed after the NAS security activation process.
  • FIG. 14 is a flowchart of a mobile communication method according to Embodiment 16 of the present invention, in which a NAS security activation process (corresponding to step 7 in FIG. 14) is performed according to an existing method, and in the attach process, after the NAS security is activated,
  • the MME requests the UE to re-upload the UE capability information or the content in the attachment request by using the newly defined UE Information Request message. (Attach request contents), the UE uploads UE capabilities or Attach request contents through a UE Information Response message, so that the MME acquires the correct UE capability.
  • the execution process of this embodiment includes:
  • the UE in the RRC_IDLE (Radio Resource Control IDLE) state performs the attach procedure, firstly initiates a random access procedure, that is, sends a first random access message MSG1;
  • the eNB After detecting the MSG1 message, the eNB sends a random access response message, that is, an MSG2 message, to the UE.
  • the UE After receiving the random access response, the UE adjusts the uplink sending opportunity according to the TA (Timing Advance) of the MSG2, and sends an RRC Connection Request message to the eNB.
  • TA Timing Advance
  • the eNB sends an RRC Connection Setup message to the UE, including establishing an SRB1 (signaling radio bearer1) and radio resource configuration information.
  • SRB1 signaling radio bearer1
  • the UE After the completion of the SRB1 bearer and the radio resource configuration, the UE sends an RRC Connection Setup Complete message to the eNB, where the RRC update complete message includes an attach request message of the NAS layer.
  • the eNB selects the MME, and sends an initial UE message to the MME, where the initial UE message includes an attach request (Attach Request) message of the NAS layer;
  • the UE and the MME perform an AKA and NAS security activation process
  • the MME sends a UE Information Request (UE InformationRequest) message to the eNB.
  • UE InformationRequest UE InformationRequest
  • the eNB sends a UE Information Request (UE InformationRequest) message to the UE.
  • UE InformationRequest UE InformationRequest
  • the UE sends a UE Information Response (UE InformationResponse) message to the eNB, where the UE information response message carries the UE capability or the Attach request contents;
  • UE Information Response UE InformationResponse
  • the eNB sends a UE Information Response (UE InformationResponse) message to the MME, where the UE information response message carries the UE capability or the Attach request contents;
  • UE InformationResponse UE Information Response
  • the MME sends an Initial Context Setup Request to the eNB.
  • the message requesting to establish a default bearer wherein the initial context setup request message includes a NAS layer attach request (Attach Accept) and an Activate Default EPS Bearer Context Request message, where the EPS full spell is Evolved Packet Core, Chinese name is the evolved packet core network;
  • the eNB After the eNB receives the initial context setup request message, if the initial context setup request message does not include the UE capability information, the eNB sends a UE Capability Enquiry message to the UE to query the UE capability.
  • the UE sends a UE Capability Information message to the eNB, and reports UE capability information.
  • the eNB sends a UE Capability Information Indication message to the MME, and updates the UE capability information of the MME.
  • the eNB sends a security mode command (Security Mode Command) message to the UE according to the security information supported by the UE in the initial context setting request (Initial Context Setup Request) message, and performs security activation;
  • a security mode command Security Mode Command
  • Initial context setting request Initial Context Setup Request
  • the UE sends a Security Mode Complete message to the eNB, indicating that the security activation is completed.
  • the eNB sends an RRC Connection Reconfiguration (RRC Connection Reconfiguration) message to the UE according to the ERAB (Evolved Radio Access Bearer) setup information in the Initial Context Setup Request message.
  • RRC Connection Reconfiguration RRC Connection Reconfiguration
  • ERAB Evolved Radio Access Bearer
  • Resource reconfiguration including reconfiguration of SRB1 and radio resource configuration, establishment of SRB2, DRB (Data Radio Bearer, data radio bearer) (including default bearer), etc.
  • the UE sends an RRC Connection Reconfiguration Complete message to the eNB, indicating that the resource configuration is complete.
  • the eNB sends an Initial Context Setup Response message to the MME, indicating that the UE context establishment is completed.
  • the UE sends an uplink information transmission (Uplink Information Transfer) message to the eNB, including the NAS layer Attach Complete and the Activate Default EPS Bearer Context Accept message.
  • Uplink Information Transfer Uplink Information Transfer
  • the eNB sends an uplink NAS transport (Uplink NAS Transport) message to the MME, including the NAS layer attach complete (Attach Complete), and activates the default evolved packet core network bearer.
  • Uplink NAS Transport Uplink NAS Transport
  • Attach Complete the NAS layer attach complete
  • Attach Complete the default evolved packet core network bearer.
  • the following (Activate Default EPS Bearer Context Accept) message is accepted.
  • step 7 in the embodiment of the present invention corresponds to the NAS activation process, and the improvement steps 8 to 11 of the embodiment of the present invention are performed after the NAS activation process.
  • FIG. 15 is a schematic structural diagram of a mobile communication device according to an embodiment of the present invention.
  • the device is deployed in a UE, and includes: a receiving module 1201, a verification module 1202, and a first sending module 1203, where:
  • the receiving module 1201 is configured to receive a non-access stratum NAS security mode command message from the mobility management entity MME, where the NAS security mode command message carries first verification matching information for verifying the UE capability information that the MME has received;
  • the verification module 1202 is configured to determine, according to the first verification matching information, whether the UE capability information that the MME has received is consistent with the UE capability information that is sent by the UE to the MME.
  • the first sending module 1203 is configured to send a NAS security mode complete message to the MME when the UE capability information that the MME has received is consistent with the UE capability information sent by the UE to the MME.
  • the first verification matching information is a first hash value of an attach request message that the MME has received before sending the NAS security mode command message to the UE, and the NAS security mode command message further includes an attach that the MME has received.
  • the verification module 1202 is specifically configured to:
  • the first sending module 1203 is configured to send a NAS security mode complete message to the MME when the second hash value is consistent with the first hash value and the second NAS-MAC is consistent with the first NAS-MAC.
  • the NAS security mode command message further includes: a UE security capability returned by the MME;
  • the verification module 1202 is further configured to:
  • the first sending module 1203 is specifically configured to:
  • the second hash value is consistent with the first hash value
  • the second NAS-MAC is consistent with the first NAS-MAC
  • the UE security capability returned by the MME is consistent with the security capability of the UE sent by the UE to the MME
  • the NAS is sent to the MME. Safe mode completion message.
  • the first sending module 1203 is further configured to:
  • the method is further configured to: if the second NAS-MAC is consistent with the first NAS-MAC, and the UE security capability returned by the MME is consistent with the security capability of the UE sent by the UE to the MME, and the second hash value is inconsistent with the first hash value, Sending a NAS security mode complete message to the MME, where the NAS security mode complete message carries an attach request message.
  • the first verification matching information is a third hash value of the UE capability information that the MME has received
  • the NAS security mode command message further includes the MME adopting the hash calculation of the UE capability information that has been received.
  • the verification module 1202 is specifically configured to:
  • the fourth hash value of the UE capability information sent by the UE to the MME is calculated according to the hash algorithm
  • the first sending module 1203 is specifically configured to: if the packets are consistent, the UE sends a NAS security mode complete message to the MME.
  • the NAS security mode command message further includes: a UE security capability returned by the MME;
  • the verification module 1202 is further configured to:
  • the first sending module 1203 is specifically configured to:
  • the fourth hash value is consistent with the third hash value
  • the fourth NAS-MAC is consistent with the third NAS-MAC
  • the UE security capability returned by the MME is consistent with the security capability of the UE sent by the UE to the MME
  • the NAS is sent to the MME. Safe mode completion message.
  • the first sending module 1203 is further configured to:
  • the UE sends a NAS security mode failure message to the MME;
  • the first sending module 1203 is further configured to: if the fourth NAS-MAC is consistent with the third NAS-MAC, the UE security capability returned by the MME is consistent with the security capability of the UE sent by the UE to the MME, and the fourth hash value and the third hash are If the hash value is inconsistent, the UE sends a NAS security mode complete message to the MME, and the NAS security mode complete message carries the UE capability information.
  • the first verification matching information is the UE capability information that the MME has received
  • the NAS security mode command message further includes the integrity algorithm, the secret key identifier, and the fifth NAS of the NAS security mode command message adopted by the MME.
  • the verification module 1202 is specifically configured to:
  • the UE determines whether the sixth NAS-MAC is consistent with the fifth NAS-MAC
  • the first sending module 1203 is specifically configured to send a NAS security mode complete message to the MME if they are consistent.
  • the verification module 1202 is specifically configured to:
  • the UE determines whether the capabilities of the UE capability information received by the MME are identical to those of the UE that are sent to the MME.
  • the first sending module 1203 is specifically configured to send a NAS security mode complete message to the MME if they are consistent.
  • the first sending module 1203 is further configured to:
  • the MME has received the UE capability information other than the UE security capability and the UE sends the MME to the MME, the NAS security mode complete message is sent to the MME, and the NAS security mode complete message carries the UE capability information.
  • the NAS security mode command message includes: a UE security capability received by the MME, an integrity algorithm used by the MME, a secret key identifier, and a seventh NAS-MAC of the NAS security mode command message;
  • the verification module 1202 is specifically configured to:
  • the first sending module 1203 is configured to send a NAS security mode complete message to the MME if the data is consistent, and the NAS security mode complete message carries the second authentication match information and the NAS-MAC of the NAS security mode complete message.
  • the second verification matching information includes:
  • the hash value of the attach request message that the UE has sent to the MME or
  • the hash value of the UE capability information that the UE has sent to the MME is the hash value of the UE capability information that the UE has sent to the MME.
  • the second verification matching information includes: UE capability information of the UE.
  • the receiving module 1201 is further configured to: after the first sending module 1203 sends the NAS security mode complete message to the MME, receive the downlink NAS transport message sent by the MME, where the downlink NAS transport message carries the UE capability information request message or the request. The UE resends the request message of the attach request message;
  • the first sending module 1203 is further configured to send an uplink information transmission message to the MME, where the uplink information transmission message carries the UE capability information or the attach request message.
  • the receiving module 1201 is further configured to:
  • the first sending module 1203 After transmitting the NAS security mode complete message to the MME, the first sending module 1203 receives the UE information request message sent by the MME, where the UE information request message carries the UE capability information request message or the request message requesting the UE to resend the attach request message;
  • the first sending module 1203 is further configured to send a UE information response message to the MME, where the UE information response message carries the UE capability information or the attach request message.
  • FIG. 16 is a schematic structural diagram of a mobile communication apparatus according to Embodiment 2 of the present invention, where the apparatus is deployed in In the MME, including:
  • the second sending module 1301 is configured to send a NAS security mode command message to the UE, where the NAS security mode command message carries the first verification matching information, where the UE determines, according to the first verification matching information, whether the UE capability information that the MME has received is The UE capability information sent by the UE to the MME is consistent; if they are consistent, the UE sends a NAS security mode complete message to the MME.
  • the first verification matching information is a first hash value of the attach request message that the MME has received
  • the NAS security mode command message further includes the MME adopting the hash calculation for the already received attachment request message.
  • the NAS security mode command message further includes: the UE security capability that the MME has received.
  • the device further includes: a first receiving module 1302, configured to:
  • the second NAS-MAC of the NAS security mode command generated by the UE is consistent with the first NAS-MAC, and the UE security capability of the MME backhaul is the same as the security capability of the UE sent by the UE to the MME and the second request of the UE to generate the attach request message.
  • the NAS security mode complete message sent by the UE is received, where the NAS security mode complete message carries the attach request message.
  • the first verification matching information is a third hash value of the UE capability information that the MME has received
  • the NAS security mode command message further includes the MME adopting the hash calculation of the UE capability information that has been received.
  • the hash algorithm, the integrity algorithm used by the MME, the secret key identifier, and the third NAS-MAC of the NAS security mode command message is a third hash value of the UE capability information that the MME has received.
  • the NAS security mode command message further includes: the UE security capability that the MME has received.
  • the device further includes: a second receiving module 1303, configured to:
  • the fourth NAS-MAC of the NAS security mode command message generated by the UE is consistent with the third NAS-MAC, and the UE security capability returned by the MME is the same as the UE security capability sent by the UE to the MME, and the UE capability information generated by the UE is the fourth.
  • the NAS security mode completion message sent by the UE is received, and the NAS security mode completion message carries the UE capability information.
  • the first verification matching information is UE capability information that the MME has received
  • the NAS security mode command message further includes an integrity algorithm, a secret key identifier, and an MME.
  • the fifth NAS-MAC of the NAS security mode command message is UE capability information that the MME has received
  • the device further includes: a third receiving module 1304, configured to:
  • the sixth NAS-MAC of the NAS security mode command message generated by the UE is consistent with the fifth NAS-MAC, and the UE security capability included in the UE capability information that the MME has received is consistent with the security capability of the UE sent by the UE to the MME.
  • the UE determines that the UE capability information received by the MME is not the same as the UE security capability, and the UE security mode completion message is sent by the UE.
  • the NAS security mode completion message carries the UE capability information.
  • the NAS security mode command message includes: a UE security capability received by the MME, an integrity algorithm used by the MME, a secret key identifier, and a seventh NAS-MAC of the NAS security mode command message.
  • the apparatus further includes: a fourth receiving module 1305, configured to receive a NAS security mode completion message sent by the UE, and the NAS security mode completion message carries the second verification matching information and the NAS of the NAS security mode completion message.
  • a fourth receiving module 1305, configured to receive a NAS security mode completion message sent by the UE, and the NAS security mode completion message carries the second verification matching information and the NAS of the NAS security mode completion message.
  • the second verification matching information includes:
  • the hash value of the attach request message that the UE has sent to the MME or
  • the hash value of the UE capability information that the UE has sent to the MME is the hash value of the UE capability information that the UE has sent to the MME.
  • the second verification matching information includes: UE capability information of the UE.
  • the second sending module 1301 is further configured to: if the UE capability information that the MME has received is inconsistent with that sent by the UE, send a downlink NAS transmission message to the UE, where the downlink NAS transmission message carries the UE capability information request message. Or requesting the UE to resend the request message of the attach request message;
  • the fourth receiving module 1305 is further configured to receive an uplink information transmission message sent by the UE, where the uplink information transmission message carries the UE capability information or the attach request message.
  • the second sending module 1301 is further configured to: if the MME determines that the UE capability information that the MME has received is inconsistent with that sent by the UE, send a UE information request message to the UE, where the UE information request message carries the UE capability information request. a message or a request message requesting the UE to resend the attach request message;
  • the fourth receiving module 1305 is further configured to receive a UE information response message sent by the UE, where the UE information response message carries the UE capability information or the attach request message.
  • FIG. 17 is a schematic structural diagram of a mobile communication device according to an embodiment of the present invention.
  • the mobile communication device 1400 includes a communication interface 1401, a memory 1403, and a processor 1402.
  • the communication interface 1401, the processor 1402, the memory 1403, and the bus 1404 communicate with each other through the bus 1404.
  • the bus 1404 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus.
  • PCI peripheral component interconnect
  • EISA extended industry standard architecture
  • the bus can be divided into an address bus, a data bus, a control bus, and the like. For ease of representation, only one thick line is shown in Figure 14, but it does not mean that there is only one bus or one type of bus.
  • the communication interface 1401 is configured to communicate with a transmitting end.
  • the memory 1403 is configured to store a program.
  • the program can include program code, the program code including computer operating instructions.
  • the memory 1403 may include a random access memory (RAM), and may also include a non-volatile memory such as at least one disk storage.
  • the processor 1402 executes the program stored in the memory 1403 to implement the method of the foregoing method embodiment of the present invention:
  • NAS security mode command message carries first verification matching information for verifying UE capability information that the MME has received;
  • the UE sends a NAS security mode complete message to the MME.
  • the processor 1402 may be a general-purpose processor, including a central processing unit (CPU), a network processor (NP Processor, etc.), or a digital signal processor (DSP), an application specific integrated circuit. (ASIC), Field Programmable Gate Array (FPGA) or other programmable logic device, discrete gate or transistor logic device, discrete hardware component.
  • CPU central processing unit
  • NP Processor network processor
  • DSP digital signal processor
  • ASIC application specific integrated circuit
  • FPGA Field Programmable Gate Array
  • FIG. 18 is a schematic structural diagram of a mobile communication device according to Embodiment 2 of the present invention.
  • the mobile communication device 1500 includes a communication interface 1501, a memory 1503, and a processor 1502.
  • the communication interface 1501, the processor 1502, the memory 1503, and the bus 1504 communicate with each other.
  • the bus 1504 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus. Place
  • PCI peripheral component interconnect
  • EISA extended industry standard architecture
  • Place The bus can be divided into an address bus, a data bus, a control bus, and the like. For ease of representation, only one thick line is shown in Figure 15, but it does not mean that there is only one bus or one type of bus.
  • the communication interface 1501 is configured to communicate with a transmitting end.
  • the memory 1503 is configured to store a program.
  • the program can include program code, the program code including computer operating instructions.
  • the memory 1503 may include a random access memory (RAM), and may also include a non-volatile memory such as at least one disk storage.
  • the processor 1502 executes the program stored in the memory 1503 to implement the method of the foregoing method embodiment of the present invention:
  • NAS security mode command message carries the first verification matching information
  • the UE determines, according to the first verification matching information, that the MME has received Whether the UE capability information is consistent with the UE capability information sent by the UE to the MME; if they are consistent, the UE sends a NAS security mode complete message to the MME.
  • the processor 1502 may be a general-purpose processor, including a central processing unit (CPU), a network processor (NP Processor, etc.), or a digital signal processor (DSP), an application specific integrated circuit. (ASIC), Field Programmable Gate Array (FPGA) or other programmable logic device, discrete gate or transistor logic device, discrete hardware component.
  • CPU central processing unit
  • NP Processor network processor
  • DSP digital signal processor
  • ASIC application specific integrated circuit
  • FPGA Field Programmable Gate Array
  • the UE verifies, according to the received first verification matching message, whether the UE capability information that the MME has received is consistent with the capability information of the UE that is sent by the UE to the MME, and may be returned by the MME in the embodiment of the present invention.
  • Verifying the matching message the UE verifies the UE capability information received by the MME, and ensures that the MME has the correct UE capability information, and the Attach Request message in the Attach process is not protected by the NAS security context.
  • the attacker may To modify the UE capability information, the MME cannot obtain the correct UE capability and the DoS attack problem.
  • the DoS is the abbreviation of the Denial of Service, that is, the denial of service, and the DoS attack behavior is called a DoS attack.
  • the foregoing program may be stored in a computer readable storage medium, and the program is executed when executed.
  • the foregoing steps include the steps of the foregoing method embodiments; and the foregoing storage medium includes: a medium that can store program codes, such as a ROM, a RAM, a magnetic disk, or an optical disk.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Databases & Information Systems (AREA)
  • Power Engineering (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Telephone Function (AREA)

Abstract

本发明涉及移动通信技术，尤其涉及一种移动通信方法、装置及设备。其中，该方法包括：用户设备UE接收来自移动管理实体MME的非接入层NAS安全模式命令消息，所述NAS安全模式命令消息中携带用于对所述MME已经接收到的UE能力信息进行验证的第一验证匹配信息；所述UE根据所述第一验证匹配信息，确定所述MME已经接收到的UE能力信息是否与所述UE发送给所述MME的UE能力信息一致；若一致，则所述UE向所述MME发送NAS安全模式完成消息。本发明实施例的移动通信方法、装置及设备，能够确保MME获取正确的UE能力信息。

Description

移动通信方法、装置及设备 技术领域
本发明涉及移动通信技术，尤其涉及一种移动通信方法、装置及设备。
背景技术
移动通信的附着(Attach)流程中，UE(User Equipment，用户设备)通过eNB(Evolved Node B，演化基站)向MME(Mobility ManageUEnt Entity，移动管理实体)发送附着请求(Attach Request)消息，其中在附着请求消息中携带UE能力(UE Capability)信息如网络能力及安全能力等，MME根据接收到的UE的能力向UE提供服务。当附着请求消息没有完整性保护时，比如，UE第一次注册网络的场景下附着请求消息没有完整性保护，此时若攻击者实施中间人攻击，修改了UE发送给MME的UE能力信息，那么MME将会根据被修改之后的UE能力信息向UE提供服务，由此可能会导致UE无法使用某些业务，如，攻击者将UE能力信息中的语音域优先级和用户使用设置(Voice domain preference and UE‘s usage setting)去掉，添加仅使用短信服务(Additional update type-SMS only)参数，那么UE只能使用短消息业务，而不能使用语音通话业务。
发明内容
本发明实施例提供了一种移动通信方法、装置及设备，确保MME获取正确的UE能力信息。
第一方面，本发明实施例提供了一种移动通信方法，包括：
用户设备UE接收来自移动管理实体MME的非接入层NAS安全模式命令消息，所述NAS安全模式命令消息中携带用于对所述MME已经接收到的UE能力信息进行验证的第一验证匹配信息；
所述UE根据所述第一验证匹配信息，确定所述MME已经接收到的UE能力信息是否与所述UE发送给所述MME的UE能力信息一致；
若一致，则所述UE向所述MME发送NAS安全模式完成消息。
可选的，所述第一验证匹配信息为所述MME向所述UE发送所述NAS安全模式命令消息前已经接收到的附着请求消息的第一哈希值，所述NAS安全模式命令消息还包括所述MME对已经接收到的所述附着请求消息进行哈希计算所采用的哈希算法、所述MME所采用的完整性算法、秘钥标识以及所述NAS安全模式命令消息的第一非接入层消息认证码NAS-MAC；
所述UE计算所述UE接收到的所述NAS安全模式命令消息的第二NAS-MAC；
所述UE确定第二NAS-MAC是否与所述第一NAS-MAC一致；
若一致，所述UE根据哈希算法，计算所述UE发送给所述MME的附着请求消息的第二哈希值；
所述UE确定所述二哈希值是否与所述第一哈希值一致；
若一致，则所述UE向所述MME发送NAS安全模式完成消息。
可选的，所述NAS安全模式命令消息还包括：所述MME回传的UE安全能力；
所述UE确定所述MME回传的UE安全能力是否与所述UE发送给所述MME的UE安全能力一致；
相应的，所述若一致，则所述UE向所述MME发送NAS安全模式完成消息，包括：
若所述第二哈希值与所述第一哈希值一致、所述第二NAS-MAC与所述第一NAS-MAC一致且所述MME回传的UE安全能力与所述UE发送给所述MME的UE安全能力一致，则所述UE向所述MME发送NAS安全模式完成消息。
可选的，所述方法还包括：
若所述第二哈希值、所述第二NAS-MAC以及所述MME回传的UE安全能力中的至少一项验证失败，则所述UE向所述MME发送NAS安全模式失败消息；
或者，
若所述第二NAS-MAC与所述第一NAS-MAC一致、所述MME回传的UE安全能力与所述UE发送给所述MME的UE安全能力一致且所述第二哈希值与所述第一哈希值不一致，则所述UE向所述MME发送NAS安全模式 完成消息，该NAS安全模式完成消息中携带附着请求消息。
可选的，所述第一验证匹配信息为所述MME已经接收到的UE能力信息的第三哈希值，所述NAS安全模式命令消息还包括所述MME对已经接收到的UE能力信息进行哈希计算所所采用的哈希算法、所述MME所采用的完整性算法、秘钥标识以及所述NAS安全模式命令消息的第三NAS-MAC；
所述UE计算所述UE接收到的所述NAS安全模式命令消息的第四NAS-MAC；所述UE确定所述第四NAS-MAC是否与所述第三NAS-MAC一致；
若一致，所述UE根据哈希算法，计算所述UE发送给所述MME的UE能力信息的第四哈希值；
所述UE确定所述二哈希值是否与所述第三哈希值一致；
若一致，则所述UE向所述MME发送NAS安全模式完成消息。
可选的，所述NAS安全模式命令消息中还包括：所述MME回传的UE安全能力；
所述UE确定所述MME回传的UE安全能力是否与所述UE发送给所述MME的UE安全能力一致；
相应的，所述若一致，则所述UE向所述MME发送NAS安全模式完成消息，包括：
若所述第四哈希值与所述第三哈希值一致、所述第四NAS-MAC与所述第三NAS-MAC一致且所述MME回传的UE安全能力与所述UE发送给所述MME的UE安全能力一致，则所述UE向所述MME发送NAS安全模式完成消息。
可选的，所述方法还包括：
若所述第四哈希值、所述第四NAS-MAC以及所述MME回传的UE安全能力中的至少一项验证失败，则所述UE向所述MME发送NAS安全模式失败消息；
或者，
若所述第四NAS-MAC与所述第三NAS-MAC一致、所述MME回传的UE安全能力与所述UE发送给所述MME的UE安全能力一致且所述第四哈希值与所述第三哈希值不一致，则所述UE向所述MME发送NAS安全模式 完成消息，所述NAS安全模式完成消息中携带UE能力信息。
可选的，所述第一验证匹配信息为所述MME已经接收到的UE能力信息，所述NAS安全模式命令消息还包括所述MME所采用的完整性算法、秘钥标识以及所述NAS安全模式命令消息的第五NAS-MAC；
所述UE计算所述UE接收到的所述NAS安全模式命令消息的第六NAS-MAC；
所述UE确定所述第六NAS-MAC是否与所述第五NAS-MAC一致；
若一致，所述UE所述MME已经接收到的UE能力信息是否与所述UE发送给所述MME的UE能力信息一致；
若一致，则所述UE向所述MME发送NAS安全模式完成消息。
可选的，所述UE确定所述第六NAS-MAC是否与所述第五NAS-MAC一致，
若一致，所述UE确定所述MME已经接收到的所述UE能力信息中所包括的UE安全能力是否与所述UE发送给所述MME的UE安全能力一致；
若一致，则所述UE确定所述MME接收到的所述UE能力信息中除所述UE安全能力外的其它能力是否分别与所述UE发送给所述MME的一致；
若一致，则所述UE向所述MME发送NAS安全模式完成消息。
可选的，所述方法还包括：
若所述MME已经接收到的所述UE能力信息中除所述UE安全能力外的其它能力与所述UE发送给所述MME的不一致，则所述UE向所述MME发送NAS安全模式完成消息，所述NAS安全模式完成消息中携带UE能力信息。
可选的，所述NAS安全模式命令消息包括：所述MME接收到的UE安全能力、所述MME所采用的完整性算法、秘钥标识以及所述NAS安全模式命令消息的第七NAS-MAC；
所述UE计算所述UE接收到的所述NAS安全模式命令消息的第八NAS-MAC；
所述UE确定所述第八NAS-MAC是否与所述第七NAS-MAC一致；
若一致，所述UE确定所述MME接收到的UE安全能力是否与所述UE发送给所述MME的UE安全能力一致；
若一致，则所述UE向所述MME发送NAS安全模式完成消息，所述NAS安全模式完成消息中携带第二验证匹配信息以及所述NAS安全模式完成消息的NAS-MAC。
可选的，所述第二验证匹配信息包括：
所述UE已经向所述MME发送的附着请求消息的哈希值；或者，
所述UE已经向所述MME发送的UE能力信息的哈希值。
可选的，所述第二验证匹配信息包括：所述UE的UE能力信息。
可选的，所述UE向所述MME发送NAS安全模式完成消息之后，还包括：
所述UE接收所述MME发送的下行NAS传输消息，所述下行NAS传输消息中携带UE能力信息请求消息或者请求所述UE重新发送附着请求消息的请求消息；
所述UE向所述MME发送上行信息传输消息，所述上行信息传输消息中携带所述UE能力信息或附着请求消息。
可选的，所述UE向所述MME发送NAS安全模式完成消息之后，还包括：
所述UE接收所述MME发送的UE信息请求消息，所述UE信息请求消息携带UE能力信息请求消息或者请求所述UE重新发送附着请求消息的请求消息；
所述UE向所述MME发送UE信息应答消息，所述UE信息应答消息中携带UE能力信息或附着请求消息。
第二方面，本发明实施例提供了一种移动通信方法，包括：
MME向UE发送NAS安全模式命令消息，所述NAS安全模式命令消息中携带第一验证匹配信息，用于所述UE根据所述第一验证匹配信息，确定所述MME已经接收到的UE能力信息是否与所述UE发送给所述MME的UE能力信息一致；若一致，则所述UE向所述MME发送NAS安全模式完成消息。
可选的，所述第一验证匹配信息为所述MME已经接收到的附着请求消息的第一哈希值，所述NAS安全模式命令消息还包括所述MME对已经接收到的所述附着请求消息进行哈希计算所采用的哈希算法、所述MME所采用 的完整性算法、秘钥标识以及所述NAS安全模式命令消息的第一非接入层消息认证NAS-MAC。
可选的，所述NAS安全模式命令消息还包括：所述MME已经接收到的UE安全能力。
可选的，所述方法还包括：
在所述UE生成的所述NAS安全模式命令消息的第二NAS-MAC与所述第一NAS-MAC一致、所述MME回传的UE安全能力与所述UE发送给所述MME的UE安全能力一致且所述UE生成的附着请求消息的第二哈希值与所述第一哈希值不一致时，所述MME接收所述UE发送的NAS安全模式完成消息，其中所述NAS安全模式完成消息中携带附着请求消息。
可选的，所述第一验证匹配信息为所述MME已经接收到的UE能力信息的第三哈希值，所述NAS安全模式命令消息还包括所述MME对已经接收到的UE能力信息进行哈希计算所所采用的哈希算法、所述MME所采用的完整性算法、秘钥标识以及所述NAS安全模式命令消息的第三NAS-MAC。
可选的，所述NAS安全模式命令消息中还包括：所述MME已经接收到的UE安全能力。
可选的，所述方法还包括：
在所述UE生成的所述NAS安全模式命令消息的第四NAS-MAC与所述第三NAS-MAC一致、所述MME回传的UE安全能力与所述UE发送给所述MME的UE安全能力一致且所述UE生成的UE能力信息的第四哈希值与所述第三哈希值不一致时，所述MME接收所述UE发送的NAS安全模式完成消息，所述NAS安全模式完成消息中携带UE能力信息。
可选的，所述第一验证匹配信息为所述MME已经接收到的UE能力信息，所述NAS安全模式命令消息还包括所述MME所采用的完整性算法、秘钥标识以及所述NAS安全模式命令消息的第五NAS-MAC。
可选的，所述方法还包括：
在所述UE生成的所述NAS安全模式命令消息的第六NAS-MAC与所述第五NAS-MAC一致、所述MME回传的所述UE能力信息中所包括的UE安全能力与所述UE发送给所述MME的UE安全能力一致且在所述UE确定所述MME已经接收到的所述UE能力信息中除所述UE安全能力外的其它能 力与所述UE发送给所述MME的不一致时，所述MME接收所述UE发送的NAS安全模式完成消息，所述NAS安全模式完成消息中携带UE能力信息。
可选的，所述所述NAS安全模式命令消息包括：所述MME接收到的UE安全能力、所述MME所采用的完整性算法、秘钥标识以及所述NAS安全模式命令消息的第七NAS-MAC。
可选的，所述方法还包括：
所述MME接收所述UE发送的NAS安全模式完成消息，所述NAS安全模式完成消息中携带第二验证匹配信息以及所述NAS安全模式完成消息的NAS-MAC；
可选的，所述第二验证匹配信息包括：
所述UE已经向所述MME发送的附着请求消息的哈希值；或者，
所述UE已经向所述MME发送的UE能力信息的哈希值。
可选的，所述第二验证匹配信息包括：所述UE的UE能力信息。
可选的，所述方法还包括：
若所述MME确定所述MME已经接收到的所述UE能力信息与所述UE发送的不一致，则所述MME向所述UE发送下行NAS传输消息，所述下行NAS传输消息中携带UE能力信息请求消息或者请求所述UE重新发送附着请求消息的请求消息；
所述MME接收所述UE发送的上行信息传输消息，所述上行信息传输消息中携带所述UE能力信息或附着请求消息。
可选的，所述方法还包括：
若所述MME确定所述MME已经接收到的所述UE能力信息与所述UE发送的不一致，则所述MME向所述UE发送UE信息请求消息，所述UE信息请求消息携带UE能力信息请求消息或者请求所述UE重新发送附着请求消息的请求消息；
所述MME接收所述UE发送的UE信息应答消息，所述UE信息应答消息中携带UE能力信息或附着请求消息。
第三方面，本发明实施例提供了一种移动通信装置，所述装置部署于UE中，包括：
接收模块，用于接收来自移动管理实体MME的非接入层NAS安全模式 命令消息，所述NAS安全模式命令消息中携带用于对所述MME已经接收到的UE能力信息进行验证的第一验证匹配信息；
验证模块，用于根据所述第一验证匹配信息，确定所述MME已经接收到的UE能力信息是否与所述UE发送给所述MME的UE能力信息一致；
第一发送模块，用于MME已经接收到的UE能力信息与所述UE发送给所述MME的UE能力信息一致时，向所述MME发送NAS安全模式完成消息。
可选的，所述第一验证匹配信息为所述MME向所述UE发送所述NAS安全模式命令消息前已经接收到的附着请求消息的第一哈希值，所述NAS安全模式命令消息还包括所述MME对已经接收到的所述附着请求消息进行哈希计算所采用的哈希算法、所述MME所采用的完整性算法、秘钥标识以及所述NAS安全模式命令消息的第一非接入层消息认证码NAS-MAC；
所述验证模块，具体用于：
计算所述UE接收到的所述NAS安全模式命令消息的第二NAS-MAC；
确定第二NAS-MAC是否与所述第一NAS-MAC一致；
若一致，根据哈希算法，计算所述UE发送给所述MME的附着请求消息的第二哈希值；
确定所述二哈希值是否与所述第一哈希值一致；
所述第一发送模块，具体用于所述二哈希值与所述第一哈希值一致且所述第二NAS-MAC与所述第一NAS-MAC一致时，向所述MME发送NAS安全模式完成消息。
可选的，所述NAS安全模式命令消息中还包括：所述MME回传的UE安全能力；
所述验证模块，还用于：
确定所述MME回传的UE安全能力是否与所述UE发送给所述MME的UE安全能力一致；
所述第一发送模块，具体用于：
若所述第二哈希值与所述第一哈希值一致、所述第二NAS-MAC与所述第一NAS-MAC一致且所述MME回传的UE安全能力与所述UE发送给所述MME的UE安全能力一致，则向所述MME发送NAS安全模式完成消息。
可选的，所述第一发送模块，还用于：
若所述第二哈希值、所述第二NAS-MAC以及所述MME回传的UE安全能力中的至少一项验证失败，则向所述MME发送NAS安全模式失败消息；
或者，
还用于：若所述第二NAS-MAC与所述第一NAS-MAC一致、所述MME回传的UE安全能力与所述UE发送给所述MME的UE安全能力一致且所述第二哈希值与所述第一哈希值不一致，则向所述MME发送NAS安全模式完成消息，该NAS安全模式完成消息中携带附着请求消息。
可选的，所述第一验证匹配信息为所述MME已经接收到的UE能力信息的第三哈希值，所述NAS安全模式命令消息还包括所述MME对已经接收到的UE能力信息进行哈希计算所所采用的哈希算法、所述MME所采用的完整性算法、秘钥标识以及所述NAS安全模式命令消息的第三NAS-MAC；
所述验证模块，具体用于：
计算所述UE接收到的所述NAS安全模式命令消息的第四NAS-MAC；
确定所述第四NAS-MAC是否与所述第三NAS-MAC一致；
若一致，根据哈希算法，计算所述UE发送给所述MME的UE能力信息的第四哈希值；
确定所述二哈希值是否与所述第三哈希值一致；
所述第一发送模块，具体用于若一致，则所述UE向所述MME发送NAS安全模式完成消息。
可选的，所述NAS安全模式命令消息中还包括：所述MME回传的UE安全能力；
所述验证模块，还用于：
确定所述MME回传的UE安全能力是否与所述UE发送给所述MME的UE安全能力一致；
所述第一发送模块，具体用于：
若所述第四哈希值与所述第三哈希值一致、所述第四NAS-MAC与所述第三NAS-MAC一致且所述MME回传的UE安全能力与所述UE发送给所述MME的UE安全能力一致，则向所述MME发送NAS安全模式完成消息。
可选的，所述第一发送模块，还用于：
若所述第四哈希值、所述第四NAS-MAC以及所述MME回传的UE安全能力中的至少一项验证失败，则所述UE向所述MME发送NAS安全模式失败消息；
或者，
所述第一发送模块，还用于若所述第四NAS-MAC与所述第三NAS-MAC一致、所述MME回传的UE安全能力与所述UE发送给所述MME的UE安全能力一致且所述第四哈希值与所述第三哈希值不一致，则所述UE向所述MME发送NAS安全模式完成消息，所述NAS安全模式完成消息中携带UE能力信息。
可选的，所述第一验证匹配信息为所述MME已经接收到的UE能力信息，所述NAS安全模式命令消息还包括所述MME所采用的完整性算法、秘钥标识以及所述NAS安全模式命令消息的第五NAS-MAC；
所述验证模块，具体用于：
计算所述UE接收到的所述NAS安全模式命令消息的第六NAS-MAC；
所述UE确定所述第六NAS-MAC是否与所述第五NAS-MAC一致；
确定所述MME已经接收到的UE能力信息是否与所述UE发送给所述MME的UE能力信息一致；
所述第一发送模块，具体用于若一致，则向所述MME发送NAS安全模式完成消息。
可选的，所述验证模块，具体用于：
确定所述第六NAS-MAC是否与所述第五NAS-MAC一致；
若一致，确定所述MME已经接收到的所述UE能力信息中所包括的UE安全能力是否与所述UE发送给所述MME的UE安全能力一致；
若一致，则所述UE确定所述MME接收到的所述UE能力信息中除所述UE安全能力外的其它能力是否分别与所述UE发送给所述MME的一致；
所述第一发送模块，具体用于若一致，则向所述MME发送NAS安全模式完成消息。
可选的，所述第一发送模块还用于：
若所述MME已经接收到的所述UE能力信息中除所述UE安全能力外的其它能力与所述UE发送给所述MME的不一致，则向所述MME发送NAS 安全模式完成消息，所述NAS安全模式完成消息中携带UE能力信息。
可选的，所述NAS安全模式命令消息包括：所述MME接收到的UE安全能力、所述MME所采用的完整性算法、秘钥标识以及所述NAS安全模式命令消息的第七NAS-MAC；
所述验证模块，具体用于：
计算所述UE接收到的所述NAS安全模式命令消息的第八NAS-MAC；
确定所述第八NAS-MAC是否与所述第七NAS-MAC一致，若一致，确定所述MME接收到的UE安全能力是否与所述UE发送给所述MME的UE安全能力一致；
所述第一发送模块，具体用于若一致，则向所述MME发送NAS安全模式完成消息，所述NAS安全模式完成消息中携带第二验证匹配信息以及所述NAS安全模式完成消息的NAS-MAC。
可选的，所述第二验证匹配信息包括：
所述UE已经向所述MME发送的附着请求消息的哈希值；或者，
所述UE已经向所述MME发送的UE能力信息的哈希值。
可选的，所述第二验证匹配信息包括：所述UE的UE能力信息。
可选的，所述接收模块，还用于所述第一发送模块向所述MME发送NAS安全模式完成消息之后，接收所述MME发送的下行NAS传输消息，所述下行NAS传输消息中携带UE能力信息请求消息或者请求所述UE重新发送附着请求消息的请求消息；
所述第一发送模块，还用于向所述MME发送上行信息传输消息，所述上行信息传输消息中携带所述UE能力信息或附着请求消息。
可选的，所述接收模块还用于：
所述第一发送模块向所述MME发送NAS安全模式完成消息之后，接收所述MME发送的UE信息请求消息，所述UE信息请求消息携带UE能力信息请求消息或者请求所述UE重新发送附着请求消息的请求消息；
所述第一发送模块，还用于向所述MME发送UE信息应答消息，所述UE信息应答消息中携带UE能力信息或附着请求消息。
第四方面，本发明实施例提供了一种移动通信装置，所述装置部署于MME中，包括：
第二发送模块，用于向UE发送NAS安全模式命令消息，所述NAS安全模式命令消息中携带所述第一验证匹配信息，用于所述UE根据所述第一验证匹配信息，确定所述MME已经接收到的UE能力信息是否与所述UE发送给所述MME的UE能力信息一致；若一致，则所述UE向所述MME发送NAS安全模式完成消息。
可选的，所述第一验证匹配信息为所述MME已经接收到的附着请求消息的第一哈希值，所述NAS安全模式命令消息还包括所述MME对已经接收到的所述附着请求消息进行哈希计算所采用的哈希算法、所述MME所采用的完整性算法、秘钥标识以及所述NAS安全模式命令消息的第一非接入层消息认证NAS-MAC。
可选的，所述NAS安全模式命令消息中还包括：所述MME已经接收到的UE安全能力。
可选的，所述装置还包括：第一接收模块，用于：
在所述UE生成的所述NAS安全模式命令的第二NAS-MAC与所述第一NAS-MAC一致、所述MME回传的UE安全能力与所述UE发送给所述MME的UE安全能力一致且所述UE生成的附着请求消息的第二哈希值与所述第一哈希值不一致时，接收所述UE发送的NAS安全模式完成消息，其中所述NAS安全模式完成消息中携带附着请求消息。
可选的，所述第一验证匹配信息为所述MME已经接收到的UE能力信息的第三哈希值，所述NAS安全模式命令消息还包括所述MME对已经接收到的UE能力信息进行哈希计算所所采用的哈希算法、所述MME所采用的完整性算法、秘钥标识以及所述NAS安全模式命令消息的第三NAS-MAC。
可选的，所述NAS安全模式命令消息中还包括：所述MME已经接收到的UE安全能力。
可选的，所述装置还包括：第二接收模块，用于：
在所述UE生成的所述NAS安全模式命令消息的第四NAS-MAC与所述第三NAS-MAC一致、所述MME回传的UE安全能力与所述UE发送给所述MME的UE安全能力一致且所述UE生成的UE能力信息的第四哈希值与所述第三哈希值不一致时，接收所述UE发送的NAS安全模式完成消息，所述NAS安全模式完成消息中携带UE能力信息。
可选的，所述第一验证匹配信息为所述MME已经接收到的UE能力信息，所述NAS安全模式命令消息还包括所述MME所采用的完整性算法、秘钥标识以及所述NAS安全模式命令消息的第五NAS-MAC。
可选的，所述装置还包括：第三接收模块，用于：
在所述UE生成的所述NAS安全模式命令消息的第六NAS-MAC与所述第五NAS-MAC一致、所述MME已经接收到的所述UE能力信息中所包括的UE安全能力与所述UE发送给所述MME的UE安全能力一致且在所述UE确定所述MME已经接收到的所述UE能力信息中除所述UE安全能力外的其它能力与所述UE发送给所述MME的不一致时，接收所述UE发送的NAS安全模式完成消息，所述NAS安全模式完成消息中携带UE能力信息。
可选的，所述所述NAS安全模式命令消息包括：所述MME接收到的UE安全能力、所述MME所采用的完整性算法、秘钥标识以及所述NAS安全模式命令消息的第七NAS-MAC。
可选的，所述装置还包括：第四接收模块，用于接收所述UE发送的NAS安全模式完成消息，所述NAS安全模式完成消息中携带第二验证匹配信息以及所述NAS安全模式完成消息的NAS-MAC；
可选的，所述第二验证匹配信息包括：
所述UE已经向所述MME发送的附着请求消息的哈希值；或者，
所述UE已经向所述MME发送的UE能力信息的哈希值。
可选的，所述第二验证匹配信息包括：所述UE的UE能力信息。
可选的，所述第二发送模块，还用于若所述MME已经接收到的所述UE能力信息与所述UE发送的不一致，则向所述UE发送下行NAS传输消息，所述下行NAS传输消息中携带UE能力信息请求消息或者请求所述UE重新发送附着请求消息的请求消息；
所述第四接收模块，还用于接收所述UE发送的上行信息传输消息，所述上行信息传输消息中携带所述UE能力信息或附着请求消息。
可选的，所述第二发送模块还用于：若所述MME确定所述MME已经接收到的所述UE能力信息与所述UE发送的不一致，则向所述UE发送UE信息请求消息，所述UE信息请求消息携带UE能力信息请求消息或者请求所述UE重新发送附着请求消息的请求消息；
所述第四接收模块，还用于接收所述UE发送的UE信息应答消息，所述UE信息应答消息中携带UE能力信息或附着请求消息。
第五方面，本发明实施例提供了一种移动通信设备，所述设备部署于UE中，包括：
通信接口、存储器、处理器和通信总线，其中，所述通信接口、所述存储器和所述处理器通过所述通信总线通信；
所述存储器用于存放程序，所述处理器用于执行所述存储器存储的程序；当所述移动通信设备运行时，所述处理器运行程序，所述程序包括：
接收来自移动管理实体MME的非接入层NAS安全模式命令消息，所述NAS安全模式命令消息中携带用于对所述MME已经接收到的UE能力信息进行验证的第一验证匹配信息；
根据所述第一验证匹配信息，确定所述MME已经接收到的UE能力信息是否与所述UE发送给所述MME的UE能力信息一致；
若一致，则向所述MME发送NAS安全模式完成消息。
第六方面，本发明实施例提供了一种移动通信设备，所述设备部署于MME中，包括：
通信接口、存储器、处理器和通信总线，其中，所述通信接口、所述存储器和所述处理器通过所述通信总线通信；
所述存储器用于存放程序，所述处理器用于执行所述存储器存储的程序；当所述移动通信设备运行时，所述处理器运行程序，所述程序包括：
向UE发送NAS安全模式命令消息，所述NAS安全模式命令消息中携带第一验证匹配信息，用于所述UE根据所述第一验证匹配信息，确定所述MME已经接收到的UE能力信息是否与所述UE发送给所述MME的UE能力信息一致；若一致，则所述UE向所述MME发送NAS安全模式完成消息。
本发明实施例方法，UE根据接收到的第一验证匹配消息验证MME已经接收到的UE能力信息是否与UE发送给MME的UE能力信息一致，可见本发明实施例中通过MME回传验证匹配消息，UE对MME接收到的UE能力信息进行验证的方式，确保MME拥有正确的UE能力信息，解决附着(Attach)流程中附着请求(Attach Request)消息没有NAS安全上下文保护，攻击者可能修改UE能力信息，MME无法获取正确的UE能力而造成的DoS攻击问题， 其中，DoS是Denial of Service的简称，即拒绝服务，造成DoS的攻击行为被称为DoS攻击。
附图说明
图1示出了本发明实施例一移动通信方法的流程图；
图2示出了本发明实施例二移动通信方法的流程图；
图3示出了本发明实施例三移动通信方法的流程图；
图4示出了本发明实施例四移动通信方法的流程图；
图5示出了本发明实施例五移动通信方法的流程图；
图6示出了本发明实施例六移动通信方法的流程图；
图7示出了本发明实施例七移动通信方法的流程图；
图8示出了本发明实施例八移动通信方法的流程图；
图9示出了本发明实施例九移动通信方法的流程图；
图10示出了本发明实施例十移动通信方法的流程图；
图11示出了本发明实施例十一移动通信方法的流程图；
图12示出了本发明实施例十二移动通信方法的流程图；
图13示出了本发明实施例十五移动通信方法的流程图；
图14示出了本发明实施例十六移动通信方法的流程图；
图15示出了本发明实施例一移动通信装置的结构示意图；
图16示出了本发明实施例二移动通信装置的结构示意图；
图17示出了本发明实施例一移动通信设备的结构示意图；
图18示出了本发明实施例二移动通信设备的结构示意图。
具体实施方式
图1示出了本发明实施例一移动通信方法的流程图。如图1所示，本发明实施例一的主要处理步骤包括：
步骤S11：UE接收来自MME的NAS(Non-Access Stratum，非接入层)安全模式命令(NAS Security Mode Command)消息，其中，NAS安全模式命令消息中携带用于对MME已经接收到的UE能力信息进行验证的第一验证匹配信息。
UE的附着流程中，UE通过eNB向MME发送附着请求(Attach Request)消息，其中在附着请求消息中携带UE能力(UE Capability)信息。
具体的UE能力信息包括：UE网络能力(UE network capability)，UE网络能力即为UE安全能力、移动台网络能力(MS network capability，其中MS的英文全拼为Mobile Station，中文名称为移动台)、移动台等级2(Mobile station classmark 2)、移动台等级3(Mobile station classmark 3)、支持的编解码器(Supported Codecs)、附加更新类型(Additional update type)、语音域优先级和用户使用设置(Voice domain preference and UE's usage setting)、移动台网络功能支持(MS network feature support)。
由于UE发送给MME的附着请求消息可能没有完整性保护，由此可能会受到中间人攻击，使得MME接收到的附着请求消息中的UE能力信息，与UE发送给MME的不一致，使得MME无法获取到正确的UE能力信息。
为了确保MME能够得到正确的UE能力信息，MME在NAS安全激活过程中通过NAS安全模式命令消息向UE发送第一验证匹配信息，用于UE根据第一验证匹配信息确定MME已经接收到的UE能力信息是否与UE发送的一致。
步骤S12：UE根据第一验证匹配信息，确定MME已经接收到的UE能力信息是否与UE发送给MME的UE能力信息一致。
步骤S13：若一致，则UE向MME发送NAS安全模式完成消息。
本发明实施例方法，UE根据接收到的第一验证匹配消息验证MME已经接收到的UE能力信息是否与UE发送给MME的UE能力信息一致，可见本发明实施例中通过MME回传验证匹配消息，UE对MME接收到的UE能力信息进行验证的方式，确保MME拥有正确的UE能力信息，解决附着(Attach)流程中附着请求(Attach Request)消息没有NAS安全上下文保护，攻击者可能修改UE能力信息，MME无法获取正确的UE能力而造成的DoS攻击问题，其中，DoS是Denial of Service的简称，即拒绝服务，造成DoS的攻击行为被称为DoS攻击。
本发明实施例一的上述方法中，第一验证匹配信息可以有多种不同的实现方式，以下将结合具体实施例进行说明。
图2示出了本发明实施例二移动通信方法的流程图，本方法中，MME对接收到的附着请求消息进行哈希计算得到附着请求消息的哈希值，并通过NAS安全模式命令消息将附着请求消息的哈希值发送给UE，以通过UE对附着请求消息哈希值的验证，确定MME接收到的UE能力信息是否与UE发送给MME的一致，如图2所示，本方法的主要处理步骤包括：
步骤S21：UE接收来自MME的NAS安全模式命令消息。
其中，NAS安全模式命令消息中携带的第一验证匹配消息为MME对在附着流程中接收到的附着请求消息进行哈希计算得到附着请求消息的第一哈希值，NAS安全模式命令消息还包括MME对已经接收到的附着请求消息进行哈希计算所采用的哈希算法(可选携带)、MME所采用的完整性算法、密钥标识以及NAS安全模式命令消息的第一NAS-MAC(Non-Access Stratum UEssage Authentication Code，非接入层消息认证码)，其中，第一NAS-MAC用于对NAS安全模式命令消息的完整性进行保护。
进一步，NAS安全模式命令消息中还可以包括MME及UE均支持的一种加密算法、可选携带可选携带的[IMEI(International Mobile Equipment Identity，国际移动设备标识)请求]以及可选携带的用于空闲移动安全上下文映射的[NONCEUE、NONCEMME]，其中，NONCEUE为UE选择的随机数，NONCEMME指MME选择的的随机数。
步骤S22：UE计算UE接收到的NAS安全模式命令消息的第二NAS-MAC。
本步骤中，UE采用MME对发送的NAS安全模式命令消息进行完整性保护的方式，对UE接收到的NAS安全模式命令消息进行计算，得到第二NAS-MAC。
若NAS安全模式命令消息在发送过程中未受到中间人攻击，则第一NAS-MAC会与第二NAS-MAC一致。
步骤S23：UE确定第二NAS-MAC是否与第一NAS-MAC一致，若一致，执行步骤S24，若不一致，执行步骤S27。
步骤S24：UE根据哈希算法，计算UE发送给MME的附着请求消息的第二哈希值。
UE采用哈希算法对UE在附着流程中发送给MME的附着请求消息进行 哈希计算，若在附着流程中附着请求消息未受到中间人修改，则UE计算得到的第二哈希值会与NAS安全模式命令消息中的第一哈希值一致。
进一步，本发明实施例中在NAS安全模式命令消息中携带附着请求消息的哈希值，可以缩短附着请求消息长度，提高信息发送速率。
步骤S25：UE确定第二哈希值是否与第一哈希值一致，若一致，执行步骤S26，否则执行步骤S27。
步骤S26：UE向MME发送NAS安全模式完成(NAS Security Mode Complete)消息。
其中，在NAS安全模式完成消息中可选携带[IMEI]以及携带对NAS安全模式完成消息进行安全保护的NAS-MAC。
步骤S27：UE向MME发送NAS安全模式失败(NAS Security Mode Reject)消息。
本实施例中，UE对接收到的NAS安全模式命令消息的完整性以及MME接收到的附着请求消息的哈希值进行验证，当上述第二哈希值与第一哈希值一致且第二NAS-MAC与第一NAS-MAC一致时，UE确定UE接收到的NAS安全模式命令消息未被修改，MME在UE附着流程接收到的附着请求消息与UE发送给MME的一致，从而确保MME接收到的附着请求消息中的UE能力信息与UE发送的UE能力信息一致。
当附着请求消息的哈希值以及NAS-MAC的完整性校验至少有一个失败时，说明MME接收到的附着请求以及NAS安全模式命令消息至少有一个受到攻击被修改，此时UE向MME发送NAS Security Mode Reject消息。
本实施例中，UE通过对MME的附着请求消息的哈希值的验证实现对MME接收到的UE能力的验证，确保MME接收到的UE能力信息为正确的UE能力信息。
本实施例中，第一验证匹配消息在传输时可以占用现有规范中MME回传UE安全能力的IE(Information Element，信息单元)，也可以使用一个新的IE进行传输。
图3示出了本发明实施例三移动通信方法的流程图，本方法中，MME将接收到的UE安全能力以及附着请求消息的哈希值通过NAS安全模式命令消息发送给UE，以通过UE对附着请求消息哈希值以及UE安全能力的验证， 确定MME接收到的UE能力信息是否与UE发送给MME的一致，如图3所示，本方法的主要处理步骤包括：
步骤S31：UE接收来自MME的NAS安全模式命令消息。
其中，NAS安全模式命令消息携带的第一验证匹配消息为MME对在附着流程中接收到的附着请求消息进行哈希计算得到附着请求消息的第一哈希值，NAS安全模式命令消息还包括MME在附着流程中接收到的UE安全能力、MME对已经接收到的附着请求消息进行哈希计算所采用的哈希算法(可选携带)、MME及UE均支持的一种完整性算法、秘钥标识以及NAS安全模式命令消息的第一NAS-MAC，第一NAS-MAC用于对NAS安全模式命令消息的完整性进行保护。
进一步，在安全模式命令消息中还可以包括MME及UE均支持的一种加密算法、可选携带的还可以包括[IMEI(International Mobile Equipment Identity，国际移动设备标识)请求]以及可选携带的[NONCEUE、NONCEMME]，其中，NONCEUE为UE选择的随机数，NONCEMME为MME选择的随机数。
步骤S32：UE计算UE接收到的NAS安全模式命令消息的第二NAS-MAC。
本步骤中，UE采用MME对发送的NAS安全模式命令消息进行完整性保护的方式，对UE接收到的NAS安全模式命令消息进行计算，得到第二NAS-MAC。
若NAS安全模式命令消息在发送过程中未受到中间人攻击，则第一NAS-MAC会与第二NAS-MAC一致。
步骤S33：UE确定第二NAS-MAC是否与第一NAS-MAC一致，若一致，执行步骤S34，若不一致，执行步骤S36。
步骤S34：UE根据哈希算法，计算UE发送给MME的附着请求消息的第二哈希值，确定第二哈希值是否与第一哈希值一致、MME回传的UE安全能力是否与UE发送给MME的UE安全能力一致，(哈希值的计算、哈希值的确认、UE安全能力的确认顺序不进行限定)，若均一致，执行步骤S35，否则执行步骤S36。
UE采用哈希算法对UE在附着流程中发送给MME的附着请求消息进行 哈希计算，若在附着流程中附着请求消息未受到中间人修改，则UE计算得到的第二哈希值会与NAS安全模式命令消息中的第一哈希值一致。
进一步，本发明实施例中在NAS安全模式命令消息中携带附着请求消息的哈希值，可以缩短附着请求消息长度，提高信息发送速率。
步骤S35：UE向MME发送NAS安全模式完成消息。
其中，在NAS安全模式完成消息中可选携带[IMEI]以及携带对NAS安全模式完成消息进行安全保护的NAS-MAC。
步骤S36：UE向MME发送NAS安全模式失败消息。
本发明实施例中，UE通过对MME收到的附着请求消息的哈希值以及UE安全能力进行验证实现对MME接收到的UE能力的验证，确保MME接收到的UE能力信息为正确的UE能力信息，
本发明实施例中，第一验证匹配消息只能使用一个新的IE进行传输。
图4示出了本发明实施例四移动通信方法的流程图，本方法中，MME将接收到的UE安全能力以及附着请求消息的哈希值通过NAS安全模式命令消息发送给UE，以通过UE对附着请求消息哈希值以及UE安全能力的验证，确定MME接收到的UE能力信息是否与UE发送给MME的一致，如图4所示，本方法的主要处理步骤包括：
步骤S41：UE接收来自MME的NAS安全模式命令消息。
其中，NAS安全模式命令消息携带的第一验证匹配消息为MME对在附着流程中接收到的附着请求消息进行哈希计算得到附着请求消息的第一哈希值，NAS安全模式命令消息还包括MME在附着流程中接收到的UE安全能力、MME对已经接收到的附着请求消息进行哈希计算所采用的哈希算法(可选携带)、MME采用的完整性算法、秘钥标识以及NAS安全模式命令消息的第一NAS-MAC，第一NAS-MAC用于对NAS安全模式命令消息的完整性进行保护。
进一步，在安全模式命令消息中还可以包括MME及UE均支持的一种加密算法、可选携带的[IMEI(International Mobile Equipment Identity，国际移动设备标识)请求]以及可选携带的[NONCEUE、NONCEMME]，其中，NONCEUE为UE选择的随机数，NONCEMME指MME选择的随机数。
步骤S42：UE计算UE接收到的NAS安全模式命令消息的第二 NAS-MAC。
步骤S43：UE确定第二NAS-MAC是否与第一NAS-MAC一致，若一致，执行步骤S44，若不一致，执行步骤S48。
步骤S44：UE确定MME回传的UE安全能力是否与UE发送给MME的UE安全能力一致，若一致，执行步骤S45，否则执行步骤S48。
步骤S45：UE确定第二哈希值是否与第一哈希值一致，若一致，执行步骤S46，若不一致，执行步骤S47。
本发明实施例中，第二哈希值的计算与上述实施例相同，不再赘述。
步骤S46：UE向MME发送NAS安全模式完成消息。
其中，在NAS安全模式完成消息中可选携带[IMEI]以及携带对NAS安全模式完成消息进行安全保护的NAS-MAC。
步骤S47：UE向MME发送NAS安全模式完成消息，该消息中携带附着请求消息或者UE能力。本步骤发送的NAS安全模式完成消息中除携带附着请求消息外还可选携带[IMEI]以及携带对NAS安全模式完成消息进行安全保护的NAS-MAC。
步骤S48：UE向MME发送NAS安全模式失败消息。
本实施例中，当UE安全能力和NAS-MAC的完整性验证成功后，实际上UE和MME之间已经建立NAS安全上下文了，所以当附着请求消息的哈希值的完整性验证失败时，直接在有完整性保护的NAS Security Mode Complete消息中重新上传Attach Request的内容即可，这也是与实施例三不同之处，实施例三采取的方式是：即使UE security capabilities和NAS-MAC的完整性验证成功UE和MME之间已经建立NAS安全上下文了，如果Attach Request消息的哈希值的完整性验证失败，UE也要发送NAS Security Mode Reject消息。
本发明实施例中，第一验证匹配消息只能使用一个新的IE进行传输。
图5示出了本发明实施例五移动通信方法的流程图，本方法中，MME对接收到的UE能力信息进行哈希计算得到UE能力的哈希值，并通过NAS安全模式命令消息将UE能力信息的哈希值发送给UE，以通过UE对UE能力哈希值的验证，确定MME接收到的UE能力信息是否与UE发送给MME的一致，如图5所示，本方法的主要处理步骤包括：
步骤S51：UE接收来自MME的NAS安全模式命令消息。
其中，NAS安全模式命令消息携带的第一验证匹配消息为MME对在附着流程中接收到的UE能力信息进行哈希计算得到UE能力信息的第三哈希值，NAS安全模式命令消息还包括MME对已经接收到的UE能力信息进行哈希计算所采用的哈希算法(可选携带)、MME及UE均支持的一种完整性算法、秘钥标识以及NAS安全模式命令消息的第三NAS-MAC(Non-Access Stratum UEssage Authentication Code，非接入层消息认证码)，其中，第三NAS-MAC用于对NAS安全模式命令消息的完整性进行保护。
进一步，在安全模式命令消息中还可以包括MME及UE均支持的一种加密算法、可选携带的[IMEI(International Mobile Equipment Identity，国际移动设备标识)请求]以及可选携带的[NONCEUE、NONCEMME]，其中，NONCEUE为UE选择的随机数，NONCEMME指MME选择的随机数。
步骤S52：UE计算UE接收到的NAS安全模式命令消息的第四NAS-MAC。
本步骤中，UE采用MME对发送的NAS安全模式命令消息进行完整性保护的方式，对UE接收到的NAS安全模式命令消息进行计算，得到第四NAS-MAC。
若NAS安全模式命令消息在发送过程中未受到中间人攻击，则第三NAS-MAC会与第四NAS-MAC一致。
步骤S53：UE确定第四NAS-MAC是否与第三NAS-MAC一致，若一致，执行步骤S54，否则，执行步骤S57。
步骤S54：UE根据哈希算法，计算UE发送给MME的UE能力信息的第四哈希值。
UE采用哈希算法对UE在附着流程中发送给MME的UE能力信息进行哈希计算，若在附着流程中UE能力信息中的UE能力信息未受到中间人修改，则UE计算得到的第四哈希值会与NAS安全模式命令消息中的第三哈希值一致。
进一步，本发明实施例中在NAS安全模式命令消息中携带UE能力信息的哈希值，可以缩短UE能力信息长度，提高信息发送速率。
步骤S55：UE确定第四哈希值是否与第三哈希值一致，若一致，执行步 骤S56，否则执行步骤S57。
步骤S56：UE向MME发送NAS安全模式完成(NAS Security Mode Complete)消息。
其中，在NAS安全模式完成消息中可选携带[IMEI]以及携带对NAS安全模式完成消息进行安全保护的NAS-MAC。
步骤S57：UE向MME发送NAS安全模式失败(NAS Security Mode Reject)消息。
本实施例中，UE对接收到的NAS安全模式命令消息的完整性以及MME接收到的UE能力信息的哈希值进行验证，当上述第四哈希值与第三哈希值一致且第四NAS-MAC与第三NAS-MAC一致时，UE确定UE接收到的NAS安全模式命令消息未被修改，MME在UE附着流程接收到的UE能力信息与UE发送给MME的一致，从而确保MME接收到的UE能力信息中与UE发送的UE能力信息一致。
当UE能力信息的哈希值以及NAS-MAC的完整性校验至少有一个失败时，说明MME接收到的UE能力信息以及NAS安全模式命令至少有一个受到攻击被修改，此时UE向MME发送NAS Security Mode Reject消息。
本实施例中，UE通过对MME的UE能力信息的哈希值的验证实现对MME接收到的UE能力信息的验证，确保MME接收到的UE能力信息为正确的UE能力信息，
本实施例中，第一验证匹配消息在传输时可以占用现有规范中MME回传UE安全能力的IE，也可以使用一个新的IE进行传输。
图6示出了本发明实施例六移动通信方法的流程图，本方法中，MME将接收到的UE安全能力以及UE能力信息的哈希值通过NAS安全模式命令消息发送给UE，以通过UE对UE能力信息哈希值以及UE安全能力的验证，确定MME接收到的UE能力信息是否与UE发送给MME的一致，如图6所示，本方法的主要处理步骤包括：
步骤S61：UE接收来自MME的NAS安全模式命令消息。
其中，NAS安全模式命令消息携带的第一验证匹配消息为MME对在附着流程中接收到的UE能力信息进行哈希计算得到UE能力信息的第三哈希值，NAS安全模式命令消息还包括MME在附着流程中接收到的UE安全能 力、MME对已经接收到的UE能力信息进行哈希计算所采用的哈希算法(可选携带)、MME及UE均支持的一种完整性算法、秘钥标识以及NAS安全模式命令消息的第三NAS-MAC，第三NAS-MAC用于对NAS安全模式命令消息的完整性进行保护。
进一步，在安全模式命令消息中还可以包括MME及UE均支持的一种加密算法、可选携带的[IMEI(International Mobile Equipment Identity，国际移动设备标识)请求]以及可选携带的[NONCEUE、NONCEMME]，其中，NONCEUE为UE选择的随机数，NONCEMME指MME选择的随机数。
步骤S62：UE计算UE接收到的NAS安全模式命令消息的第四NAS-MAC。
本步骤中，UE采用MME对发送的NAS安全模式命令消息进行完整性保护的方式，对UE接收到的NAS安全模式命令消息进行计算，得到第四NAS-MAC。
若NAS安全模式命令消息在发送过程中未受到中间人攻击，则第三NAS-MAC会与第四NAS-MAC一致。
步骤S63：UE确定第四NAS-MAC是否与第三NAS-MAC一致，若一致，执行步骤S64，否则，执行步骤S66。
步骤S64：UE根据哈希算法，计算UE发送给MME的UE能力信息的第四哈希值，确定第四哈希值是否与第三哈希值一致、MME回传的UE安全能力是否与UE发送给MME的UE安全能力一致(哈希值的计算、哈希值的确认、UE安全能力的确认顺序不规定)，若均一致，执行步骤S65，否则执行步骤S66。
步骤S65：UE向MME发送NAS安全模式完成消息。
其中，在NAS安全模式完成消息中可选携带[IMEI]以及携带对NAS安全模式完成消息进行安全保护的NAS-MAC。
步骤S66：UE向MME发送NAS安全模式失败消息。
本发明实施例中，UE通过对MME的UE能力信息的哈希值以及UE安全能力进行验证实现对MME接收到的UE能力的验证，确保MME接收到的UE能力信息为正确的UE能力信息本发明实施例中，第一验证匹配消息只能 使用一个新的IE进行传输。
图7示出了本发明实施例七移动通信方法的流程图，本方法中，MME将接收到的UE安全能力以及UE能力信息的哈希值通过NAS安全模式命令消息发送给UE，以通过UE对UE能力信息哈希值以及UE安全能力的验证，确定MME接收到的UE能力信息是否与UE发送给MME的一致，如图7所示，本方法的主要处理步骤包括：
步骤S71：UE接收来自MME的NAS安全模式命令消息。
其中，NAS安全模式命令消息携带的第一验证匹配消息为MME对在附着流程中接收到的UE能力信息进行哈希计算得到UE能力信息的第三哈希值,NAS安全模式命令消息还包括MME在附着流程中接收到的UE安全能力、MME对已经接收到的UE能力信息进行哈希计算所采用的哈希算法(可选携带)、MME及UE均支持的一种完整性算法、秘钥标识以及NAS安全模式命令消息的第三NAS-MAC，第三NAS-MAC用于对NAS安全模式命令消息的完整性进行保护。
进一步，在安全模式命令消息中还可以包括MME及UE均支持的一种加密算法、可选携带的[IMEI(International Mobile Equipment Identity，国际移动设备标识)请求]以及可选携带的[NONCEUE、NONCEMME]。
步骤S72：UE计算UE接收到的NAS安全模式命令消息的第四NAS-MAC。
步骤S73：UE确定第四NAS-MAC是否与第三NAS-MAC一致，若一致，执行步骤S74，否则，执行步骤S78。
步骤S74：UE确定MME回传的UE安全能力是否与UE发送给MME的UE安全能力一致，若一致，执行步骤S75，否则执行步骤S78。
步骤S75：UE确定第四哈希值是否与第三哈希值一致，若一致，执行步骤S76，若不一致，执行步骤S77。
步骤S76：UE向MME发送NAS安全模式完成消息。
其中，在NAS安全模式完成消息中可选携带[IMEI]以及携带对NAS安全模式完成消息进行安全保护的NAS-MAC。
步骤S77：UE向MME发送NAS安全模式完成消息，该消息中携带UE能力信息。
本步骤发送的NAS安全模式完成消息除携带UE能力信息外还可选携带[IMEI]以及携带对NAS安全模式完成消息进行安全保护的NAS-MAC。
步骤S78：UE向MME发送NAS安全模式失败消息。
本发明实施例中，第一验证匹配消息只能使用一个新的IE进行传输。
图8示出了本发明实施例八移动通信方法的流程图，本方法中，MME通过NAS安全模式命令消息将在附着流程中接收到的UE能力信息发送给UE，以通过UE实现对UE能力信息的验证，如图8所示，本方法的主要处理步骤包括：
步骤S81：UE接收来自MME的NAS安全模式命令消息。
其中，NAS安全模式命令消息携带的第一验证匹配消息为MME在附着流程中已经接收到的UE能力信息，NAS安全模式命令消息还包括MME及UE均支持的一种完整性算法、秘钥标识以及NAS安全模式命令消息的第五NAS-MAC。
进一步，在安全模式命令消息中还可以包括MME及UE均支持的一种加密算法、可选携带的[IMEI(International Mobile Equipment Identity，国际移动设备标识)请求]以及可选携带的[NONCEUE、NONCEMME]，其中，NONCEUE为UE选择的随机数，NONCEMME指MME选择的随机数。
步骤S82：UE计算UE接收到的NAS安全模式命令消息的第六NAS-MAC。
步骤S83：UE确定第六NAS-MAC是否与第五NAS-MAC一致，若一致，执行步骤S84，否则，执行步骤S86。
步骤S84：UE确定MME已经接收到的UE能力信息是否与UE发送给MME的UE能力信息一致。
步骤S85：若一致，则UE向MME发送NAS安全模式完成消息。
其中，在NAS安全模式完成消息中可选携带[IMEI]以及携带对NAS安全模式完成消息进行安全保护的NAS-MAC。
步骤S86：若不一致UE向MME发送NAS安全模式失败(NAS Security Mode Reject)消息。
本实施例中，第一验证匹配消息在传输时可以占用现有规范中MME回传UE安全能力的IE，也可以使用一个新的IE进行传输，或者第一验证匹配 消息中的除了UE安全能力之外的UE能力使用一个新的IE进行传输。
图9示出了本发明实施例九移动通信方法的流程图，本方法中，MME通过NAS安全模式命令消息将在附着流程中接收到的UE能力信息发送给UE，以通过UE实现UE能力信息的验证，如图9所示，本方法的主要处理步骤包括：
步骤S91：UE接收来自MME的NAS安全模式命令消息。
其中，NAS安全模式命令消息携带的第一验证匹配消息为MME在附着流程中已经接收到的UE能力信息，NAS安全模式命令消息还包括MME及UE均支持的一种完整性算法、秘钥标识以及NAS安全模式命令消息的第五NAS-MAC。
进一步，在安全模式命令消息中还可以包括MME及UE均支持的一种加密算法、可选携带的[IMEI(International Mobile Equipment Identity，国际移动设备标识)请求]以及可选携带的[NONCEUE、NONCEMME]，其中，NONCEUE为UE选择的随机数，NONCEMME指MME选择的随机数。
步骤S92：UE计算UE接收到的NAS安全模式命令消息的第六NAS-MAC。
步骤S93：UE确定第六NAS-MAC是否与第五NAS-MAC一致，若一致，执行步骤S94，否则执行步骤S98。
步骤S94：UE确定MME回传的UE能力信息中所包括的UE安全能力是否与UE发送给MME的UE安全能力一致，若一致，执行步骤S95，否则执行步骤S98。
步骤S95：UE确定MME回传的UE能力信息中除UE安全能力外的其它能力是否分别与UE发送给MME的一致，若一致执行步骤S96，否则执行步骤S97。
步骤S96：UE向MME发送NAS安全模式完成消息。
其中，在NAS安全模式完成消息中可选携带[IMEI]以及携带对NAS安全模式完成消息进行安全保护的NAS-MAC。
步骤S97：UE向MME发送NAS安全模式完成消息，NAS安全模式完成消息中携带UE能力。
本步骤发送的NAS安全模式完成消息除携带UE能力信息外还可选携带 [IMEI]以及携带对NAS安全模式完成消息进行安全保护的NAS-MAC
步骤S98：UE向MME发送NAS安全模式失败(NAS Security Mode Reject)消息。
本实施例中，第一验证匹配消息在传输时可以占用现有规范中MME回传UE安全能力的IE，也可以使用一个新的IE进行传输，或者第一验证匹配消息中的除了UE安全能力之外的UE能力使用一个新的IE进行传输。
图10示出了本发明实施例十移动通信方法的流程图，本方法中，UE在NAS安全模式完成消息中将第二验证匹配消息发送给MME，如图10所示，本发明实施例十方法的主要处理步骤包括：
步骤S101：MME接收来自UE的NAS(Non-Access Stratum，非接入层)安全模式完成(NAS Security Mode Complete)消息，其中，NAS安全模式完成消息中携带用于对MME已经接收到的UE能力信息进行验证的第二验证匹配信息。
步骤S102：MME根据第二验证匹配信息，确定MME已经接收到的UE能力信息是否与UE发送给MME的UE能力信息一致。
本发明实施例十的上述方法中，第二验证匹配信息可以有多种不同的实现方式，以下将结合具体实施例进行说明。
图11示出了本发明实施例十一移动通信方法的流程图，本方法中，MME通过NAS安全模式命令消息将在附着流程中接收到的UE安全能力信息发送给UE，如图11所示，本发明实施例十一方法的主要处理步骤包括：
步骤S111：UE接收来自MME的NAS安全模式命令消息。
其中，NAS安全模式命令消息中携带MME在附着流程中已经接收到的UE安全能力、MME所采用的完整性算法及可选携带的Hash算法、秘钥标识以及NAS安全模式命令消息的第七NAS-MAC。
进一步，在NAS安全模式命令消息中还可以包括MME及UE均支持的一种加密算法、可选携带的[IMEI请求]以及可选携带的[NONCEUE、NONCEMME]，其中，NONCEUE为UE选择的随机数，NONCEMME指MME选择的随机数。
步骤S112：UE计算UE接收到的NAS安全模式命令消息的第八NAS-MAC；
步骤S113：UE确定第八NAS-MAC是否与第七NAS-MAC一致，若一致，执行步骤S114，否则，执行步骤S116。
步骤S114：UE确定MME回传的UE安全能力是否与UE发送给MME的UE安全能力一致；
步骤S115：若一致，则UE向MME发送NAS安全模式完成消息，NAS安全模式完成消息中携带用于MME对已接收到的UE能力信息进行验证的第二验证匹配信息以及NAS安全模式完成消息的NAS-MAC。
本发明实施例中，当UE安全能力及NAS安全模式命令消息的完整性验证成功时，向MME发送第二验证匹配消息，MME可以利用接收到的第二验证匹配信息对在附着流程中接收到的UE能力信息进行验证，确保MME获取正确的UE能力信息。
其中，UE向MME发送的第二验证匹配消息还可以为UE在附着流程中已经向MME发送的附着请求消息的哈希值；或者，UE在附着流程中已经向MME发送的UE能力信息的哈希值，除此之外，NAS安全模式完成消息中可选携带UE所采用的哈希算法(可选携带)、[IMEI]以及携带对NAS安全模式完成消息进行安全保护的NAS-MAC。
MME接收到UE发送的附着请求消息的哈希值或者UE能力信息的哈希值后，利用哈希算法对在附着流程中接收到的附着请求消息或UE能力信息进行哈希计算，并利用计算的结果确定MME在附着流程中接收到的附着请求消息或UE能力是否与UE发送的一致。
若不一致，则MME在NAS安全激活后，请求UE重新发送UE能力信息或附着请求内容，具体实现方式包括：
方式一：
(1)MME向eNB发送下行NAS传输(Downlink NAS Transport)消息，下行NAS传输消息中包含UE能力请求(UE Capability Request)消息或附着请求内容的请求(Attach Request Contents Request)消息；
(2)eNB向UE发送下行信息传输(Downlink Information Transfer)消息，下行信息传输消息中包含UE能力请求(UE Capability Request)消息或附着请求消息的内容请求(Attach Request Contents Request)消息；
(3)UE向eNB发送上行信息传输(Uplink Information Transfer)消息， 包含UE能力(UE capabilities)或附着请求消息的内容(Attach request contents)；
(4)eNB向MME发送上行NAS传输(Uplink NAS Transport)消息，包含UE能力(UE capabilities)或附着请求内容(Attach request contents)；
方式二：
(1)MME向eNB发送UE信息请求(UE InformationRequest)消息，UE信息请求中包含UE能力请求(UE Capability Request)消息或附着请求内容的请求(Attach Request Contents Request)消息；
(2)eNB向UE发送UE信息请求(UE InformationRequest)消息；
(3)UE向eNB发送UE信息响应(UE InformationResponse)消息，UE信息响应消息中携带UE能力(UE capabilities)或附着请求消息携带的内容(Attach request contents)；
(4)eNB向MME发送UE信息响应(UE InformationResponse)消息，其中UE信息响应消息中携带UE能力(UE capabilities)或附着请求消息的内容(Attach request contents)。
步骤S116：若不一致，UE向MME发送NAS安全模式失败(NAS Security Mode Reject)消息。
图12示出了本发明实施例十二移动通信方法的流程图，本方法中，MME通过NAS安全模式命令消息将在附着流程中接收到的UE安全能力信息发送给UE，如图12所示，本发明实施例十二的主要处理步骤包括：
步骤S121：UE接收来自MME的NAS安全模式命令消息。
其中，NAS安全模式命令消息中携带MME在附着流程中已经接收到的UE安全能力、MME及UE均支持的一种完整性算法、可选携带的Hash算法、秘钥标识以及NAS安全模式命令消息的第七NAS-MAC。
进一步，在NAS安全模式命令消息中还可以包括MME及UE均支持的一种加密算法、可选携带的[IMEI请求]以及可选携带的[NONCEUE、NONCEMME]。
步骤S122：UE计算UE接收到的NAS安全模式命令消息的第八NAS-MAC；
步骤S123：UE确定第八NAS-MAC是否与第七NAS-MAC一致，若一 致则执行步骤S124，否则，执行步骤S126。
步骤S124：UE确定MME回传的UE安全能力是否与UE发送给MME的UE安全能力一致；
步骤S125：若一致，则UE向MME发送NAS安全模式完成消息，NAS安全模式完成消息中携带UE能力信息以及NAS安全模式完成消息的NAS-MAC。
本发明实施例中，当UE安全能力及NAS安全模式命令消息的完整性验证成功时，向MME发送UE能力信息。
进一步在NAS安全模式完成消息中可选携带[IMEI]以及携带对NAS安全模式完成消息进行安全保护的NAS-MAC，从而可以保证NAS安全模式完成消息中的UE能力信息不被修改，保证MME获取正确的UE能力信息。
步骤S126：若不一致，UE向MME发送NAS安全模式失败(NAS Security Mode Reject)消息。
本实施例中，UE能力信息可以放在第二验证匹配信息IE中传输，但MME直接保存该UE能力信息，不会再次进行验证该UE能力信息是否与已经收到的附着请求中的UE能力信息相同。
本发明还提供了移动通信方法的实施例十三，该实施例方法的主要处理步骤包括：MME向UE发送NAS安全模式命令消息，NAS安全模式命令消息中携带第一验证匹配信息，用于UE根据第一验证匹配信息，确定MME已经接收到的UE能力信息是否与UE发送给MME的UE能力信息一致；若一致，则UE向MME发送NAS安全模式完成消息。
基于上述实施例十三，在其中一种实施方式中，第一验证匹配信息为MME已经接收到的附着请求消息的第一哈希值，NAS安全模式命令消息还包括MME对已经接收到的附着请求消息进行哈希计算所采用的哈希算法(可选携带)、MME所采用的完整性算法、秘钥标识以及NAS安全模式命令消息的第一非接入层消息认证NAS-MAC。
基于上述实施例十三，在其中一种实施方式中，该方法还包括：
在UE生成的NAS安全模式命令消息的第二NAS-MAC与第一NAS-MAC一致、MME回传的UE安全能力与UE发送给MME的UE安全能力一致且UE生成的附着请求消息的第二哈希值与第一哈希值不一致时， MME接收UE发送的NAS安全模式完成消息，其中NAS安全模式完成消息中携带附着请求消息或UE能力。
基于上述实施例十三，在其中一种实施方式中，第一验证匹配信息为MME已经接收到的UE能力信息的第三哈希值，NAS安全模式命令消息还包括MME对已经接收到的UE能力信息进行哈希计算所所采用的哈希算法(可选携带)、MME所采用的完整性算法、秘钥标识以及NAS安全模式命令消息的第三NAS-MAC。
基于上述实施例十三，在其中一种实施方式中，该方法还包括：
在UE生成的第四NAS-MAC与第三NAS-MAC一致、MME回传的UE安全能力与UE发送给MME的UE安全能力一致且UE生成的UE能力信息的第四哈希值与第三哈希值不一致时，MME接收UE发送的NAS安全模式完成消息，NAS安全模式完成消息中携带UE能力信息。
基于上述实施例十三，在其中一种实施方式中，第一验证匹配信息为MME已经接收到的UE能力信息，NAS安全模式命令消息还包括MME所采用的完整性算法、秘钥标识以及NAS安全模式命令消息的第五NAS-MAC。
基于上述实施例十三，在其中一种实施方式中，该方法还包括：
在UE生成的第六NAS-MAC与第五NAS-MAC一致、MME已经接收到的UE能力信息中的UE安全能力与UE发送给MME的UE安全能力一致且MME已经接收到的UE能力信息中除UE安全能力外的其它能力与UE发送给MME的不一致时，UE向MME发送NAS安全模式完成消息，NAS安全模式完成消息中携带UE能力信息。
本发明进一步提供了移动通信方法的实施例十四，该实施例的主要处理步骤包括：
(1)MME接收来自UE的NAS(Non-Access Stratum，非接入层)安全模式完成(NAS Security Mode Complete)消息，其中，NAS安全模式完成消息中携带用于对MME已经接收到的UE能力信息进行验证的第二验证匹配信息。
(2)MME根据第二验证匹配信息，确定MME已经接收到的UE能力信息是否与UE发送给MME的UE能力信息一致。
基于上述实施例十四，在其中一种实施方式中，第二验证匹配信息包括：
UE已经向MME发送的附着请求消息的哈希值；或者，
UE已经向MME发送的UE能力信息的哈希值。
基于上述实施例十四，在其中一种实施方式中，第二验证匹配信息包括：UE已经向MME发送的UE能力信息。
基于上述实施例十四，在其中一种实施方式中，该方法还包括：
若MME在附着流程中接收到的附着请求消息或UE能力与UE发送的不一致，则MME向UE发送下行NAS传输消息，下行NAS传输消息中携带UE能力信息请求消息或附着请求内容请求消息；
MME接收UE发送的上行信息传输消息，上行信息传输消息中携带UE能力信息或附着请求内容。
基于上述实施例十四，在其中一种实施方式中，该方法还包括：
若MME在附着流程中接收到的附着请求消息或UE能力与UE发送的不一致，则MME向UE发送UE信息请求消息，UE信息请求消息中携带UE能力信息请求消息或附着请求内容请求消息；
MME接收UE发送的UE信息应答消息，UE信息应答消息包携带UE能力信息或附着请求内容。
图13示出了本发明实施例十五移动通信方法的流程图，该方法中，按照现有方法执行NAS安全激活过程(对应图13中的步骤7)，NAS安全激活后，MME通过下行NAS传输(Downlink NAS Transport)消息请求UE重新上传UE能力(UE capabilities)或者附着请求内容(Attach request contents)，UE通过上行NAS传输(Uplink NAS Transport)消息上传UE能力(UE capabilities)或者附着请求内容(Attach request contents)，从而使MME获取正确的UE能力。
如图13所示，本实施例的执行过程包括：
1、处在RRC_IDLE(Radio Resource Control IDLE，无线资源控制空闲)状态的UE进行Attach过程，首先发起随机接入过程，即发送第一随机接入消息MSG1；
2、eNB检测到MSG1消息后，向UE发送随机接入响应消息，即MSG2消息；
3、UE收到随机接入响应后，根据MSG2的TA(Timing Advance，时间 提前量)调整上行发送时机，向eNB发送RRC连接请求(RRC Connection Request)消息；
4、eNB向UE发送RRC连接更新(RRC Connection Setup)消息，包含建立SRB1(signalling radio bearer1，第一信令无线承载)和无线资源配置信息；
5、UE完成SRB1承载和无线资源配置后，向eNB发送RRC连接更新完成(RRC Connection Setup Complete)消息，其中，在RRC更新完成消息中包含NAS层的附着请求(Attach request)消息；
6、eNB选择MME，向MME发送初始UE消息(Initial UE Message)，初始UE消息中包含NAS层的附着请求(Attach Request)消息；
7、UE和MME进行AKA以及NAS安全激活过程；
8、MME向eNB发送下行NAS传输(Downlink NAS Transport)消息，下行NAS传输消息中包含UE能力请求(UE Capability Request)消息或附着消息内容的请求(Attach Request Contents Request)消息；
9、eNB向UE发送下行信息传输(Downlink Information Transfer)消息，下行信息传输消息中包含UE能力请求(UE Capability Request)消息或附着请求消息的内容请求(Attach Request Contents Request)消息；
10、UE向eNB发送上行信息传输(Uplink Information Transfer)消息，包含UE能力(UE capabilities)或附着请求消息的内容(Attach request contents)；
11、eNB向MME发送上行NAS传输(Uplink NAS Transport)消息，包含UE能力(UE capabilities)或附着请求内容(Attach request contents)；
12、MME向eNB发送初始上下文建立请求(Initial Context Setup Request)消息，请求建立默认承载，其中，初始上下文建立请求消息中包含NAS层附着请求(Attach Accept)、Activate Default EPS Bearer Context Request(激活默认的演进分组核心网承载上下文请求)消息，其中EPS全拼为Evolved Packet Core，中文名称为演进的分组核心网；
13、eNB接收到初始上下文建立请求消息后，如果初始上下文建立请求消息不包含UE能力信息，则eNB向UE发送UE能力查询(UE Capability Enquiry)消息，查询UE能力；
14、UE向eNB发送UE能力信息(UE Capability Information)消息，报告UE能力信息；
15、eNB向MME发送UE能力信息显示(UE Capability Information Indication)消息，更新MME的UE能力信息；
16、eNB根据初始上下文设置请求(Initial Context Setup Request)消息中UE支持的安全信息，向UE发送安全模式命令(Security Mode Command)消息，进行安全激活；
17、UE向eNB发送安全模式完成(Security Mode Complete)消息，表示安全激活完成；
18、eNB根据初始上下文设置请求(Initial Context Setup Request)消息中的ERAB(Evolved Radio Access Bearer，演进的无线接入承载)建立信息，向UE发送RRC连接的重配置(RRC Connection Reconfiguration)消息进行UE资源重配，包括重配SRB1和无线资源配置，建立SRB2、DRB(Data Radio Bearer，数据无线承载)(包括默认承载)等；
19、UE向eNB发送RRC连接重配置完成(RRC Connection Reconfiguration Complete)消息，表示资源配置完成；
20、eNB向MME发送初始上下文设置响应(Initial Context Setup Response)消息，表明UE上下文建立完成；
21、UE向eNB发送上行信息传输(Uplink Information Transfer)消息，包含NAS层附着完成(Attach Complete)、激活默认的演进分组核心网承载上下文接受(Activate Default EPS Bearer Context Accept)消息；
22、eNB向MME发送上行NAS传输(Uplink NAS Transport)消息，包含NAS层附着完成(Attach Complete)、激活默认的演进分组核心网承载上下文接受(Activate Default EPS Bearer Context Accept)消息。
本发明实施例中的上述步骤7对应NAS安全激活过程，本发明实施例的改进步骤8～11在NAS安全激活过程之后执行。
图14示出了本发明实施例十六移动通信方法的流程图，该方法中，按照现有方法执行NAS安全激活过程(对应图14中的步骤7)，在attach流程中，NAS安全激活后，MME通过新定义的UE信息请求(UE Information Request)消息请求UE重新上传UE能力(UE capabilities)信息或附着请求中的内容 (Attach request contents)，UE通过UE信息响应(UE Information Response)消息上传UE能力(UE capabilities)或附着请求内容(Attach request contents)，从而使MME获取正确的UE能力。
如图14所示，本实施例的执行过程包括：
1、处在RRC_IDLE(Radio Resource Control IDLE，无线资源控制空闲)状态的UE进行Attach过程，首先发起随机接入过程，即发送第一随机接入消息MSG1；
2、eNB检测到MSG1消息后，向UE发送随机接入响应消息，即MSG2消息；
3、UE收到随机接入响应后，根据MSG2的TA(Timing Advance，时间提前量)调整上行发送时机，向eNB发送RRC连接请求(RRC Connection Request)消息；
4、eNB向UE发送RRC连接更新(RRC Connection Setup)消息，包含建立SRB1(signalling radio bearer1，第一信令无线承载)和无线资源配置信息；
5、UE完成SRB1承载和无线资源配置后，向eNB发送RRC连接更新完成(RRC Connection Setup Complete)消息，其中，在RRC更新完成消息中包含NAS层的附着请求(Attach request)消息；
6、eNB选择MME，向MME发送初始UE消息(Initial UE Message)，初始UE消息中包含NAS层的附着请求(Attach Request)消息；
7、UE和MME进行AKA以及NAS安全激活过程；
8、MME向eNB发送UE信息请求(UE InformationRequest)消息；
9、eNB向UE发送UE信息请求(UE InformationRequest)消息；
10、UE向eNB发送UE信息响应(UE InformationResponse)消息，UE信息响应消息中携带UE能力(UE capabilities)或附着请求消息携带的内容(Attach request contents)；
11、eNB向MME发送UE信息响应(UE InformationResponse)消息，其中UE信息响应消息中携带UE能力(UE capabilities)或附着请求消息携带的内容(Attach request contents)；
12、MME向eNB发送初始上下文建立请求(Initial Context Setup Request) 消息，请求建立默认承载，其中，初始上下文建立请求消息中包含NAS层附着请求(Attach Accept)、Activate Default EPS Bearer Context Request(激活默认的演进分组核心网承载上下文请求)消息，其中EPS全拼为Evolved Packet Core，中文名称为演进的分组核心网；
13、eNB接收到初始上下文建立请求消息后，如果初始上下文建立请求消息不包含UE能力信息，则eNB向UE发送UE能力查询(UE Capability Enquiry)消息，查询UE能力；
14、UE向eNB发送UE能力信息(UE Capability Information)消息，报告UE能力信息；
15、eNB向MME发送UE能力信息显示(UE Capability Information Indication)消息，更新MME的UE能力信息；
16、eNB根据初始上下文设置请求(Initial Context Setup Request)消息中UE支持的安全信息，向UE发送安全模式命令(Security Mode Command)消息，进行安全激活；
17、UE向eNB发送安全模式完成(Security Mode Complete)消息，表示安全激活完成；
18、eNB根据初始上下文设置请求(Initial Context Setup Request)消息中的ERAB(Evolved Radio Access Bearer，演进的无线接入承载)建立信息，向UE发送RRC连接的重配(RRC Connection Reconfiguration)消息进行UE资源重配，包括重配SRB1和无线资源配置，建立SRB2、DRB(Data Radio Bearer，数据无线承载)(包括默认承载)等；
19、UE向eNB发送RRC连接重配置完成(RRC Connection Reconfiguration Complete)消息，表示资源配置完成；
20、eNB向MME发送初始上下文设置响应(Initial Context Setup Response)消息，表明UE上下文建立完成；
21、UE向eNB发送上行信息传输(Uplink Information Transfer)消息，包含NAS层附着完成(Attach Complete)、激活默认的演进分组核心网承载上下文接受(Activate Default EPS Bearer Context Accept)消息；
22、eNB向MME发送上行NAS传输(Uplink NAS Transport)消息，包含NAS层附着完成(Attach Complete)、激活默认的演进分组核心网承载上 下文接受(Activate Default EPS Bearer Context Accept)消息。
本发明实施例中的上述步骤7对应NAS激活过程，本发明实施例的改进步骤8～11在NAS激活过程之后执行。
图15示出了本发明实施例一移动通信装置的结构示意图，该装置部署于UE中，包括：接收模块1201、验证模块1202以及第一发送模块1203，其中：
接收模块1201，用于接收来自移动管理实体MME的非接入层NAS安全模式命令消息，NAS安全模式命令消息中携带用于对MME已经接收到的UE能力信息进行验证的第一验证匹配信息；
验证模块1202，用于根据第一验证匹配信息，确定MME已经接收到的UE能力信息是否与UE发送给MME的UE能力信息一致；
第一发送模块1203，用于MME已经接收到的UE能力信息与UE发送给MME的UE能力信息一致时，向MME发送NAS安全模式完成消息。
在上述实施例中，第一验证匹配信息为MME向UE发送NAS安全模式命令消息前已经接收到的附着请求消息的第一哈希值，NAS安全模式命令消息还包括MME对已经接收到的附着请求消息进行哈希计算所采用的哈希算法、MME所采用的完整性算法、秘钥标识以及NAS安全模式命令消息的第一非接入层消息认证码NAS-MAC；
验证模块1202，具体用于：
计算UE接收到的NAS安全模式命令消息的第二NAS-MAC；
确定第二NAS-MAC是否与第一NAS-MAC一致；
若一致，根据哈希算法，计算UE发送给MME的附着请求消息的第二哈希值；
确定二哈希值是否与第一哈希值一致；
第一发送模块1203，具体用于二哈希值与第一哈希值一致且第二NAS-MAC与第一NAS-MAC一致时，向MME发送NAS安全模式完成消息。
在上述实施例中，NAS安全模式命令消息中还包括：MME回传的UE安全能力；
验证模块1202，还用于：
确定MME回传的UE安全能力是否与UE发送给MME的UE安全能力一致；
第一发送模块1203，具体用于：
若第二哈希值与第一哈希值一致、第二NAS-MAC与第一NAS-MAC一致且MME回传的UE安全能力与UE发送给MME的UE安全能力一致，则向MME发送NAS安全模式完成消息。
在上述实施例中，第一发送模块1203，还用于：
若第二哈希值、第二NAS-MAC以及MME回传的UE安全能力中的至少一项验证失败，则向MME发送NAS安全模式失败消息；
或者，
还用于：若第二NAS-MAC与第一NAS-MAC一致、MME回传的UE安全能力与UE发送给MME的UE安全能力一致且第二哈希值与第一哈希值不一致，则向MME发送NAS安全模式完成消息，该NAS安全模式完成消息中携带附着请求消息。
在上述实施例中，第一验证匹配信息为MME已经接收到的UE能力信息的第三哈希值，NAS安全模式命令消息还包括MME对已经接收到的UE能力信息进行哈希计算所所采用的哈希算法、MME所采用的完整性算法、秘钥标识以及NAS安全模式命令消息的第三NAS-MAC；
验证模块1202，具体用于：
计算UE接收到的NAS安全模式命令消息的第四NAS-MAC；
确定第四NAS-MAC是否与第三NAS-MAC一致；
若一致，根据哈希算法，计算UE发送给MME的UE能力信息的第四哈希值；
确定二哈希值是否与第三哈希值一致；
第一发送模块1203，具体用于若一致，则UE向MME发送NAS安全模式完成消息。
在上述实施例中，NAS安全模式命令消息中还包括：MME回传的UE安全能力；
验证模块1202，还用于：
确定MME回传的UE安全能力是否与UE发送给MME的UE安全能力一致；
第一发送模块1203，具体用于：
若第四哈希值与第三哈希值一致、第四NAS-MAC与第三NAS-MAC一致且MME回传的UE安全能力与UE发送给MME的UE安全能力一致，则向MME发送NAS安全模式完成消息。
在上述实施例中，第一发送模块1203，还用于：
若第四哈希值、第四NAS-MAC以及MME回传的UE安全能力中的至少一项验证失败，则UE向MME发送NAS安全模式失败消息；
或者，
第一发送模块1203，还用于若第四NAS-MAC与第三NAS-MAC一致、MME回传的UE安全能力与UE发送给MME的UE安全能力一致且第四哈希值与第三哈希值不一致，则UE向MME发送NAS安全模式完成消息，NAS安全模式完成消息中携带UE能力信息。
在上述实施例中，第一验证匹配信息为MME已经接收到的UE能力信息，NAS安全模式命令消息还包括MME所采用的完整性算法、秘钥标识以及NAS安全模式命令消息的第五NAS-MAC；
验证模块1202，具体用于：
计算UE接收到的NAS安全模式命令消息的第六NAS-MAC；
UE确定第六NAS-MAC是否与第五NAS-MAC一致；
确定MME已经接收到的UE能力信息是否与UE发送给MME的UE能力信息一致；
第一发送模块1203，具体用于若一致，则向MME发送NAS安全模式完成消息。
在上述实施例中，验证模块1202，具体用于：
确定第六NAS-MAC是否与第五NAS-MAC一致；
若一致，确定MME已经接收到的UE能力信息中所包括的UE安全能力是否与UE发送给MME的UE安全能力一致；
若一致，则UE确定MME接收到的UE能力信息中除UE安全能力外的其它能力是否分别与UE发送给MME的一致；
第一发送模块1203，具体用于若一致，则向MME发送NAS安全模式完成消息。
在上述实施例中，第一发送模块1203还用于：
若MME已经接收到的UE能力信息中除UE安全能力外的其它能力与UE发送给MME的不一致，则向MME发送NAS安全模式完成消息，NAS安全模式完成消息中携带UE能力信息。
在上述实施例中，NAS安全模式命令消息包括：MME接收到的UE安全能力、MME所采用的完整性算法、秘钥标识以及NAS安全模式命令消息的第七NAS-MAC；
验证模块1202，具体用于：
计算UE接收到的NAS安全模式命令消息的第八NAS-MAC；
确定第八NAS-MAC是否与第七NAS-MAC一致，若一致，确定MME接收到的UE安全能力是否与UE发送给MME的UE安全能力一致；
第一发送模块1203，具体用于若一致，则向MME发送NAS安全模式完成消息，NAS安全模式完成消息中携带第二验证匹配信息以及NAS安全模式完成消息的NAS-MAC。
在上述实施例中，第二验证匹配信息包括：
UE已经向MME发送的附着请求消息的哈希值；或者，
UE已经向MME发送的UE能力信息的哈希值。
在上述实施例中，第二验证匹配信息包括：UE的UE能力信息。
在上述实施例中，接收模块1201，还用于第一发送模块1203向MME发送NAS安全模式完成消息之后，接收MME发送的下行NAS传输消息，下行NAS传输消息中携带UE能力信息请求消息或者请求UE重新发送附着请求消息的请求消息；
第一发送模块1203，还用于向MME发送上行信息传输消息，上行信息传输消息中携带UE能力信息或附着请求消息。
在上述实施例中，接收模块1201还用于：
第一发送模块1203向MME发送NAS安全模式完成消息之后，接收MME发送的UE信息请求消息，UE信息请求消息携带UE能力信息请求消息或者请求UE重新发送附着请求消息的请求消息；
第一发送模块1203，还用于向MME发送UE信息应答消息，UE信息应答消息中携带UE能力信息或附着请求消息。
图16示出了本发明实施例二移动通信装置的结构示意图，该装置部署于 MME中，包括：
第二发送模块1301，用于向UE发送NAS安全模式命令消息，NAS安全模式命令消息中携带第一验证匹配信息，用于UE根据第一验证匹配信息，确定MME已经接收到的UE能力信息是否与UE发送给MME的UE能力信息一致；若一致，则UE向MME发送NAS安全模式完成消息。
在上述实施例中，第一验证匹配信息为MME已经接收到的附着请求消息的第一哈希值，NAS安全模式命令消息还包括MME对已经接收到的附着请求消息进行哈希计算所采用的哈希算法、MME所采用的完整性算法、秘钥标识以及NAS安全模式命令消息的第一非接入层消息认证NAS-MAC。
在上述实施例中，NAS安全模式命令消息中还包括：MME已经接收到的UE安全能力。
如图16所示，该装置还包括：第一接收模块1302，用于：
在UE生成的NAS安全模式命令的第二NAS-MAC与第一NAS-MAC一致、MME回传的UE安全能力与UE发送给MME的UE安全能力一致且UE生成的附着请求消息的第二哈希值与第一哈希值不一致时，接收UE发送的NAS安全模式完成消息，其中NAS安全模式完成消息中携带附着请求消息。
在上述实施例中，第一验证匹配信息为MME已经接收到的UE能力信息的第三哈希值，NAS安全模式命令消息还包括MME对已经接收到的UE能力信息进行哈希计算所所采用的哈希算法、MME所采用的完整性算法、秘钥标识以及NAS安全模式命令消息的第三NAS-MAC。
在上述实施例中，NAS安全模式命令消息中还包括：MME已经接收到的UE安全能力。
如图16所示，该装置还包括：第二接收模块1303，用于：
在UE生成的NAS安全模式命令消息的第四NAS-MAC与第三NAS-MAC一致、MME回传的UE安全能力与UE发送给MME的UE安全能力一致且UE生成的UE能力信息的第四哈希值与第三哈希值不一致时，接收UE发送的NAS安全模式完成消息，NAS安全模式完成消息中携带UE能力信息。
如图16所示，第一验证匹配信息为MME已经接收到的UE能力信息，NAS安全模式命令消息还包括MME所采用的完整性算法、秘钥标识以及 NAS安全模式命令消息的第五NAS-MAC。
如图16所示，该装置还包括：第三接收模块1304，用于：
在UE生成的NAS安全模式命令消息的第六NAS-MAC与第五NAS-MAC一致、MME已经接收到的UE能力信息中所包括的UE安全能力与UE发送给MME的UE安全能力一致且在UE确定MME已经接收到的UE能力信息中除UE安全能力外的其它能力与UE发送给MME的不一致时，接收UE发送的NAS安全模式完成消息，NAS安全模式完成消息中携带UE能力信息。
在上述实施例中，NAS安全模式命令消息包括：MME接收到的UE安全能力、MME所采用的完整性算法、秘钥标识以及NAS安全模式命令消息的第七NAS-MAC。
在上述实施例中，该装置还包括：第四接收模块1305，用于接收UE发送的NAS安全模式完成消息，NAS安全模式完成消息中携带第二验证匹配信息以及NAS安全模式完成消息的NAS-MAC；
在上述实施例中，第二验证匹配信息包括：
UE已经向MME发送的附着请求消息的哈希值；或者，
UE已经向MME发送的UE能力信息的哈希值。
在上述实施例中，第二验证匹配信息包括：UE的UE能力信息。
在上述实施例中，第二发送模块1301，还用于若MME已经接收到的UE能力信息与UE发送的不一致，则向UE发送下行NAS传输消息，下行NAS传输消息中携带UE能力信息请求消息或者请求UE重新发送附着请求消息的请求消息；
第四接收模块1305，还用于接收UE发送的上行信息传输消息，上行信息传输消息中携带UE能力信息或附着请求消息。
在上述实施例中，第二发送模块1301还用于：若MME确定MME已经接收到的UE能力信息与UE发送的不一致，则向UE发送UE信息请求消息，UE信息请求消息携带UE能力信息请求消息或者请求UE重新发送附着请求消息的请求消息；
第四接收模块1305，还用于接收UE发送的UE信息应答消息，UE信息应答消息中携带UE能力信息或附着请求消息。
图17为本发明实施例一移动通信设备的结构示意图，所述移动通信设备1400包括通信接口1401、存储器1403和处理器1402，其中，通信接口1401、处理器1402、存储器1403、通过总线1404相互连接；总线1404可以是外设部件互连标准(peripheral component interconnect，简称PCI)总线或扩展工业标准结构(extended industry standard architecture，简称EISA)总线等。所述总线可以分为地址总线、数据总线、控制总线等。为便于表示，图14中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。
所述通信接口1401用于与发送端通信。存储器1403，用于存放程序。具体地，程序可以包括程序代码，所述程序代码包括计算机操作指令。存储器1403可能包含随机存取存储器(random access memory，简称RAM)，也可能还包括非易失性存储器(non-volatile memory)，例如至少一个磁盘存储器。
处理器1402执行存储器1403所存放的程序，实现本发明前述方法实施例的方法：
接收来自移动管理实体MME的非接入层NAS安全模式命令消息，所述NAS安全模式命令消息中携带用于对所述MME已经接收到的UE能力信息进行验证的第一验证匹配信息；
根据所述第一验证匹配信息，确定所述MME已经接收到的UE能力信息是否与所述UE发送给所述MME的UE能力信息一致；
若一致，则所述UE向所述MME发送NAS安全模式完成消息。
上述的处理器1402可以是通用处理器，包括中央处理器(Central Processing Unit，简称CPU)、网络处理器(Network Processor，简称NP)等；还可以是数字信号处理器(DSP)、专用集成电路(ASIC)、现场可编程门阵列(FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件。
图18为本发明实施例二移动通信设备的结构示意图，所述移动通信设备1500包括通信接口1501、存储器1503和处理器1502，其中，通信接口1501、处理器1502、存储器1503、通过总线1504相互连接；总线1504可以是外设部件互连标准(peripheral component interconnect，简称PCI)总线或扩展工业标准结构(extended industry standard architecture，简称EISA)总线等。所 述总线可以分为地址总线、数据总线、控制总线等。为便于表示，图15中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。
所述通信接口1501用于与发送端通信。存储器1503，用于存放程序。具体地，程序可以包括程序代码，所述程序代码包括计算机操作指令。存储器1503可能包含随机存取存储器(random access memory，简称RAM)，也可能还包括非易失性存储器(non-volatile memory)，例如至少一个磁盘存储器。
处理器1502执行存储器1503所存放的程序，实现本发明前述方法实施例的方法：
确定用于UE对所述MME已经接收到的UE安全能力进行验证的第一验证匹配信息；
向所述UE发送NAS安全模式命令消息，所述NAS安全模式命令消息中携带所述第一验证匹配信息，用于所述UE根据所述第一验证匹配信息，确定所述MME已经接收到的UE能力信息是否与所述UE发送给所述MME的UE能力信息一致；若一致，则所述UE向所述MME发送NAS安全模式完成消息。
上述的处理器1502可以是通用处理器，包括中央处理器(Central Processing Unit，简称CPU)、网络处理器(Network Processor，简称NP)等；还可以是数字信号处理器(DSP)、专用集成电路(ASIC)、现场可编程门阵列(FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件。
本发明实施例的移动通信设备，UE根据接收到的第一验证匹配消息验证MME已经接收到的UE能力信息是否与UE发送给MME的UE能力信息一致，可见本发明实施例中通过MME回传验证匹配消息，UE对MME接收到的UE能力信息进行验证的方式，确保MME拥有正确的UE能力信息，解决附着(Attach)流程中附着请求(Attach Request)消息没有NAS安全上下文保护，攻击者可能修改UE能力信息，MME无法获取正确的UE能力而造成的DoS攻击问题，其中，DoS是Denial of Service的简称，即拒绝服务，造成DoS的攻击行为被称为DoS攻击。
本领域普通技术人员可以理解：实现上述方法实施例的全部或部分步骤可以通过程序指令相关的硬件来完成，前述的程序可以存储于一计算机可读取存储介质中，该程序在执行时，执行包括上述方法实施例的步骤；而前述的存储介质包括：ROM、RAM、磁碟或者光盘等各种可以存储程序代码的介质。
最后应说明的是：以上各实施例仅用以说明本发明的技术方案，而非对其限制；尽管参照前述各实施例对本发明进行了详细的说明，本领域的普通技术人员应当理解：其依然可以对前述各实施例所记载的技术方案进行修改，或者对其中部分或者全部技术特征进行等同替换；而这些修改或者替换，并不使相应技术方案的本质脱离本发明各实施例技术方案的范围。

Claims (62)

  1. 一种移动通信方法，其特征在于，包括：
    用户设备UE接收来自移动管理实体MME的非接入层NAS安全模式命令消息，所述NAS安全模式命令消息中携带用于对所述MME已经接收到的UE能力信息进行验证的第一验证匹配信息；
    所述UE根据所述第一验证匹配信息，确定所述MME已经接收到的UE能力信息是否与所述UE发送给所述MME的UE能力信息一致；
    若一致，则所述UE向所述MME发送NAS安全模式完成消息。
  2. 根据权利要求1所述的方法，其特征在于，所述第一验证匹配信息为所述MME向所述UE发送所述NAS安全模式命令消息前已经接收到的附着请求消息的第一哈希值，所述NAS安全模式命令消息还包括所述MME对已经接收到的所述附着请求消息进行哈希计算所采用的哈希算法、所述MME所采用的完整性算法、秘钥标识以及所述NAS安全模式命令消息的第一非接入层消息认证码NAS-MAC；
    所述UE计算所述UE接收到的所述NAS安全模式命令消息的第二NAS-MAC；
    所述UE确定第二NAS-MAC是否与所述第一NAS-MAC一致；
    若一致，所述UE根据哈希算法，计算所述UE发送给所述MME的附着请求消息的第二哈希值；
    所述UE确定所述二哈希值是否与所述第一哈希值一致；
    若一致，则所述UE向所述MME发送NAS安全模式完成消息。
  3. 根据权利要求2所述的方法，其特征在于，所述NAS安全模式命令消息还包括：所述MME回传的UE安全能力；
    所述UE确定所述MME回传的UE安全能力是否与所述UE发送给所述MME的UE安全能力一致；
    相应的，所述若一致，则所述UE向所述MME发送NAS安全模式完成消息，包括：
    若所述第二哈希值与所述第一哈希值一致、所述第二NAS-MAC与所述第一NAS-MAC一致且所述MME回传的UE安全能力与所述UE发送给所述MME的UE安全能力一致，则所述UE向所述MME发送NAS安全模式完成 消息。
  4. 根据权利要求3所述的方法，其特征在于，所述方法还包括：
    若所述第二哈希值、所述第二NAS-MAC以及所述MME回传的UE安全能力中的至少一项验证失败，则所述UE向所述MME发送NAS安全模式失败消息；
    或者，
    若所述第二NAS-MAC与所述第一NAS-MAC一致、所述MME回传的UE安全能力与所述UE发送给所述MME的UE安全能力一致且所述第二哈希值与所述第一哈希值不一致，则所述UE向所述MME发送NAS安全模式完成消息，该NAS安全模式完成消息中携带附着请求消息。
  5. 根据权利要求1所述的方法，其特征在于，所述第一验证匹配信息为所述MME已经接收到的UE能力信息的第三哈希值，所述NAS安全模式命令消息还包括所述MME对已经接收到的UE能力信息进行哈希计算所所采用的哈希算法、所述MME所采用的完整性算法、秘钥标识以及所述NAS安全模式命令消息的第三NAS-MAC；
    所述UE计算所述UE接收到的所述NAS安全模式命令消息的第四NAS-MAC；所述UE确定所述第四NAS-MAC是否与所述第三NAS-MAC一致；
    若一致，所述UE根据哈希算法，计算所述UE发送给所述MME的UE能力信息的第四哈希值；
    所述UE确定所述二哈希值是否与所述第三哈希值一致；
    若一致，则所述UE向所述MME发送NAS安全模式完成消息。
  6. 根据权利要求5所述的方法，其特征在于，所述NAS安全模式命令消息中还包括：所述MME回传的UE安全能力；
    所述UE确定所述MME回传的UE安全能力是否与所述UE发送给所述MME的UE安全能力一致；
    相应的，所述若一致，则所述UE向所述MME发送NAS安全模式完成消息，包括：
    若所述第四哈希值与所述第三哈希值一致、所述第四NAS-MAC与所述第三NAS-MAC一致且所述MME回传的UE安全能力与所述UE发送给所述 MME的UE安全能力一致，则所述UE向所述MME发送NAS安全模式完成消息。
  7. 根据权利要求6所述的方法，其特征在于，所述方法还包括：
    若所述第四哈希值、所述第四NAS-MAC以及所述MME回传的UE安全能力中的至少一项验证失败，则所述UE向所述MME发送NAS安全模式失败消息；
    或者，
    若所述第四NAS-MAC与所述第三NAS-MAC一致、所述MME回传的UE安全能力与所述UE发送给所述MME的UE安全能力一致且所述第四哈希值与所述第三哈希值不一致，则所述UE向所述MME发送NAS安全模式完成消息，所述NAS安全模式完成消息中携带UE能力信息。
  8. 根据权利要求1所述的方法，其特征在于，所述第一验证匹配信息为所述MME已经接收到的UE能力信息，所述NAS安全模式命令消息还包括所述MME所采用的完整性算法、秘钥标识以及所述NAS安全模式命令消息的第五NAS-MAC；
    所述UE计算所述UE接收到的所述NAS安全模式命令消息的第六NAS-MAC；
    所述UE确定所述第六NAS-MAC是否与所述第五NAS-MAC一致；
    若一致，所述UE所述MME已经接收到的UE能力信息是否与所述UE发送给所述MME的UE能力信息一致；
    若一致，则所述UE向所述MME发送NAS安全模式完成消息。
  9. 根据权利要求8所述的方法，其特征在于，所述UE确定所述第六NAS-MAC是否与所述第五NAS-MAC一致，
    若一致，所述UE确定所述MME已经接收到的所述UE能力信息中所包括的UE安全能力是否与所述UE发送给所述MME的UE安全能力一致；
    若一致，则所述UE确定所述MME接收到的所述UE能力信息中除所述UE安全能力外的其它能力是否分别与所述UE发送给所述MME的一致；
    若一致，则所述UE向所述MME发送NAS安全模式完成消息。
  10. 根据权利要求9所述的方法，其特征在于，所述方法还包括：
    若所述MME已经接收到的所述UE能力信息中除所述UE安全能力外的 其它能力与所述UE发送给所述MME的不一致，则所述UE向所述MME发送NAS安全模式完成消息，所述NAS安全模式完成消息中携带UE能力信息。
  11. 根据权利要求1所述的方法，其特征在于，所述NAS安全模式命令消息包括：所述MME接收到的UE安全能力、所述MME所采用的完整性算法、秘钥标识以及所述NAS安全模式命令消息的第七NAS-MAC；
    所述UE计算所述UE接收到的所述NAS安全模式命令消息的第八NAS-MAC；
    所述UE确定所述第八NAS-MAC是否与所述第七NAS-MAC一致；
    若一致，所述UE确定所述MME接收到的UE安全能力是否与所述UE发送给所述MME的UE安全能力一致；
    若一致，则所述UE向所述MME发送NAS安全模式完成消息，所述NAS安全模式完成消息中携带第二验证匹配信息以及所述NAS安全模式完成消息的NAS-MAC。
  12. 根据权利要求11所述的方法，其特征在于，所述第二验证匹配信息包括：
    所述UE已经向所述MME发送的附着请求消息的哈希值；或者，
    所述UE已经向所述MME发送的UE能力信息的哈希值。
  13. 根据权利要求11所述的方法，其特征在于，所述第二验证匹配信息包括：所述UE的UE能力信息。
  14. 根据权利要求11或12所述的方法，其特征在于，所述UE向所述MME发送NAS安全模式完成消息之后，还包括：
    所述UE接收所述MME发送的下行NAS传输消息，所述下行NAS传输消息中携带UE能力信息请求消息或者请求所述UE重新发送附着请求消息的请求消息；
    所述UE向所述MME发送上行信息传输消息，所述上行信息传输消息中携带所述UE能力信息或附着请求消息。
  15. 根据权利要求11或12所述的方法，其特征在于，所述UE向所述MME发送NAS安全模式完成消息之后，还包括：
    所述UE接收所述MME发送的UE信息请求消息，所述UE信息请求消 息携带UE能力信息请求消息或者请求所述UE重新发送附着请求消息的请求消息；
    所述UE向所述MME发送UE信息应答消息，所述UE信息应答消息中携带UE能力信息或附着请求消息。
  16. 一种移动通信方法，其特征在于，包括：
    MME向UE发送NAS安全模式命令消息，所述NAS安全模式命令消息中携带第一验证匹配信息，用于所述UE根据所述第一验证匹配信息，确定所述MME已经接收到的UE能力信息是否与所述UE发送给所述MME的UE能力信息一致；若一致，则所述UE向所述MME发送NAS安全模式完成消息。
  17. 根据权利要求16所述的方法，其特征在于，所述第一验证匹配信息为所述MME已经接收到的附着请求消息的第一哈希值，所述NAS安全模式命令消息还包括所述MME对已经接收到的所述附着请求消息进行哈希计算所采用的哈希算法、所述MME所采用的完整性算法、秘钥标识以及所述NAS安全模式命令消息的第一非接入层消息认证NAS-MAC。
  18. 根据权利要求17所述的方法，其特征在于，所述NAS安全模式命令消息还包括：所述MME已经接收到的UE安全能力。
  19. 根据权利要求18所述的方法，其特征在于，所述方法还包括：
    在所述UE生成的所述NAS安全模式命令消息的第二NAS-MAC与所述第一NAS-MAC一致、所述MME回传的UE安全能力与所述UE发送给所述MME的UE安全能力一致且所述UE生成的附着请求消息的第二哈希值与所述第一哈希值不一致时，所述MME接收所述UE发送的NAS安全模式完成消息，其中所述NAS安全模式完成消息中携带附着请求消息。
  20. 根据权利要求16所述的方法，其特征在于，所述第一验证匹配信息为所述MME已经接收到的UE能力信息的第三哈希值，所述NAS安全模式命令消息还包括所述MME对已经接收到的UE能力信息进行哈希计算所所采用的哈希算法、所述MME所采用的完整性算法、秘钥标识以及所述NAS安全模式命令消息的第三NAS-MAC。
  21. 根据权利要求20所述的方法，其特征在于，所述NAS安全模式命令消息中还包括：所述MME已经接收到的UE安全能力。
  22. 根据权利要求21所述的方法，其特征在于，所述方法还包括：
    在所述UE生成的所述NAS安全模式命令消息的第四NAS-MAC与所述第三NAS-MAC一致、所述MME回传的UE安全能力与所述UE发送给所述MME的UE安全能力一致且所述UE生成的UE能力信息的第四哈希值与所述第三哈希值不一致时，所述MME接收所述UE发送的NAS安全模式完成消息，所述NAS安全模式完成消息中携带UE能力信息。
  23. 根据权利要求16所述的方法，其特征在于，所述第一验证匹配信息为所述MME已经接收到的UE能力信息，所述NAS安全模式命令消息还包括所述MME所采用的完整性算法、秘钥标识以及所述NAS安全模式命令消息的第五NAS-MAC。
  24. 根据权利要求23所述的方法，其特征在于，所述方法还包括：
    在所述UE生成的所述NAS安全模式命令消息的第六NAS-MAC与所述第五NAS-MAC一致、所述MME回传的所述UE能力信息中所包括的UE安全能力与所述UE发送给所述MME的UE安全能力一致且在所述UE确定所述MME已经接收到的所述UE能力信息中除所述UE安全能力外的其它能力与所述UE发送给所述MME的不一致时，所述MME接收所述UE发送的NAS安全模式完成消息，所述NAS安全模式完成消息中携带UE能力信息。
  25. 根据权利要求16所述的方法，其特征在于，所述所述NAS安全模式命令消息包括：所述MME接收到的UE安全能力、所述MME所采用的完整性算法、秘钥标识以及所述NAS安全模式命令消息的第七NAS-MAC。
  26. 根据权利要求25所述的方法，其特征在于，所述方法还包括：
    所述MME接收所述UE发送的NAS安全模式完成消息，所述NAS安全模式完成消息中携带第二验证匹配信息以及所述NAS安全模式完成消息的NAS-MAC；
  27. 根据权利要求26所述的方法，其特征在于，所述第二验证匹配信息包括：
    所述UE已经向所述MME发送的附着请求消息的哈希值；或者，
    所述UE已经向所述MME发送的UE能力信息的哈希值。
  28. 根据权利要求26所述的方法，其特征在于，所述第二验证匹配信息包括：所述UE的UE能力信息。
  29. 根据权利要求26或27所述的方法，其特征在于，所述方法还包括：
    若所述MME确定所述MME已经接收到的所述UE能力信息与所述UE发送的不一致，则所述MME向所述UE发送下行NAS传输消息，所述下行NAS传输消息中携带UE能力信息请求消息或者请求所述UE重新发送附着请求消息的请求消息；
    所述MME接收所述UE发送的上行信息传输消息，所述上行信息传输消息中携带所述UE能力信息或附着请求消息。
  30. 根据权利要求26或27所述的方法，其特征在于，所述方法还包括：
    若所述MME确定所述MME已经接收到的所述UE能力信息与所述UE发送的不一致，则所述MME向所述UE发送UE信息请求消息，所述UE信息请求消息携带UE能力信息请求消息或者请求所述UE重新发送附着请求消息的请求消息；
    所述MME接收所述UE发送的UE信息应答消息，所述UE信息应答消息中携带UE能力信息或附着请求消息。
  31. 一种移动通信装置，其特征在于，所述装置部署于UE中，包括：
    接收模块，用于接收来自移动管理实体MME的非接入层NAS安全模式命令消息，所述NAS安全模式命令消息中携带用于对所述MME已经接收到的UE能力信息进行验证的第一验证匹配信息；
    验证模块，用于根据所述第一验证匹配信息，确定所述MME已经接收到的UE能力信息是否与所述UE发送给所述MME的UE能力信息一致；
    第一发送模块，用于MME已经接收到的UE能力信息与所述UE发送给所述MME的UE能力信息一致时，向所述MME发送NAS安全模式完成消息。
  32. 根据权利要求31所述的装置，其特征在于，所述第一验证匹配信息为所述MME向所述UE发送所述NAS安全模式命令消息前已经接收到的附着请求消息的第一哈希值，所述NAS安全模式命令消息还包括所述MME对已经接收到的所述附着请求消息进行哈希计算所采用的哈希算法、所述MME所采用的完整性算法、秘钥标识以及所述NAS安全模式命令消息的第一非接入层消息认证码NAS-MAC；
    所述验证模块，具体用于：
    计算所述UE接收到的所述NAS安全模式命令消息的第二NAS-MAC；
    确定第二NAS-MAC是否与所述第一NAS-MAC一致；
    若一致，根据哈希算法，计算所述UE发送给所述MME的附着请求消息的第二哈希值；
    确定所述二哈希值是否与所述第一哈希值一致；
    所述第一发送模块，具体用于所述二哈希值与所述第一哈希值一致且所述第二NAS-MAC与所述第一NAS-MAC一致时，向所述MME发送NAS安全模式完成消息。
  33. 根据权利要求32所述的装置，其特征在于，所述NAS安全模式命令消息中还包括：所述MME回传的UE安全能力；
    所述验证模块，还用于：
    确定所述MME回传的UE安全能力是否与所述UE发送给所述MME的UE安全能力一致；
    所述第一发送模块，具体用于：
    若所述第二哈希值与所述第一哈希值一致、所述第二NAS-MAC与所述第一NAS-MAC一致且所述MME回传的UE安全能力与所述UE发送给所述MME的UE安全能力一致，则向所述MME发送NAS安全模式完成消息。
  34. 根据权利要求33所述的装置，其特征在于，所述第一发送模块，还用于：
    若所述第二哈希值、所述第二NAS-MAC以及所述MME回传的UE安全能力中的至少一项验证失败，则向所述MME发送NAS安全模式失败消息；
    或者，
    还用于：若所述第二NAS-MAC与所述第一NAS-MAC一致、所述MME回传的UE安全能力与所述UE发送给所述MME的UE安全能力一致且所述第二哈希值与所述第一哈希值不一致，则向所述MME发送NAS安全模式完成消息，该NAS安全模式完成消息中携带附着请求消息。
  35. 根据权利要求31所述的装置，其特征在于，所述第一验证匹配信息为所述MME已经接收到的UE能力信息的第三哈希值，所述NAS安全模式命令消息还包括所述MME对已经接收到的UE能力信息进行哈希计算所所采用的哈希算法、所述MME所采用的完整性算法、秘钥标识以及所述NAS 安全模式命令消息的第三NAS-MAC；
    所述验证模块，具体用于：
    计算所述UE接收到的所述NAS安全模式命令消息的第四NAS-MAC；
    确定所述第四NAS-MAC是否与所述第三NAS-MAC一致；
    若一致，根据哈希算法，计算所述UE发送给所述MME的UE能力信息的第四哈希值；
    确定所述二哈希值是否与所述第三哈希值一致；
    所述第一发送模块，具体用于若一致，则所述UE向所述MME发送NAS安全模式完成消息。
  36. 根据权利要求35所述的装置，其特征在于，所述NAS安全模式命令消息中还包括：所述MME回传的UE安全能力；
    所述验证模块，还用于：
    确定所述MME回传的UE安全能力是否与所述UE发送给所述MME的UE安全能力一致；
    所述第一发送模块，具体用于：
    若所述第四哈希值与所述第三哈希值一致、所述第四NAS-MAC与所述第三NAS-MAC一致且所述MME回传的UE安全能力与所述UE发送给所述MME的UE安全能力一致，则向所述MME发送NAS安全模式完成消息。
  37. 根据权利要求36所述的装置，其特征在于，所述第一发送模块，还用于：
    若所述第四哈希值、所述第四NAS-MAC以及所述MME回传的UE安全能力中的至少一项验证失败，则所述UE向所述MME发送NAS安全模式失败消息；
    或者，
    所述第一发送模块，还用于若所述第四NAS-MAC与所述第三NAS-MAC一致、所述MME回传的UE安全能力与所述UE发送给所述MME的UE安全能力一致且所述第四哈希值与所述第三哈希值不一致，则所述UE向所述MME发送NAS安全模式完成消息，所述NAS安全模式完成消息中携带UE能力信息。
  38. 根据权利要求31所述的装置，其特征在于，所述第一验证匹配信息 为所述MME已经接收到的UE能力信息，所述NAS安全模式命令消息还包括所述MME所采用的完整性算法、秘钥标识以及所述NAS安全模式命令消息的第五NAS-MAC；
    所述验证模块，具体用于：
    计算所述UE接收到的所述NAS安全模式命令消息的第六NAS-MAC；
    所述UE确定所述第六NAS-MAC是否与所述第五NAS-MAC一致；
    确定所述MME已经接收到的UE能力信息是否与所述UE发送给所述MME的UE能力信息一致；
    所述第一发送模块，具体用于若一致，则向所述MME发送NAS安全模式完成消息。
  39. 根据权利要求38所述的装置，其特征在于，所述验证模块，具体用于：
    确定所述第六NAS-MAC是否与所述第五NAS-MAC一致；
    若一致，确定所述MME已经接收到的所述UE能力信息中所包括的UE安全能力是否与所述UE发送给所述MME的UE安全能力一致；
    若一致，则所述UE确定所述MME接收到的所述UE能力信息中除所述UE安全能力外的其它能力是否分别与所述UE发送给所述MME的一致；
    所述第一发送模块，具体用于若一致，则向所述MME发送NAS安全模式完成消息。
  40. 根据权利要求39所述的装置，其特征在于，所述第一发送模块还用于：
    若所述MME已经接收到的所述UE能力信息中除所述UE安全能力外的其它能力与所述UE发送给所述MME的不一致，则向所述MME发送NAS安全模式完成消息，所述NAS安全模式完成消息中携带UE能力信息。
  41. 根据权利要求31所述的装置，其特征在于，所述NAS安全模式命令消息包括：所述MME接收到的UE安全能力、所述MME所采用的完整性算法、秘钥标识以及所述NAS安全模式命令消息的第七NAS-MAC；
    所述验证模块，具体用于：
    计算所述UE接收到的所述NAS安全模式命令消息的第八NAS-MAC；
    确定所述第八NAS-MAC是否与所述第七NAS-MAC一致，若一致，确 定所述MME接收到的UE安全能力是否与所述UE发送给所述MME的UE安全能力一致；
    所述第一发送模块，具体用于若一致，则向所述MME发送NAS安全模式完成消息，所述NAS安全模式完成消息中携带第二验证匹配信息以及所述NAS安全模式完成消息的NAS-MAC。
  42. 根据权利要求41所述的装置，其特征在于，所述第二验证匹配信息包括：
    所述UE已经向所述MME发送的附着请求消息的哈希值；或者，
    所述UE已经向所述MME发送的UE能力信息的哈希值。
  43. 根据权利要求41所述的装置，其特征在于，所述第二验证匹配信息包括：所述UE的UE能力信息。
  44. 根据权利要求41或42所述的装置，其特征在于，所述接收模块，还用于所述第一发送模块向所述MME发送NAS安全模式完成消息之后，接收所述MME发送的下行NAS传输消息，所述下行NAS传输消息中携带UE能力信息请求消息或者请求所述UE重新发送附着请求消息的请求消息；
    所述第一发送模块，还用于向所述MME发送上行信息传输消息，所述上行信息传输消息中携带所述UE能力信息或附着请求消息。
  45. 根据权利要求41或42所述的装置，其特征在于，所述接收模块还用于：
    所述第一发送模块向所述MME发送NAS安全模式完成消息之后，接收所述MME发送的UE信息请求消息，所述UE信息请求消息携带UE能力信息请求消息或者请求所述UE重新发送附着请求消息的请求消息；
    所述第一发送模块，还用于向所述MME发送UE信息应答消息，所述UE信息应答消息中携带UE能力信息或附着请求消息。
  46. 一种移动通信装置，其特征在于，所述装置部署于MME中，包括：
    第二发送模块，用于向UE发送NAS安全模式命令消息，所述NAS安全模式命令消息中携带所述第一验证匹配信息，用于所述UE根据所述第一验证匹配信息，确定所述MME已经接收到的UE能力信息是否与所述UE发送给所述MME的UE能力信息一致；若一致，则所述UE向所述MME发送NAS安全模式完成消息。
  47. 根据权利要求46所述的装置，其特征在于，所述第一验证匹配信息为所述MME已经接收到的附着请求消息的第一哈希值，所述NAS安全模式命令消息还包括所述MME对已经接收到的所述附着请求消息进行哈希计算所采用的哈希算法、所述MME所采用的完整性算法、秘钥标识以及所述NAS安全模式命令消息的第一非接入层消息认证NAS-MAC。
  48. 根据权利要求47所述的装置，其特征在于，所述NAS安全模式命令消息中还包括：所述MME已经接收到的UE安全能力。
  49. 根据权利要求48所述的装置，其特征在于，所述装置还包括：第一接收模块，用于：
    在所述UE生成的所述NAS安全模式命令的第二NAS-MAC与所述第一NAS-MAC一致、所述MME回传的UE安全能力与所述UE发送给所述MME的UE安全能力一致且所述UE生成的附着请求消息的第二哈希值与所述第一哈希值不一致时，接收所述UE发送的NAS安全模式完成消息，其中所述NAS安全模式完成消息中携带附着请求消息。
  50. 根据权利要求46所述的装置，其特征在于，所述第一验证匹配信息为所述MME已经接收到的UE能力信息的第三哈希值，所述NAS安全模式命令消息还包括所述MME对已经接收到的UE能力信息进行哈希计算所所采用的哈希算法、所述MME所采用的完整性算法、秘钥标识以及所述NAS安全模式命令消息的第三NAS-MAC。
  51. 根据权利要求50所述的装置，其特征在于，所述NAS安全模式命令消息中还包括：所述MME已经接收到的UE安全能力。
  52. 根据权利要求51所述的装置，其特征在于，所述装置还包括：第二接收模块，用于：
    在所述UE生成的所述NAS安全模式命令消息的第四NAS-MAC与所述第三NAS-MAC一致、所述MME回传的UE安全能力与所述UE发送给所述MME的UE安全能力一致且所述UE生成的UE能力信息的第四哈希值与所述第三哈希值不一致时，接收所述UE发送的NAS安全模式完成消息，所述NAS安全模式完成消息中携带UE能力信息。
  53. 根据权利要求46所述的装置，其特征在于，所述第一验证匹配信息为所述MME已经接收到的UE能力信息，所述NAS安全模式命令消息还包 括所述MME所采用的完整性算法、秘钥标识以及所述NAS安全模式命令消息的第五NAS-MAC。
  54. 根据权利要求53所述的装置，其特征在于，所述装置还包括：第三接收模块，用于：
    在所述UE生成的所述NAS安全模式命令消息的第六NAS-MAC与所述第五NAS-MAC一致、所述MME已经接收到的所述UE能力信息中所包括的UE安全能力与所述UE发送给所述MME的UE安全能力一致且在所述UE确定所述MME已经接收到的所述UE能力信息中除所述UE安全能力外的其它能力与所述UE发送给所述MME的不一致时，接收所述UE发送的NAS安全模式完成消息，所述NAS安全模式完成消息中携带UE能力信息。
  55. 根据权利要求46所述的装置，其特征在于，所述所述NAS安全模式命令消息包括：所述MME接收到的UE安全能力、所述MME所采用的完整性算法、秘钥标识以及所述NAS安全模式命令消息的第七NAS-MAC。
  56. 根据权利要求55所述的装置，其特征在于，所述装置还包括：第四接收模块，用于接收所述UE发送的NAS安全模式完成消息，所述NAS安全模式完成消息中携带第二验证匹配信息以及所述NAS安全模式完成消息的NAS-MAC；
  57. 根据权利要求56所述的装置，其特征在于，所述第二验证匹配信息包括：
    所述UE已经向所述MME发送的附着请求消息的哈希值；或者，
    所述UE已经向所述MME发送的UE能力信息的哈希值。
  58. 根据权利要求56所述的装置，其特征在于，所述第二验证匹配信息包括：所述UE的UE能力信息。
  59. 根据权利要求56或57所述的装置，其特征在于，所述第二发送模块，还用于若所述MME已经接收到的所述UE能力信息与所述UE发送的不一致，则向所述UE发送下行NAS传输消息，所述下行NAS传输消息中携带UE能力信息请求消息或者请求所述UE重新发送附着请求消息的请求消息；
    所述第四接收模块，还用于接收所述UE发送的上行信息传输消息，所述上行信息传输消息中携带所述UE能力信息或附着请求消息。
  60. 根据权利要求56或57所述的装置，其特征在于，所述第二发送模块还用于：若所述MME确定所述MME已经接收到的所述UE能力信息与所述UE发送的不一致，则向所述UE发送UE信息请求消息，所述UE信息请求消息携带UE能力信息请求消息或者请求所述UE重新发送附着请求消息的请求消息；
    所述第四接收模块，还用于接收所述UE发送的UE信息应答消息，所述UE信息应答消息中携带UE能力信息或附着请求消息。
  61. 一种移动通信设备，其特征在于，所述设备部署于UE中，包括：
    通信接口、存储器、处理器和通信总线，其中，所述通信接口、所述存储器和所述处理器通过所述通信总线通信；
    所述存储器用于存放程序，所述处理器用于执行所述存储器存储的程序；当所述移动通信设备运行时，所述处理器运行程序，所述程序包括：
    接收来自移动管理实体MME的非接入层NAS安全模式命令消息，所述NAS安全模式命令消息中携带用于对所述MME已经接收到的UE能力信息进行验证的第一验证匹配信息；
    根据所述第一验证匹配信息，确定所述MME已经接收到的UE能力信息是否与所述UE发送给所述MME的UE能力信息一致；
    若一致，则向所述MME发送NAS安全模式完成消息。
  62. 一种移动通信设备，其特征在于，所述设备部署于MME中，包括：
    通信接口、存储器、处理器和通信总线，其中，所述通信接口、所述存储器和所述处理器通过所述通信总线通信；
    所述存储器用于存放程序，所述处理器用于执行所述存储器存储的程序；当所述移动通信设备运行时，所述处理器运行程序，所述程序包括：
    向UE发送NAS安全模式命令消息，所述NAS安全模式命令消息中携带第一验证匹配信息，用于所述UE根据所述第一验证匹配信息，确定所述MME已经接收到的UE能力信息是否与所述UE发送给所述MME的UE能力信息一致；若一致，则所述UE向所述MME发送NAS安全模式完成消息。
PCT/CN2016/070182 2016-01-05 2016-01-05 移动通信方法、装置及设备 WO2017117721A1 (zh)

Priority Applications (19)

Application Number Priority Date Filing Date Title
EP21163083.5A EP3873122A1 (en) 2016-01-05 2016-01-05 Avoiding a man-in-the-middle attack on an attach request message
PCT/CN2016/070182 WO2017117721A1 (zh) 2016-01-05 2016-01-05 移动通信方法、装置及设备
CN202110217166.9A CN113271594A (zh) 2016-01-05 2016-01-05 移动通信方法、装置及设备
CN202110217266.1A CN113271595B (zh) 2016-01-05 2016-01-05 移动通信方法、装置及设备
CN201910127640.1A CN109729096B (zh) 2016-01-05 2016-01-05 移动通信方法、装置及设备
KR1020187022094A KR102125826B1 (ko) 2016-01-05 2016-01-05 이동 통신 방법, 장치 및 디바이스
RU2018128207A RU2706173C1 (ru) 2016-01-05 2016-01-05 Способ, аппаратура и устройство мобильной связи
JP2018553275A JP6598225B2 (ja) 2016-01-05 2016-01-05 モバイル通信方法、装置、およびデバイス
BR112018013812-6A BR112018013812B1 (pt) 2016-01-05 Método e aparelho de comunicação móvel
EP20192538.5A EP3800914B1 (en) 2016-01-05 2016-01-05 Avoiding a man-in-the-middle attack on an attach request message
CN201680077927.2A CN108702624B (zh) 2016-01-05 2016-01-05 移动通信方法、装置及设备
CN202110217137.2A CN113055888B (zh) 2016-01-05 2016-01-05 移动通信方法、装置及设备
EP16882868.9A EP3393159B1 (en) 2016-01-05 2016-01-05 Avoiding a man-in-the-middle attack on an attach request message
US16/026,777 US10419938B2 (en) 2016-01-05 2018-07-03 Mobile communication method, apparatus, and device
US16/552,530 US10944786B2 (en) 2016-01-05 2019-08-27 Mobile communication method, apparatus, and device
US17/138,498 US11310266B2 (en) 2016-01-05 2020-12-30 Mobile communication method, apparatus, and device
US17/723,257 US11736519B2 (en) 2016-01-05 2022-04-18 Mobile communication method, apparatus, and device
US18/355,671 US12003533B2 (en) 2016-01-05 2023-07-20 Mobile communication method, apparatus, and device
US18/668,898 US20240396934A1 (en) 2016-01-05 2024-05-20 Mobile communication method, apparatus, and device

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2016/070182 WO2017117721A1 (zh) 2016-01-05 2016-01-05 移动通信方法、装置及设备

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US16/026,777 Continuation US10419938B2 (en) 2016-01-05 2018-07-03 Mobile communication method, apparatus, and device

Publications (1)

Publication Number Publication Date
WO2017117721A1 true WO2017117721A1 (zh) 2017-07-13

Family

ID=59273185

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/070182 WO2017117721A1 (zh) 2016-01-05 2016-01-05 移动通信方法、装置及设备

Country Status (7)

Country Link
US (6) US10419938B2 (zh)
EP (3) EP3873122A1 (zh)
JP (1) JP6598225B2 (zh)
KR (1) KR102125826B1 (zh)
CN (5) CN113271595B (zh)
RU (1) RU2706173C1 (zh)
WO (1) WO2017117721A1 (zh)

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20210021994A1 (en) * 2019-10-07 2021-01-21 Intel Corporation Secure user equipment capability transfer for user equipment with no access stratum security
WO2021051974A1 (zh) * 2019-09-16 2021-03-25 华为技术有限公司 一种空口信息的安全保护方法及装置
JP2022501857A (ja) * 2018-08-09 2022-01-06 オッポ広東移動通信有限公司Guangdong Oppo Mobile Telecommunications Corp., Ltd. 能力報告の方法及びデバイス
CN114208240A (zh) * 2020-01-22 2022-03-18 华为技术有限公司 数据传输方法、装置及系统

Families Citing this family (21)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP6651613B2 (ja) * 2015-10-05 2020-02-19 テレフオンアクチーボラゲット エルエム エリクソン（パブル） ワイヤレス通信
EP3873122A1 (en) 2016-01-05 2021-09-01 Huawei Technologies Co., Ltd. Avoiding a man-in-the-middle attack on an attach request message
CA3016848C (en) * 2016-03-28 2024-01-09 Panasonic Intellectual Property Corporation Of America User equipment, base station and codec mode switching method
US20180083972A1 (en) * 2016-09-20 2018-03-22 Lg Electronics Inc. Method and apparatus for security configuration in wireless communication system
MX2019008888A (es) * 2017-01-30 2019-10-15 Telefonaktiebolaget LM Ericsson publi Comunicaciones inalámbricas.
CN109756451B (zh) * 2017-11-03 2022-04-22 华为技术有限公司 一种信息交互方法及装置
KR102405412B1 (ko) * 2018-04-06 2022-06-07 삼성전자주식회사 무선 통신 시스템에서 정보 보안을 위한 장치 및 방법
US10798745B2 (en) * 2018-09-28 2020-10-06 Verizon Patent And Licensing Inc. Determining device locations based on random access channel signaling
KR102460418B1 (ko) * 2018-11-21 2022-10-31 한국전자통신연구원 통신 시스템에서 제어 메시지의 송수신 방법 및 장치
WO2020148172A1 (en) * 2019-01-15 2020-07-23 Telefonaktiebolaget Lm Ericsson (Publ) Radio access capabilities of a wireless device
US11470473B2 (en) * 2019-01-18 2022-10-11 Qualcomm Incorporated Medium access control security
CN111866884B (zh) * 2019-04-26 2022-05-24 华为技术有限公司 一种安全保护方法及装置
CN112087747A (zh) * 2019-06-14 2020-12-15 苹果公司 改善的rrc过程安全性
US20210105611A1 (en) * 2019-10-04 2021-04-08 Qualcomm Incorporated User equipment radio capability protection
EP4084516A4 (en) * 2019-12-27 2023-09-20 Ntt Docomo, Inc. BASE STATION AND WIRELESS COMMUNICATION METHOD
CN115087971A (zh) * 2020-02-14 2022-09-20 瑞典爱立信有限公司 保护无线通信网络中的能力信息传输
KR102279293B1 (ko) * 2020-08-07 2021-07-20 한국인터넷진흥원 비암호화 채널 탐지 방법 및 장치
US11522767B2 (en) 2020-10-22 2022-12-06 Bank Of America Corporation System for real-time imitation network generation using artificial intelligence
KR20220135792A (ko) * 2021-03-31 2022-10-07 삼성전자주식회사 데이터 보호를 위한 nas 메시지 이용 방법 및 장치
EP4500798A1 (en) * 2022-03-24 2025-02-05 Four Drobotics Corporation System and method for detection of cybersecurity threats
CN119155677A (zh) * 2023-06-14 2024-12-17 华为技术有限公司 通信方法和通信装置

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101378591A (zh) * 2007-08-31 2009-03-04 华为技术有限公司 终端移动时安全能力协商的方法、系统及装置
CN101384079A (zh) * 2007-09-03 2009-03-11 华为技术有限公司 一种终端移动时防止降质攻击的方法、系统及装置
US20100115275A1 (en) * 2008-11-03 2010-05-06 Samsung Electronics Co. Ltd. Security system and method for wireless communication system
CN101835156A (zh) * 2010-05-21 2010-09-15 中兴通讯股份有限公司 一种用户接入安全保护的方法及系统
US20140241317A1 (en) * 2013-02-22 2014-08-28 Samsung Electronics Co., Ltd. Method and system for providing simultaneous connectivity between multiple e-nodebs and user equipment
CN104967984A (zh) * 2015-04-29 2015-10-07 大唐移动通信设备有限公司 一种获取用户设备的信息的方法和系统

Family Cites Families (32)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR101061373B1 (ko) * 2005-04-11 2011-09-02 삼성전자주식회사 푸쉬투토크 오버 셀룰러 망의 미디어 저장 서비스 수행 방법과 ＰｏＣ 서버 및 ＰｏＣ 클라이언트
CN101022330A (zh) * 2006-02-13 2007-08-22 华为技术有限公司 提高密钥管理授权消息安全性的方法和模块
CN101011330A (zh) 2006-12-14 2007-08-08 成都死海盐疗健康馆服务有限公司 矿物盐沐浴露
CN101242629B (zh) * 2007-02-05 2012-02-15 华为技术有限公司 选择用户面算法的方法、系统和设备
US9247420B2 (en) * 2007-12-12 2016-01-26 Lg Electronics Inc. Method of managing user equipment capabilities
US8503460B2 (en) * 2008-03-24 2013-08-06 Qualcomm Incorporated Dynamic home network assignment
US8965338B2 (en) * 2008-06-09 2015-02-24 Apple Inc Network access control methods and apparatus
CN101686233B (zh) * 2008-09-24 2013-04-03 电信科学技术研究院 Ue与网络安全算法不匹配的处理方法、系统及装置
CN101848464B (zh) * 2009-03-28 2012-11-21 华为技术有限公司 实现网络安全的方法、装置及系统
US8605904B2 (en) * 2009-08-14 2013-12-10 Industrial Technology Research Institute Security method in wireless communication system having relay node
CN102025685B (zh) * 2009-09-21 2013-09-11 华为技术有限公司 认证处理方法及装置
KR101700448B1 (ko) * 2009-10-27 2017-01-26 삼성전자주식회사 이동 통신 시스템에서 보안 관리 시스템 및 방법
KR101683883B1 (ko) * 2009-12-31 2016-12-08 삼성전자주식회사 이동 통신 시스템에서 보안을 지원하는 방법 및 시스템
CN101790168B (zh) * 2010-02-01 2015-05-20 中兴通讯股份有限公司 Nas和as初始安全模式命令过程的方法
KR101737425B1 (ko) * 2010-06-21 2017-05-18 삼성전자주식회사 응급 콜을 지원하는 이동 통신 시스템에서 보안 관리 방법 및 장치와 그 시스템
CN102624759B (zh) * 2011-01-28 2017-03-29 中兴通讯股份有限公司 一种实现会话中数据迁移的方法和节点
CN102307091B (zh) * 2011-10-09 2014-10-29 大唐移动通信设备有限公司 Nas层信令的保护方法和设备
CN102917332B (zh) * 2012-10-11 2015-06-03 大唐移动通信设备有限公司 一种实现移动设备附着的方法及装置
CN102905265B (zh) * 2012-10-11 2016-02-10 大唐移动通信设备有限公司 一种实现移动设备附着的方法及装置
KR101807487B1 (ko) * 2013-01-10 2017-12-11 닛본 덴끼 가부시끼가이샤 Ue 및 네트워크 양자에서의 키 도출을 위한 mtc 키 관리
CN104427584B (zh) * 2013-08-19 2019-08-16 南京中兴软件有限责任公司 安全上下文处理方法及装置
KR101746193B1 (ko) * 2013-11-13 2017-06-20 한국전자통신연구원 보안 도우미 서비스 제공장치 및 서비스 제공방법
EP3122144B8 (en) * 2014-04-16 2019-03-13 Huawei Device Co., Ltd. Device and method for accessing wireless network
US10560846B2 (en) * 2014-09-08 2020-02-11 Blackberry Limited Method and apparatus for authenticating a network entity using unlicensed wireless spectrum
US10142840B2 (en) * 2015-01-29 2018-11-27 Motorola Mobility Llc Method and apparatus for operating a user client wireless communication device on a wireless wide area network
US9717003B2 (en) * 2015-03-06 2017-07-25 Qualcomm Incorporated Sponsored connectivity to cellular networks using existing credentials
US9801055B2 (en) * 2015-03-30 2017-10-24 Qualcomm Incorporated Authentication and key agreement with perfect forward secrecy
CN111726804B (zh) * 2015-06-05 2023-12-01 艾普拉控股有限公司 用于集成小型小区和Wi-Fi网络的统一认证
CN104967934A (zh) 2015-06-12 2015-10-07 苏州佑克骨传导科技有限公司 适用于小功率骨传导耳机的振子
US10567964B2 (en) * 2015-11-24 2020-02-18 Futurewei Technologies, Inc. Security for proxied devices
EP4102871B1 (en) * 2015-12-03 2025-02-05 Telefonaktiebolaget LM Ericsson (publ) Multi-rat security setup
EP3873122A1 (en) * 2016-01-05 2021-09-01 Huawei Technologies Co., Ltd. Avoiding a man-in-the-middle attack on an attach request message

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101378591A (zh) * 2007-08-31 2009-03-04 华为技术有限公司 终端移动时安全能力协商的方法、系统及装置
CN101384079A (zh) * 2007-09-03 2009-03-11 华为技术有限公司 一种终端移动时防止降质攻击的方法、系统及装置
US20100115275A1 (en) * 2008-11-03 2010-05-06 Samsung Electronics Co. Ltd. Security system and method for wireless communication system
CN101835156A (zh) * 2010-05-21 2010-09-15 中兴通讯股份有限公司 一种用户接入安全保护的方法及系统
US20140241317A1 (en) * 2013-02-22 2014-08-28 Samsung Electronics Co., Ltd. Method and system for providing simultaneous connectivity between multiple e-nodebs and user equipment
CN104967984A (zh) * 2015-04-29 2015-10-07 大唐移动通信设备有限公司 一种获取用户设备的信息的方法和系统

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
"Mechanisms of Limit EIAO Usage for Emergency Call Purpose Only", 3GPP TSG-SA3 (SECURITY) MEETING SA3W55, 15 May 2009 (2009-05-15), pages 1 - 3 *

Cited By (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2022501857A (ja) * 2018-08-09 2022-01-06 オッポ広東移動通信有限公司Guangdong Oppo Mobile Telecommunications Corp., Ltd. 能力報告の方法及びデバイス
JP7385648B2 (ja) 2018-08-09 2023-11-22 オッポ広東移動通信有限公司 能力報告の方法及びデバイス
WO2021051974A1 (zh) * 2019-09-16 2021-03-25 华为技术有限公司 一种空口信息的安全保护方法及装置
US12089045B2 (en) 2019-09-16 2024-09-10 Huawei Technologies Co., Ltd. Air interface information security protection method and apparatus
US20210021994A1 (en) * 2019-10-07 2021-01-21 Intel Corporation Secure user equipment capability transfer for user equipment with no access stratum security
US11617077B2 (en) * 2019-10-07 2023-03-28 Intel Corporation Secure user equipment capability transfer for user equipment with no access stratum security
CN114208240A (zh) * 2020-01-22 2022-03-18 华为技术有限公司 数据传输方法、装置及系统
CN114208240B (zh) * 2020-01-22 2024-01-30 华为技术有限公司 数据传输方法、装置及系统

Also Published As

Publication number Publication date
RU2706173C1 (ru) 2019-11-14
EP3800914A1 (en) 2021-04-07
US20180324594A1 (en) 2018-11-08
CN113055888B (zh) 2022-03-08
EP3393159A1 (en) 2018-10-24
US20220321599A1 (en) 2022-10-06
CN113271594A (zh) 2021-08-17
US10944786B2 (en) 2021-03-09
CN109729096B (zh) 2020-06-16
KR102125826B1 (ko) 2020-06-23
CN113055888A (zh) 2021-06-29
KR20180100365A (ko) 2018-09-10
CN113271595B (zh) 2022-03-08
US12003533B2 (en) 2024-06-04
US11736519B2 (en) 2023-08-22
US20190387404A1 (en) 2019-12-19
CN113271595A (zh) 2021-08-17
BR112018013812A2 (zh) 2018-12-11
US11310266B2 (en) 2022-04-19
JP6598225B2 (ja) 2019-10-30
JP2019501608A (ja) 2019-01-17
EP3800914B1 (en) 2024-05-01
CN108702624B (zh) 2021-02-23
US20240396934A1 (en) 2024-11-28
EP3393159A4 (en) 2018-12-19
CN108702624A (zh) 2018-10-23
US20240098112A1 (en) 2024-03-21
US20210194920A1 (en) 2021-06-24
EP3393159B1 (en) 2020-09-30
EP3873122A1 (en) 2021-09-01
US10419938B2 (en) 2019-09-17
CN109729096A (zh) 2019-05-07

Similar Documents

Publication Publication Date Title
WO2017117721A1 (zh) 移动通信方法、装置及设备
US11412473B2 (en) PDU session management
US8555064B2 (en) Security system and method for wireless communication system
TWI463856B (zh) 促進安全性配置的同步的方法和裝置
US11889301B2 (en) Security verification when resuming an RRC connection
JP2018510578A (ja) 完全前方秘匿性を有する認証および鍵共有
JP6725764B2 (ja) 無線リソース制御接続の再確立
WO2019071472A1 (zh) 一种业务策略创建方法及装置
WO2019213925A1 (zh) 密钥更新方法、设备和存储介质
WO2018228444A1 (zh) 连接管理方法、终端及无线接入网设备
BR112018013812B1 (pt) Método e aparelho de comunicação móvel

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16882868

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2018553275

Country of ref document: JP

Kind code of ref document: A

WWE Wipo information: entry into national phase

Ref document number: 122021001669

Country of ref document: BR

NENP Non-entry into the national phase

Ref country code: DE

REG Reference to national code

Ref country code: BR

Ref legal event code: B01A

Ref document number: 112018013812

Country of ref document: BR

WWE Wipo information: entry into national phase

Ref document number: 2016882868

Country of ref document: EP

ENP Entry into the national phase

Ref document number: 2016882868

Country of ref document: EP

Effective date: 20180718

ENP Entry into the national phase

Ref document number: 20187022094

Country of ref document: KR

Kind code of ref document: A

ENP Entry into the national phase

Ref document number: 112018013812

Country of ref document: BR

Kind code of ref document: A2

Effective date: 20180705