WO2017128306A1

WO2017128306A1 - Communication method and equipment

Info

Publication number: WO2017128306A1
Application number: PCT/CN2016/072818
Authority: WO
Inventors: 石小丽; 张宏卓; 罗海燕; 彭文杰
Original assignee: 华为技术有限公司
Priority date: 2016-01-29
Filing date: 2016-01-29
Publication date: 2017-08-03

Abstract

The embodiments of the invention comprise a communication method and equipment. The method comprises: core network equipment obtains a first key generated when access network equipment executes an access stratum security activation procedure; and after receiving a data packet transmitted by user equipment, the core network equipment decrypts, by utilizing the first key, the data packet. According to the embodiments of the invention, the core network equipment can accurately decrypt, using the key generated during the access stratum security activation procedure executed with the access network equipment, a data packet encrypted by user equipment, reducing the possibility of packet loss, ensuring normal communication between user equipment and a network, and enhancing user experience.

Description

Communication method and device

Technical field

The present invention relates to the field of communications technologies, and in particular, to a communication method and device.

Background technique

At present, due to the rapid development of intelligent terminals and mobile applications, the mobile data traffic has increased dramatically. In order to improve the efficiency of data transmission when sending sparse packets on the base station, a RRC (Radio Resource Control) connectionless technology is proposed. The RRC connectionless technology, the User Equipment (UE) may not establish an RRC connection with the base station, but directly send the user data to the core network.

Under the condition that the RRC connection is established, the data is encrypted between the UE and the base station by using a good protocol key, and the key is known only by the UE and the base station. When the UE communicates with the core network device without the RRC connection, when the UE enters the idle state, the base station releases the context information of the UE, including the key used to transmit data when the RRC connection is established. If the UE still uses the key under the RRC connection to encrypt the data, the network side cannot correctly decrypt the data packet, and the data packet may be discarded, which affects the normal communication of the UE and reduces the user experience.

Summary of the invention

The embodiment of the present invention provides a communication method, device, and system, which can implement correct decryption of a data packet encrypted by a user equipment using a key under an RRC connection, thereby ensuring normal communication of the user equipment. Improve the user experience.

In one aspect, embodiments of the present invention provide a method of communication. The method includes: acquiring, by the core network device, a first key, where the first key is generated by the access network device in performing an access layer security activation process Key. After receiving the data packet sent by the user equipment, the core network device decrypts the data packet by using the first key. The embodiment of the present invention can implement that the core network device can correctly decrypt the data packet encrypted by the user equipment and the key generated by the access network device to perform the access layer security activation process, thereby reducing the possibility that the data packet is discarded. The normal communication between the user equipment and the network is ensured, and the user experience is improved.

In a possible design, the acquiring, by the core network device, the first key may include: sending, by the core network device, a first request message to the access network device, where the first request message is used to request the first key. After receiving the first request message, the access network device carries the first key generated by the access layer security activation process in the first response message and sends the first key to the core network device. The core network device receives the first response message sent by the access network device, and obtains the first key. The core network device can actively request the access network device to perform the key generated by the access layer security activation process by the access network device, and when receiving the data sent by the user equipment, the core network can be implemented. The device directly decrypts the key obtained from the access network device to ensure that the user equipment can communicate normally.

In a possible design, the first request message may include an initial context setup request, and the first response message may include: an initial context setup response; or the first request message may include The access bearer setup request ERAB setup request, where the first response message may include an access bearer setup response ERAB setup response. The embodiment of the present invention can implement the use of the response or request that needs to be sent in the existing attaching process to implement the key acquisition, so that the core network device can be used at a small cost or without changing the existing process structure. The key generated by the access network device and the user equipment to perform the access layer security activation process is ensured, thereby ensuring normal communication of the user equipment and reducing the cost.

In a possible design, the acquiring, by the core network device, the first key may include: after the access network device performs the access layer security activation process, after the first key is generated, the access network device passes the first indication information. The first key is actively sent to the core network device. The core network device receives the first indication information sent by the access network device, where the first indication information carries the first key. Where the first finger The indication information may also instruct the core network device to decrypt the data sent by the user equipment by using the first key. The embodiment of the present invention can be implemented that the access network device can actively send the first key to the core network device, so that the core network device obtains the first key, and can correctly decrypt the data packet sent by the user equipment, thereby ensuring that the data packet is correctly decrypted. The normal communication of the user equipment improves the user experience.

In a possible design, the foregoing first indication information includes: an initial context setup response or an access bearer setup response ERAB setup response. The embodiment of the present invention can implement the use of the response or request that needs to be sent in the existing attaching process to implement the key acquisition, so that the core network device can be used at a small cost or without changing the existing process structure. The key generated by the access network device and the user equipment to perform the access layer security activation process is ensured, thereby ensuring normal communication of the user equipment and reducing the cost.

In a possible design, the core network device may send a second key generated by the non-access stratum security activation process to the access network device, where the second key is used by the access network device to derive the first key, The acquiring, by the core network device, the first key may include: the core network device acquiring an encryption algorithm used to derive the first key, and the core network device generating the first key according to the second key and the encryption algorithm. The core network device can generate the first key by itself, for example, the first key can be generated in the non-access layer security activation process, so that the core network device receives the user equipment and sends the first key. After the encrypted data packet, the first key can be used for decryption, which ensures the normal communication of the user equipment and improves the user experience.

In a possible design, the encryption algorithm used by the core network device to obtain the deduced first key may include: the core network device sends a second request message to the access network device, where the second request message is used to request access. The identifier of the encryption algorithm used by the network device to derive the first key. After receiving the second request message, the access network device may send the identifier of the encryption algorithm for deriving the first key used in performing the access layer security activation process to the core network device by using the second response message. The core network device receives the second response message sent by the access network device, and obtains an encryption algorithm used by the access network device to derive the first key. According to the embodiment of the present invention, the core network device requests the access network device to extract the identifier of the encryption algorithm of the first key, and the second core network device knows the second key. The core network device may further generate the first key, so that after receiving the data sent by the user equipment, the first key is used for decryption, thereby ensuring normal communication of the user equipment.

Optionally, the foregoing second request message may include: an initial context setup request, where the second response message may include: an initial context setup response; or the second request message may include, access The bearer setup request ERAB setup request, the second response message may include an access bearer setup response ERAB setup response. The embodiment of the present invention can realize that the identifier of the encryption algorithm for deriving the first key is obtained by using the response or request that needs to be sent in the existing attaching process, so that the existing one can be used with little cost or no change. In the process structure, the core network device can obtain the first key to ensure that the user equipment communicates normally while reducing the cost.

In a possible design, the encryption algorithm used by the core network device to obtain the deduced first key may include: an encryption algorithm used by the access network device to perform the access layer security activation process for deriving the first key. The identifier is carried in the second indication information and sent to the core network device. The core network device receives the second indication information sent by the access network device, and the core network obtains an encryption algorithm used to derive the first key. The embodiment of the present invention can be implemented that the access network device can actively send the identifier of the encryption algorithm used to derive the first key to the core network device, so that the core network device can obtain the first key according to the algorithm, thereby enabling the user to The data packets sent by the device are correctly decrypted to ensure normal communication of the user equipment and improve the user experience.

In a possible design, the foregoing second indication information may include: an initial context setup response or an access bearer setup response ERAB setup response. The embodiment of the present invention can realize that the identifier of the encryption algorithm for deriving the first key is obtained by using the response or request that needs to be sent in the existing attaching process, so that the existing one can be used with little cost or no change. In the process structure, the core network device can obtain the first key to ensure that the user equipment communicates normally while reducing the cost.

In a possible design, when there is no RRC connection between the user equipment and the access network device, the core network device receives the data packet sent by the user equipment, and uses the first key determined by the foregoing method. Decrypt the data packet sent by the user equipment. In the embodiment of the present invention, when the RRC connection is not available, or the RRC connection is released, and the access network device releases the context information of the user equipment, the user equipment still encrypts the data by using the key generated by the RRC connection. After the encrypted data packet is transmitted to the core network device, it can still be decrypted correctly, ensuring normal communication of the user equipment and improving the user experience.

In another aspect, an embodiment of the present invention provides a communication method. The method includes: when the access network device performs the access layer security activation process, the access network device generates the first key. The access network device sends the identifier of the encryption algorithm used by the first key or the access network device to derive the first key to the core network device, where the first key is used by the core network device to decrypt the data sent by the user equipment. .

In a possible design, the access network device sends the identifier of the first key or the encryption algorithm used to derive the first key to the core network device, which may include: the access network device and the first key or derivation The algorithm identifier of the encryption algorithm used by the first key is carried in the initial context setup response or the EBB setup response, and is sent to the core network device.

In a possible design, before the foregoing access network device sends the identifier of the encryption algorithm used by the first key or the derivation of the first key to the core network device, the method may further include: the access network device receiving the core A request message sent by the network device, the request message is used to request the identifier of the first key or the encryption algorithm.

In a possible design, the foregoing request message of the aspect may specifically include an initial context setup request or an access bearer setup request ERAB setup request.

On the other hand, an embodiment of the present invention provides an access network device, which has the function of implementing the behavior of the access network device in the foregoing method. The functions may be implemented by hardware or by corresponding software implemented by hardware. The hardware or software includes one or more modules corresponding to the functions described above.

In a possible design, the structure of the access network device includes a processor and a communication unit, The processor is configured to support the access network device to perform the corresponding function in the above method. The communication unit is configured to support communication between the access network device and the core network device, and send information or instructions involved in the foregoing method to the core network device. The access network device can also include a memory for coupling with the processor that retains the necessary program instructions and data for the access network device.

In another aspect, an embodiment of the present invention provides a core network device. The core network device may be a network entity in the core network, such as a mobility management entity MME, or a gateway (such as a Serving Gateway (SGW) and/or a Packet Data Network Gateway (PGW)). The core network device is configured to decrypt the data sent by the user equipment, where the key required for decryption can be implemented by the foregoing method, and the core network device has the function of realizing the behavior of the core network device in the actual method. The functions may be implemented by hardware or by corresponding software implemented by hardware. The hardware or software includes one or more modules corresponding to the functions described above.

In one possible design, the structure of the core network device includes a processor and a communication unit configured to support the core network device to perform the corresponding functions in the above methods. The communication unit is configured to support communication between the core network device and the access network device, and send information or instructions involved in the foregoing method to the access network device. The core network device can also include a memory for coupling with the processor that retains the necessary program instructions and data for the core network device.

In another aspect, an embodiment of the present invention provides a communication system, where the system includes the access network device and the core network device according to the foregoing aspect; or the system includes the core network device described in the foregoing aspect.

In still another aspect, an embodiment of the present invention provides a computer storage medium for storing computer software instructions for use in the access network device, including a program designed to perform the above aspects.

In still another aspect, an embodiment of the present invention provides a computer storage medium for storing computer software instructions for use in the core network device, including a program designed to perform the above aspects.

The embodiments provided by the embodiments of the present invention can implement that the core network device can use the user equipment. The key under the RRC connection performs the correct decryption of the encrypted data packet, ensuring normal communication of the user equipment and improving the user experience.

DRAWINGS

FIG. 1 is a schematic diagram of a communication system according to an embodiment of the present invention;

2 shows a schematic diagram of an LTE network architecture;

FIG. 3 is a flowchart of a communication method according to an embodiment of the present invention;

4 is a schematic diagram of communication of a communication method according to an embodiment of the present invention;

FIG. 5 is a schematic diagram of another communication method according to an embodiment of the present invention; FIG.

FIG. 6 is a schematic diagram of communication of another communication method according to an embodiment of the present invention;

FIG. 7 is a schematic structural diagram of a communication apparatus according to an embodiment of the present invention;

FIG. 8 is a schematic structural diagram of another communication apparatus according to an embodiment of the present invention;

FIG. 9 is a schematic structural diagram of hardware of an access network device according to an embodiment of the present disclosure;

FIG. 10 is a schematic structural diagram of hardware of a core network device according to an embodiment of the present invention.

detailed description

The technical solution of the present invention will be further described in detail below through the accompanying drawings and embodiments.

In the embodiment of the present invention, the core network device obtains the encryption key of the data plane of the user equipment in the process of attaching the user equipment. When the data sent by the user equipment is transparently transmitted to the core network device through the access network device, the core network may be utilized. The encryption key obtained above is decrypted, thereby ensuring normal communication between the user equipment and the network, and improving the user experience.

FIG. 1 is a schematic diagram of a communication system according to an embodiment of the present invention. FIG. 1 is a schematic diagram showing a partial structure of a system architecture related to an embodiment of the present invention. As shown in FIG. 1 , the system architecture may include: a core network device 101, an access network device 102, and a user equipment 103. The user equipment 103 can access the core network device 103 through the access network device 102 to perform communication, and further, can access the Internet through the core network to perform Internet communication.

The core network device 101 may be a device that provides a user connection, management of the user, and completion of the bearer for the service, and serves as an interface for the bearer network to provide an interface to the external network. The establishment of the user connection includes mobility management (MM), call management (CM), switching/routing, and recording notification (in combination with the connection of the intelligent network service to the intelligent network peripheral device). User management includes user description, QoS (Quality of Service), user communication record (Accounting), dialogue with intelligent network platform to provide virtual home environment, security (the corresponding security measures provided by the authentication center include Security management of mobile services and security of access to external networks). Access to include external PSTN, external circuit data network and packet data network, Internet and Intranets, and mobile own SMS server. The basic services that the core network can provide include mobile office, e-commerce, communication, entertainment. Sexual business, travel and location-based services, Telemetry simple messaging services (monitoring controls) and more. For example, an MME (Mobility Management Entity), an SGW (Serving GateWay), a P-GW (Packet Data Network Gateway), and the like in an LTE network. For the convenience of the description, in the present application, the foregoing provides a user connection, a management of the user, and a service completion bearer, and the device that provides the interface to the external network as the bearer network is collectively referred to as the core network device, or the MME in the LTE system is taken as an example. description.

Access network device 102 can be a device deployed in a wireless access network to provide wireless communication functionality to a UE or WD. The apparatus may include various forms of macro base stations, micro base stations, relay stations, access points, and the like. In a system using different radio access technologies, the name of a device having a base station function may be different. For example, in an LTE network, an evolved Node B (evolved Node B: eNB or eNodeB) is in the third. In the 3G network, it is called Node B and so on. For convenience of description, in the present application, the foregoing apparatus for providing a wireless communication function for a UE is collectively referred to as an access network device, or an eNB in an LTE system is taken as an example for description.

User equipment 103 may include various handheld devices with wireless communication capabilities, in-vehicle devices, wearable devices, computing devices, or other processing devices connected to wireless modems, as well as various forms of User Equipment (UE), mobile Mobile station (MS), Terminal, Terminal Equipment, etc.

The technology described in the present invention can be applied to a Long Term Evolution (LTE) system, or other wireless communication systems using various radio access technologies, for example, using code division multiple access, frequency division multiple access, time division multiple access, A system of orthogonal frequency division multiple access, single carrier frequency division multiple access and other access technologies. In addition, it can also be applied to the subsequent evolution system using the LTE system, such as the fifth generation 5G system and the like. For the sake of clarity, only the LTE system is taken as an example here. FIG. 2 is a schematic diagram of an LTE network architecture, which mainly includes a UE, an E-UTRAN (Evolved Universal Terrestrial Radio Access Network), and an EPC (Evolved Packet Core). And so on. EPC is mainly composed of MME, P-GW, SGW, etc. It can realize the traditional capabilities of mobile network such as user subscription data storage, mobility management and data exchange, and can provide users with ultra-high speed Internet experience. In addition, the E-UTRAN may be a network composed of a plurality of eNBs, and implement functions such as wireless physical layer functions, resource scheduling and radio resource management, radio access control, and mobility management.

The embodiment of the present invention is mainly applicable to the process of attaching a user equipment. The user equipment is a process of registering in the network before the user equipment performs the actual service. After the user equipment is successfully attached, the user equipment can receive the network. The service sent by the device. For convenience of description, the user equipment attachment process based on the LTE system is described as an example in the embodiment of the present invention.

The following is a further introduction to the user equipment attachment process based on the LTE system.

The attachment process is generally initiated by the user equipment. For example, the user equipment may trigger the attachment when the device is powered on, or the user equipment needs to reattach after leaving the network coverage for a period of time.

The user equipment attachment process mainly achieves the following purposes:

1. The user equipment and the network device authenticate each other, and the user equipment establishes a context with the network device. 2. The network device establishes a bearer for the user equipment. 3. The user equipment obtains the IP address assigned by the network device. Fourth, the location registration of the user equipment. 5. The network device allocates a temporary identity to the user equipment. and many more.

Wherein, when the first attachment occurs, an RRC connection is established between the UE and the eNB. At the end of this section In an RRC Connection Setup Complete message (RRC Connection Setup Complete message), the UE will also bring an Attach Request message (attach request message). After the message arrives at the access network device, the eNB sends an Initial UE Message (initial UE message) to the MME, and then places an Attach Request message (attach request message) into the message.

Authentication process: The authentication process is that the core network device obtains an authentication vector from the HSS (Home Subscriber Server) that the user subscribes to. The authentication vector includes K _ASME (Key Access Security Management Entity). ). K _{ASME is} used to derive the encryption and integrity protection keys, which can be derived from the relevant keys.

NAS (Non-access stratum) security activation process: The NAS security activation process is a process of establishing an encryption and integrity protection context between the UE and the MME. After this process, NAS messages between the MME and the UE are encrypted and integrity protected to ensure secure signaling. The algorithm used by the MME to inform the UE of the algorithm ID, the MME and the UE can respectively _derive the NAS layer encryption key according to the K _ASME , which mainly includes: K _NASenc (Key Non-access stratum encryption) Or K _NASint (Key Non-access stratum integrity), etc.; then the MME will further generate K _eNB using K _ASME and send the K _eNB to the eNB for the eNB to generate the relevant key.

The UE will notify the core network device of the algorithm ID supported by the UE. For example, the algorithm used by the UE can be as shown in Table 1.

Table 1 LTE system security algorithm

4-bit标志4-bit logo	加密算法Encryption Algorithm	完整性保护算法Integrity protection algorithm	使用算法Using algorithm
0000₂ 0000 ₂	EEA0EEA0	EEA0EEA0	NULLNULL
0001₂ 0001 ₂	128-EEA1128-EEA1	128-EEA1128-EEA1	SONW 3GSONW 3G
0010₂ 0010 ₂	128-EEA2128-EEA2	128-EEA2128-EEA2	AESAES
0011₂ 0011 ₂	128-EEA3128-EEA3	128-EEA3128-EEA3	ZUCZUC

AS (access stratum) security activation process: The previous NAS security process is to create a security context between the MME and the UE. That is, the MME and the UE negotiate to use the same Key and encryption algorithm to exchange messages between them. Encryption and integrity protection. The AS security activation process is to create a security context between the eNB and the UE, and encrypt and integrity protect the access part interaction message between the eNB and the UE. The eNB selects an encryption algorithm, and then informs the UE of the algorithm ID, and then the eNB and the UE respectively generate a key required by the access layer by using the corresponding algorithm ID and K _DF , for example, K _UPenc (Key User plane encryption, user plane encryption key) ), K _RRCenc (RRC layer signaling message encryption key), K _RRCint (RRC Signaling Integrity Protection Key), and so on. Where K _UPenc is used for encryption of the user plane between the eNB and the user terminal. The K _RRCenc and K _RRCint keys are encryption and integrity protection for RRC layer signaling messages between the eNB and the user terminal.

In order to facilitate the understanding of the embodiments of the present invention, the embodiments of the present invention are not to be construed as limiting.

FIG. 3 is a flowchart of a communication method according to an embodiment of the present invention. The method may specifically include:

S310. The core network device acquires the first key. The first key is a key generated when the user equipment and the access network device perform an access layer security activation process.

The first key may be an encryption key of the user plane of the access layer, or may be an encryption key or an integrity protection key of the control plane of the access network. For example, the first key may be the above K _UPenc , K Any one or more of the keys _RRCenc , K _RRCint, etc.

S320. The core network device receives the data packet sent by the user equipment, performs decryption by using the first key, and obtains data in the data packet.

During the communication process, the user equipment encrypts the data by using the first key, and sends the data to the core network device. After receiving the encrypted data packet sent by the user equipment, the core network device uses the first step determined by the foregoing steps. The key is decrypted and the data sent by the user can be obtained.

In the embodiment of the present invention, the core network device acquiring the first key may have the following implementation manner.

In the first manner, the core network device can obtain the first key from the access network device.

The core network device may send a request message to the access network device, requesting the first key from the access network device, and the first time that the access network device generates the first key after performing the security activation process. The key is carried in the response message and sent to the core network device. For example, the core network device may carry the request message in an initial context setup request to the access network device, and the access network device may carry the first key in an initial context setup response (initial context setup). The response is sent to the core network device, or the core network device can carry the request in the ERAB setup request to the access network device, and the access network device can carry the first key in The ERAB setup response is sent to the core network device, and so on.

The access network device may send the first key to the core network device after generating the first key. For example, the access network device may send the first key to the core network device in a message such as an initial context setup response or an ERAB setup response. In addition, the core network device may further indicate, by using the foregoing message, that the core network device decrypts the data sent by the user equipment by using the first key sent by the access network device.

In the second mode, the core network device can generate the first key.

The second key required for the access network device and the user equipment to generate the first key is generated by the core network device and sent to the access network device. For example, the second key may be a K _eNB . The encryption algorithm used by the general access network device to perform the access layer security activation process to derive the first key is the same as the algorithm for the core network device to perform the non-access layer security activation process to generate the encryption key or the integrity protection key. Therefore, the core network device can directly generate the first key according to the second key and an algorithm for generating an encryption key or an integrity protection key.

Manner 3: When the access network device performs the access layer security activation process, the encryption algorithm used by the access network device to derive the first key and the core network device perform the non-access layer security activation process to generate an encryption key or integrity protection When the algorithm of the key is different, the core network device can also generate the first key. It can be known by the second method that the second key is generated by the core network device, and the core network device can generate the first key by determining the encryption algorithm used to derive the first key.

The identity of the encryption algorithm used to derive the first key may be provided by the access network device.

The core network device may send a request message to the access network device to request an identifier of the encryption algorithm used by the access network device to derive the first key, and the access network device performs the access layer security activation process to generate the first key. And carrying the generated identifier of the encryption algorithm used to derive the first key in the response message and sending the identifier to the core network device. For example, the core network device may carry the request in an initial context setup request to the access network device, and the access network device may carry the identifier of the encryption algorithm used to derive the first key in the initial context. The initial context setup response is sent to the core network device, or the core network device can carry the request in the ERAB setup request to the access network device, and the access network device can perform the deduction. The identifier of the encryption algorithm used by a key is carried in the ERAB setup response and sent to the core network device.

When the access network device performs the access layer security activation process, the access network device actively sends the encryption algorithm identifier used by the access network device to derive the first key to the core network device. For example, the access network device may send the encryption algorithm identifier used by the derivation of the first key to the core network device in an initial context setup response or an ERAB setup response. In addition, the foregoing response information may be used to indicate that the core network device decrypts the data packet sent by the user equipment by using the first key, or does not need to receive the data packet sent by the user equipment according to the indication of the access network device. After decryption directly.

It should be noted that the foregoing "request message", "response message" or "instruction information" and the like are only described as being carried in an existing command or message, and may be carried in other commands in a specific implementation process. Or in the message, a message or command having the above-mentioned "request message", "response message" or "instruction information" function may also be separately transmitted.

According to the communication method provided by the embodiment of the present invention, the data packet encrypted by the key generated by the protocol between the user equipment and the access network device can be decrypted at the core network device, and then, the RRC connection is released, or no RRC In the case of the connection, the user equipment can still be decrypted after the data encrypted by the key generated when the RRC connection is established is sent to the core network device, thereby ensuring the normal communication, improving the user experience, and the communication process of the user equipment is not used. Make major adjustments.

The following describes the embodiment of the present invention in more detail by taking an attaching process based on the LTE system as an example. The first key uses K _UPenc as an example, the access network device takes an eNB as an example, and the core network device takes an MME as an example.

As shown in FIG. 4, the acquisition of the first key may be performed when the access network device performs an access layer security activation process. The details are as follows.

The UE triggers the attach procedure, the RRC setup process, the authentication process, the non-access stratum security activation process, the location update process, and the like according to the existing procedures.

401. The MME sends an initial context setup request to the eNB, and notifies the eNB to perform initial context setting, where the request carries an access layer user plane encryption key K _{UPenc to} acquire the request.

402. The eNB performs an access layer security activation process with the UE.

Specifically, the eNB sends a security mode command to the UE. After receiving the message, the UE _{derives a} key according to an encryption algorithm in the message, and the key includes K _UPenc .

The UE then sends a security mode complete message to the eNB.

At the same time, the eNB also generates the same key K _UPenc .

403. The eNB sends an RRC connection reconfiguration message (RRCConnectionReconfiguration) to the UE, where the message includes an attach accept message and a bearer related context. The UE sends an RRC Connection Reconfiguration Complete message (RRCConnectionReconfigurationComplete) to the eNB.

404. The eNB sends an initial context setup response to the MME, where the response carries K _UPenc .

405. The UE encrypts the data packet by using K _UPenc , and transparently transmits the data packet to the MME through the eNB, and the MME uses K _{UPenc to} perform decryption to obtain data transmitted by the UE.

The process of obtaining the identifier of the encryption algorithm used by the MME for deriving the first key may be similar to the process shown in FIG. 4, for example, the identifier of the encryption algorithm used by the K _UPenc deduction may be carried in the initial context setup request. The request, in the initial context setup response carrying the identifier of the encryption algorithm used by the K _UPenc deduction, can obtain the identification of the K _UPenc generation algorithm. Can be understood cross-referenced. After obtaining the identifier of the encryption algorithm deduced by K _{UPenc, the} MME generates K _UPenc through an encryption algorithm according to K _ASME and KeNB. After the MME receives the data packet sent by the UE, it decrypts with K _UPenc to obtain the data in the data packet.

As shown in FIG. 5, the acquisition of the first key may be performed during the bearer establishment process performed by the access network device. The details are as follows.

The UE triggers the attach process, the RRC setup process, the authentication process, the non-access stratum security activation process, the location update process, and the access layer security activation process, etc. according to the existing process. During the access layer security activation process, the UE and the eNB generate K _UPenc .

501. The MME sends an ERAB setup request to the eNB, requesting to establish an ERAB bearer for the user equipment, where the request carries the user plane encryption key K _{UPenc of the} access layer to obtain the request.

502. The eNB performs an ERAB bearer setup procedure with the UE, and sends an RRC connection reconfiguration message (RRCConnectionReconfiguration) to the UE to notify the UE.

503. The UE sends an RRC connection reconfiguration complete message RRCConnectionReconfigurationComplete to the eNB to the eNB.

504. The eNB sends an ERAB setup response to the MME, confirming that the ERAB bearer of the UE is established, and carrying K _UPenc in the response.

505. In the data transmission process, the UE encrypts the data packet by using K _UPenc , and transparently transmits the data packet to the MME through the eNB, and the MME uses K _{UPenc to} perform decryption to obtain data transmitted by the UE.

The obtaining process of the identifier of the encryption algorithm used for the first key deduction may be similar to the process shown in FIG. 5, for example, carrying the identifier acquisition request of the encryption algorithm generated by K _UPenc in the ERAB setup request, in the ERAB setup response carries the identifier K _UPenc into the algorithm to obtain the identification of the encryption algorithm K _UPenc generation can be realized. Can be understood cross-referenced. After obtaining the identifier of the encryption algorithm generated by K _{UPenc, the} MME generates K _eNB according to K _ASME , and then generates K _UPenc through an encryption algorithm. After the MME receives the data packet sent by the UE, it decrypts with K _UPenc to obtain the data in the data packet.

As shown in FIG. 6, the first key may be generated by the MME, for example, may be generated during the non-access stratum security activation process performed by the MME. Wherein, this case is directed to the MME performing non-access stratum security activation. The encryption key is used in the same encryption algorithm as the eNB performs the access layer security activation process to generate the encryption key.

The UE triggers the attach process, the RRC setup process, the authentication process, and the like according to the foregoing procedure.

In the non-access stratum security activation process, after the UE and the MME generate K _NASenc and K _NASint according to K _ASME , the MME continues to push the K _eNB .

601. The MME continues to generate any one or more of K _UPenc , K _RRCenc , K _RRCint, and K _ENB+ according to the K _eNB and the encryption algorithm used by the K _NASenc or K _NASint .

602. In the data transmission process, the UE encrypts the data packet by using K _UPenc , and sends the data packet to the MME.

603. After receiving the encrypted data packet sent by the UE, the MME decrypts the data packet by using K _UPenc .

The solution provided by the embodiment of the present invention is mainly introduced from the perspective of interaction between the network elements. It can be understood that each network element, such as a user equipment, an access network device, a core network device, etc., in order to implement the above functions, includes hardware structures and/or software modules corresponding to each function. Those skilled in the art will readily appreciate that the present invention can be implemented in a combination of hardware or hardware and computer software in combination with the elements and algorithm steps of the various examples described in the embodiments disclosed herein. Whether a function is implemented in hardware or computer software to drive hardware depends on the specific application and design constraints of the solution. A person skilled in the art can use different methods for implementing the described functions for each particular application, but such implementation should not be considered to be beyond the scope of the present invention.

The embodiments of the present invention are further described by taking an implementation manner of a virtual device as an example in the following with reference to the accompanying drawings.

FIG. 7 is a schematic structural diagram of a communication device of an access network device involved in the foregoing embodiment.

The device can include:

The processing module 701 is configured to acquire a first key, where the first key is a key generated when the access network device performs an access layer security activation process;

The receiving module 702 is configured to receive a data packet sent by the user equipment, by using the first key Decrypt the data packet.

Optionally, the apparatus may further include: a sending module 703, configured to send a first request message to the access network device, where the first request message is used to request the first key;

The receiving module 702 is further configured to: after the access network device generates the first key, receive a first response message sent by the access network device, where the first response message carries the first secret key.

Optionally, the first request message includes an initial context setup request, the first response message includes an initial context setup response, or the first request message The ERAB setup request is included, and the first response message includes an ERAB setup response.

Optionally, the receiving module 702 is further configured to: after the access network device generates the first key, receive the first indication information sent by the access network device, where the first indication information carries the first A key.

Optionally, the first indication information includes: an initial context setup response or an ERAB setup response.

Optionally, the sending module 703 is further configured to: when the core network performs a non-access stratum security activation process, the core network device generates a second key and sends the second key to the access network device;

The processing module 701 is further configured to determine an encryption algorithm used by the access network device to derive the first key.

The processing module 701 is further configured to generate the first key according to the second key and the encryption algorithm.

Optionally, the sending module 703 is further configured to send, by the access network device, a second request message, where the second request message is used to request an identifier of an encryption algorithm used by the access network device to derive the first key;

The receiving module 702 is further configured to: after the access network device generates the first key, receive the second response message sent by the access network device, where the second response message carries the identifier of the encryption algorithm.

Optionally, the second request message includes an initial context setting request (initial context) The second request message includes: an initial context setup response; or the second request message includes an ERAB setup request, the second response message Including, the EBB setup response.

Optionally, the receiving module 702 is further configured to: after the access network device generates the first key, receive second indication information that is sent by the access network device, where the second indication information carries an access network. The identifier of the encryption algorithm used by the device to derive the first key.

Optionally, the second indication information includes: an initial context setup response or an ERAB setup response.

Optionally, the receiving module 702 is further configured to receive the data packet sent by the user equipment when the RRC connection is not available.

FIG. 8 is a schematic structural diagram of a communication device of a core network device involved in the above embodiment.

The apparatus may include: a processing module 801, configured to generate a first key when the access network device performs an access layer security activation process.

The sending module 802 is configured to send, to the core network device, an identifier of the encryption algorithm used by the first key or the access network device to derive the first key, where the first key is used by the core network device pair The data sent by the user equipment to the core network device is decrypted.

Optionally, the sending module 802 is specifically configured to carry the algorithm identifier of the encryption algorithm used by the first key or the access network device to derive the first key in an initial context setup response. Or the ERAB setup response is sent to the core network device.

Optionally, the device further includes:

The receiving module 803 is configured to receive a request message sent by the core network device, where the request message is used to request the identifier of the first key or the encryption algorithm.

Optionally, the request message includes an initial context setup request or an ERAB setup request.

The embodiments of the present invention are further described by taking the implementation of the hardware structure as an example in the following with reference to the accompanying drawings.

FIG. 9 is a schematic structural diagram of hardware of an access network device involved in the foregoing embodiment.

The access network device includes a communication unit 901, a processor 902, and a memory 903. Individual modules can be connected via a bus. The communication unit 901 is configured to support the transmission and reception of information between the access network device and the core network device in the foregoing embodiment. For example, the communication unit 901 may be an interface circuit, and may support the light between the access network device and the core network device. Communication. The service data and signaling messages are processed by the processor 902 and sent by the communication unit 901 to the core network device. The signal from the core network device is received by the communication unit 901 for mediation, and further processed by the processor 902 to obtain service data and signaling information transmitted by the core network device. Processor 902 also performs the processes involved in the access network device of Figures 3 through 6 and/or other processes for the techniques described herein. The memory 903 is used to store program codes and data of the access network device. In addition, the access network device can also include a transceiver 904 for supporting communication between the access network device and the user equipment. For example, it is used to support the signaling interaction between the access network device and the user equipment in the process of performing the attaching process. Further, the interaction between the access network device and the user equipment in performing the access layer security activation process may also be used. Supports the transmission and reception of data between the access network device and the user equipment.

FIG. 10 is a schematic diagram showing the hardware structure of a core network device involved in the foregoing embodiment.

The core network device includes a communication unit 1001, a processor 1002, and a memory 1003. Individual modules can be connected via a bus. The communication unit 1001 is configured to support the transmission and reception of information between the core network device and the access network device in the foregoing embodiment. For example, the communication unit 1001 may be an interface circuit, and may support the light between the access network device and the core network device. Communication. During communication between the core network device and the access network device, the service data and signaling messages are processed by the processor 1002 and transmitted by the communication unit 1001 to the access network device. The signal from the access network device is received by the communication unit 1001 and coordinated, and further processed by the processor 1002 to obtain service data and signaling information transmitted or forwarded by the access network device. The processor 1002 also performs the processes involved in the access network device of Figures 3-6 and/or other processes for the techniques described herein. The memory 1003 is configured to store an access network device Program code and data. The core network device communicates with the user equipment through the access network device, and the signaling or data between the core network device and the user equipment may be transparently transmitted through the access network device, or may be sent after being processed by the access network device. .

It should be noted that the processor of the access network device or the core network device in the foregoing embodiment may be a processor or a collective name of multiple processing elements. For example, the processor may be a Central Processing Unit (CPU), an Application Specific Integrated Circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of the present invention. For example, one or more digital singal processors (DSPs), or one or more Field Programmable Gate Arrays (FPGAs).

The memory of the access network device or the core network device in the foregoing embodiment may be a storage device, or may be a collective name of a plurality of storage elements, and used to store executable program code or parameters required for the operation of the access network management device, Data, etc. And the memory 903 may include random access memory (RAM), and may also include non-volatile memory such as a magnetic disk memory, a flash memory, or the like.

The bus of the access network device or the core network device in the above embodiment may be an Industry Standard Architecture (ISA) bus, a Peripheral Component (PCI) bus, or an extended industry standard architecture (Extended Industry). Standard Architecture, EISA) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, and the like.

The embodiment of the present invention further provides a communication system, which includes the access network device and the core network device described in the foregoing embodiments; or the system includes the core network device described in the foregoing aspect.

A person skilled in the art should further appreciate that the elements and algorithm steps of the various examples described in connection with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both, in order to clearly illustrate hardware and software. Interchangeability, the composition and steps of the various examples have been generally described in terms of function in the above description. Whether these functions come in hardware or software Execution depends on the specific application and design constraints of the technical solution. A person skilled in the art can use different methods for implementing the described functions for each particular application, but such implementation should not be considered to be beyond the scope of the present invention.

The steps of a method or algorithm described in connection with the embodiments disclosed herein can be implemented in hardware, a software module executed by a processor, or a combination of both. The software module can be placed in random access memory (RAM), memory, read only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or technical field. Any other form of storage medium known.

The specific embodiments of the present invention have been described in detail with reference to the preferred embodiments of the present invention. All modifications, equivalent substitutions, improvements, etc., made within the spirit and scope of the invention are intended to be included within the scope of the invention.

Claims

A communication method, comprising:

The core network device acquires a first key, where the first key is a key generated when the access network device performs an access layer security activation process;

The core network device receives a data packet sent by the user equipment, and decrypts the data packet by using the first key.
The method according to claim 1, wherein the acquiring, by the core network device, the first key comprises:

Sending, by the core network device, a first request message to the access network device, where the first request message is used to request the first key;

After the access network device generates the first key, the core network device receives a first response message sent by the access network device, where the first response message carries the first key.
The method according to claim 2, wherein the first request message includes an initial context setup request, the first response message includes an initial context setup response, or an initial context setup response; The first request message includes an access bearer setup request ERAB setup request, and the first response message includes an access bearer setup response ERAB setup response.
The method according to claim 1, wherein the acquiring, by the core network device, the first key comprises:

After the access network device generates the first key, the core network device receives the first indication information sent by the access network device, where the first indication information carries the first key.
The method according to claim 4, wherein the first indication information comprises: an initial context setup response or an access bearer setup response ERAB setup response.
The method of claim 1 wherein said method further comprises

In the process of performing non-access stratum security activation by the core network device, the core network device generates The second key is sent to the access network device, and the second key is used by the access network device to derive the first key;

The acquiring, by the core network device, the first key includes:

Obtaining, by the core network device, an encryption algorithm used by the access network device to derive a first key;

The core network device generates the first key according to the second key and the encryption algorithm.
The method according to claim 6, wherein the encryption algorithm used by the core network device to obtain the derivation of the first key by the access network device comprises:

The core network device sends a second request message to the access network device, where the second request message is used to request the access network device to derive an identifier of an encryption algorithm used by the first key;

After the access network device generates the first key, the core network device receives the second response message sent by the access network device, where the second response message carries the identifier of the encryption algorithm.
The method according to claim 7, wherein the second request message includes an initial context setup request, the second response message includes an initial context setup response, or an initial context setup response; The second request message includes an access bearer setup request ERAB setup request, and the second response message includes an access bearer setup response ERAB setup response.
The method according to claim 6, wherein the encryption algorithm used by the core network device to obtain the derivation of the first key by the access network device comprises:

After the access network device generates the first key, the core network device receives the second indication information sent by the access network device, where the second indication information carries the access network device derivation The identifier of the encryption algorithm used by the first key.
The method according to claim 9, wherein the second indication information comprises: an initial context setup response or an access bearer setup response ERAB setup response.
Method according to claims 1-10, characterized in that said core network device receives The data packet sent by the user equipment includes:

When there is no RRC connection, the core network device receives the data packet sent by the user equipment.
A communication method, comprising:

The access network device generates a first key when the access network device performs an access layer security activation process;

Transmitting, by the access network device, the first key or an identifier of an encryption algorithm used by the first key to the core network device, where the first key is used by the core network device to the user The data sent by the device to the core network device is decrypted.
The method according to claim 12, wherein the sending, by the access network device, the identifier of the encryption algorithm used by the first key or the derivation of the first key to the core network device comprises:

The access network device carries the first key or the algorithm identifier of the encryption algorithm in an initial context setup response or an access bearer setup response ERAB setup response, and sends the identifier to the core network device.
The method according to claim 12 or 13, wherein before the access network device sends the identifier of the first key or the encryption algorithm used by the first key to the core network device, Also includes:

The access network device receives a request message sent by the core network device, where the request message is used to request the identifier of the first key or the encryption algorithm.
The method according to 14, wherein the request message comprises an initial context setup request or an access bearer setup request ERAB setup request.
A core network device, comprising:

a communication unit, configured to receive a data packet sent by the user equipment;

a processor, configured to acquire a first key, where the first key is a key generated when the access network device performs an access layer security activation process;

The processor is further configured to decrypt the data packet by using the first key.
The device according to claim 16, wherein the communication unit is further configured to send a first request message to the access network device, where the first request message is used to request the first key;

The communication unit is further configured to: after the first key is generated by the access network device, receive a first response message sent by the access network device, where the first response message carries the first key .
The device according to claim 17, wherein the first request message includes an initial context setup request, the first response message includes an initial context setup response, or an initial context setup response; The first request message includes an access bearer setup request ERAB setup request, and the first response message includes an access bearer setup response ERAB setup response.
The device according to claim 16, wherein the communication unit is further configured to: after the access network device generates the first key, receive the first indication information sent by the access network device, where The first indication information carries the first key.
The device according to claim 19, wherein the first indication information comprises: an initial context setup response or an access bearer setup response ERAB setup response.
The device of claim 16 wherein:

The processor is further configured to: when the core network device performs a non-access stratum security activation process, generate a second key, where the second key is used by the access network device to derive the first secret key;

The communication unit is further configured to send the second key to the access network device;

The processor is specifically configured to acquire an encryption algorithm used by the access network device to derive a first key; and generate the first key according to the second key and the encryption algorithm.
The device according to claim 21, wherein said communication unit is further used for Sending a second request message to the access network device, where the second request message is used to request the access network device to derive an identifier of an encryption algorithm used by the first key;

The communication unit is further configured to: after the access network device generates the first key, receive a second response message sent by the access network device, where the second response message carries the identifier of the encryption algorithm .
The device according to claim 22, wherein the second request message includes an initial context setup request, the second response message includes an initial context setup response, or an initial context setup response; The second request message includes an access bearer setup request ERAB setup request, and the second response message includes an access bearer setup response ERAB setup response.
The device according to claim 21, wherein the communication unit is further configured to: after the access network device generates the first key, receive second indication information sent by the access network device The second indication information carries an identifier of an encryption algorithm used by the access network device to derive the first key.
The device according to claim 24, wherein the second indication information comprises: an initial context setup response or an access bearer setup response ERAB setup response.
The device according to any one of claims 16-25, wherein the communication unit is configured to receive a data packet sent by the user equipment when there is no RRC connection.
An access network device, comprising:

a processor, configured to generate a first key when the access network device performs an access layer security activation process;

a communication unit, configured to send, to the core network device, an identifier of the encryption algorithm used by the first key or the access network device to derive the first key, where the first key is used for the core The network device decrypts data sent by the user equipment to the core network device.
The device according to claim 27, wherein said communication unit is further used for The identifier of the first key or the encryption algorithm is carried in an initial context setup response or an access bearer setup response ERAB setup response, and is sent to the core network device.
Device according to claim 27 or 28, characterized in that

The communication unit is further configured to receive a request message sent by the core network device, where the request message is used to request the identifier of the first key or the encryption algorithm.
The device according to 29, wherein the request message comprises an initial context setup request or an access bearer setup request ERAB setup request.