WO2009094942A1

WO2009094942A1 - Method and communication network system for establishing security conjunction

Info

Publication number: WO2009094942A1
Application number: PCT/CN2009/070273
Authority: WO
Inventors: Xiaoying Xu; Jing Chen
Original assignee: Huawei Technologies Co., Ltd.
Priority date: 2008-01-30
Filing date: 2009-01-22
Publication date: 2009-08-06
Also published as: CN101926151B; CN101500229A; CN101926151A; CN101500229B

Abstract

A method for establishing security conjunction is provided, comprising: receiving the access request message which is transmitted by the terminal and transferred by the relay station (201); obtaining the share root key after the authentication to the terminal according to the access request message (202); selecting the security arithmetic, which is supported by both the terminal and the network side (203); and deriving the base station key according to the share root key (204); transmitting the security mode command to the terminal through the relay station, the security mode command includes the security arithmetic (205). A communication network system is also provided. Application of the solution of the present invention solves the problem of establishing security conjunction between the terminal and the network after introducing the relay station in the LTE system, and the security mechanism of the LTE is inherited, in the case of without increasing the complicacy of the system, the security and the wieldy capability of the system is ensured.

Description

Method for establishing security association and communication network system The present application claims to be filed on January 30, 2008 with the Chinese Patent Office, application number 200810065263.5, the priority of the Chinese patent application entitled "Method of Establishing Security Association and Communication Network System" The entire contents of which are incorporated herein by reference. Technical field

The present invention relates to the field of wireless communications, and in particular, to a method and a communication network system for establishing a security association. Background technique

In order to improve the link budget and the coverage of the cellular system, the user terminal can receive the service through the relay station, and the introduction of the relay station derives a new function of the air interface, and further enhances the distributed processing characteristics of the system. The deployment of the relay station can improve the wireless access performance of the system, cover the shadow area, expand the wired coverage radius of the base station, and enhance the data rate of the specific area.

In the further development after the Long Term Evolution (LTE) system, the wireless access technology itself is enhanced in multiple directions. Among them, the wireless relay station is an important direction. Since a relay station is introduced in the LTE system, the process of establishing a security association between the terminal and the network inevitably involves the relay station. The security protection in the LTE system is divided into two parts: the access network and the core network. Therefore, it is necessary to ensure the complexity and security of the LTE system design after the introduction of the relay station, and to realize the excellent mobile communication system by utilizing the good characteristics of the relay system. .

As shown in Figure 1, a method for establishing a security association between a terminal and a network side through a relay is described in the Institute of Electrical and Electronics Engineers (IEEE) 16j standard, as follows:

The terminal synchronizes and registers with the network side through the relay station, and obtains a basic key sequence (MSK) with the authentication server through the public key management protocol; the authentication server sends the MSK to the base station, and the base station derives according to the MSK. Jian Authorization Key ( AK );

The base station sends the authentication key to the terminal through the relay station;

The terminal and the relay station synchronize the AK by means of a three-way handshake, and according to the AK, a Key Encryption Key (KEK) of the Data Encryption Key (TEK) is derived, and the TEK is generated by the base station;

The TEK is obtained between the terminal and the relay through the TEK request procedure.

In the process of implementing the present invention, the inventors have found that the prior art has at least the following problems: In the existing LTE system, the key of the LTE system is more than the security key in the IEEE 16j system, and the process of key generation is compared. Complex, therefore, when the LTE system introduces a relay station, there is no suitable method for establishing a security association between the terminal and the network, and the security process in the prior art is not applicable to establish a security association between the terminal and the network. Summary of the invention

The embodiment of the present invention provides a method for establishing a security association between a terminal and a network side. After the relay station is introduced in the LTE evolution system, a security association is established between the terminal and the network.

An embodiment of the present invention provides a method for establishing a security association between a terminal and a network side, including: receiving an access request message sent by a relay station, and obtaining a shared root key after authenticating the terminal according to the access request message; Selecting a security algorithm, the security algorithm is an algorithm supported by the terminal and the network side; and deriving a base station key according to the shared root key; sending, by the relay station, a security mode command to the terminal, the security mode command The security algorithm is included.

The embodiment of the invention further discloses a communication network system, comprising: a first receiving unit, configured to receive an access request message sent by a relay station, and a key obtaining unit, configured to receive according to the first receiving unit The access request message obtains the shared root key after the terminal authentication is authenticated; the selecting unit is configured to select a security algorithm, the security algorithm is an algorithm supported by both the terminal and the network side; and the deriving unit is configured according to the a shared root key derived by the key obtaining unit to derive a base station key; a first sending unit, configured to pass the middle The relay station sends a security mode command to the terminal, where the security mode command includes a security algorithm selected by the selection unit.

Compared with the prior art, the embodiment of the invention has the following advantages:

According to the solution provided by the embodiment of the present invention, after receiving the access request sent by the terminal through the relay station, the network side selects a security algorithm for establishing a security association, and sends a security mode command to the terminal through the relay station, where the security is performed. The mode command includes the selected security algorithm, and the terminal establishes a security association with the network side after obtaining the security algorithm, and solves the problem that a security association is established between the terminal and the network side after the introduction of the relay station in the LTE system, and the embodiment of the present invention The technical solution provided inherits the security mechanism of the LTE system, and ensures the security of the mobile communication system after joining the relay station without changing the existing security mechanism and without increasing the complexity of the system. DRAWINGS

FIG. 1 is a schematic diagram of a method for establishing a security association between a terminal and a network side in the IEEE 16j standard in the prior art;

2 is a schematic diagram of a method for establishing a security association between a terminal and a network side according to a first embodiment of the present invention;

3 is a schematic diagram of a method for establishing a security association between a terminal and a network side according to a second embodiment of the present invention;

4 is a schematic diagram of a method for establishing a security association between a terminal and a network side according to a third embodiment of the present invention;

FIG. 5 is a schematic diagram of a method for establishing a security association between a terminal and a network side according to a fourth embodiment of the present invention;

6 is a schematic diagram of a method for establishing a security association between a terminal and a network side according to a fifth embodiment of the present invention;

FIG. 7 is a schematic structural diagram of a communication network system according to a sixth embodiment of the present invention. Specific embodiment The technical solutions in the embodiments of the present invention are clearly and completely described in the following with reference to the accompanying drawings in the embodiments of the present invention. It is obvious that the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. All other embodiments obtained by a person of ordinary skill in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention.

In order to make the specific technical solutions and the objects of the present invention more clear, the following description will be further described in conjunction with the specific embodiments and drawings.

Referring to FIG. 2, a first embodiment of the present invention is introduced, and a method for establishing a terminal and a network side security association is firstly applied to an LTE system and an evolved system thereof. Specifically include:

Step 201: Receive an access request message sent by the relay station forwarding terminal.

Step 202: Obtain a shared root key after authenticating the terminal according to the access request message.

Step 203: Select a security algorithm, where the security algorithm is an algorithm supported by the terminal and the network side.

Step 204: Deriving a base station key according to the shared root key.

Step 205: Send a security mode command to the terminal by using the relay station, where the security mode command includes the security algorithm.

With the method provided in this embodiment, after receiving the access request sent by the terminal through the relay station, the network side selects a security algorithm for establishing a security association, and sends a security mode command to the terminal through the relay station, in the security mode. The command includes the selected security algorithm, and after obtaining the security algorithm, the terminal can establish a security association with the network side, and solves the problem that a security association is established between the terminal and the network side after the introduction of the relay station in the LTE system, and the present invention is implemented. The technical solution provided by the example inherits the security mechanism of the LTE system, and ensures the security of the mobile communication system after joining the relay station without substantially changing the existing security mechanism and without increasing the complexity of the system.

Referring to FIG. 3, a second embodiment of the present invention will be described with respect to a method for establishing a terminal and a network side security association. In this embodiment, the terminal is detached to active, and the specific process includes: Step 301: The terminal sends an access request message to the relay station, where the access request message includes the terminal capability and the terminal identity.

The terminal capabilities may include algorithms supported by the terminal itself. The terminal identity may be an identifier of a terminal identity such as a Temporary Mobile Subscriber Identity (TMSI) or an International Mobile Subscriber Identity (IMSI).

Step 302: The relay station sends an access request message sent by the terminal to the base station.

Step 303: After receiving the access request message sent by the relay station, the base station forwards the access request message to the mobility management entity. When forwarding, the base station may further notify the mobile management entity of the base station capability of the base station, and the base station capability may include the base station. The algorithms supported by itself.

Step 304: The mobility management entity sends the relay identifier in the received access request message to the home subscriber server.

Step 305: The home subscriber server generates an authentication vector according to the identity of the terminal, where the authentication vector is used for mutual authentication between the terminal and the network side, including a random number RAND, an expected response XRES (EXpected user RESponse), and an authentication symbol AUTN (AUTN). = SQNIIAMFIIMAC ), Shared Root Key (Key Access System Management Entity, Kasme ).

Step 306: The home subscriber server sends the authentication vector to the mobility management entity after generating the authentication vector.

Step 307: The mobility management entity sends the random number RAND and the authentication symbol AUTN to the base station.

Step 308: The base station sends the received random number RAND and the authentication symbol AUTN to the relay station.

Step 309: The relay station sends the received random number RAND and the authentication symbol AUTN to the terminal.

Step 310: The terminal verifies the AUTN, and the terminal calculates the expected integrity check code XMAC = f (SQNIIRANDIIAMF). If the integrity check code MAC in the AUTN is equal, and the sequence number SQN is in the valid range, the network authentication is considered to be successful. If the verification is successful, Then, the response value RES is obtained according to the RAND calculation.

Step 311: The terminal sends a response message to the relay station, where the response message includes the RES. Step 312: The relay station sends a response message sent by the terminal to the base station.

Step 313: The base station sends the received response message to the mobility management entity.

Step 314: The mobility management entity verifies whether the RES is the same as the XRES in the authentication vector. If they are the same, the terminal and the mobility management entity obtain the shared root key Kasme by authenticating the terminal.

Step 315: The mobility management entity selects a security algorithm according to the terminal capability and the base station capability, where the security algorithm is an algorithm supported by the terminal and the network side, including an access layer security algorithm, and the access layer security algorithm may include radio resource control. (Radio Resource Control, RRC) algorithm and User Plane (UP) algorithm, etc.; base station key can be derived according to the security algorithm selected by the mobility management entity and the shared root key Kasme.

The security algorithm may further include: a Non-Access Stratum (NAS) algorithm.

Step 316: The mobility management entity sends a security algorithm and a base station key.

The security algorithm and base station key may be included in a message sent by the mobility management entity to the base station.

Step 317: The base station sends a security algorithm and an integrity check code to the relay station. The security algorithm and integrity check code may be included in a security mode command.

When transmitting the security algorithm, the base station may perform security protection on the transmitted content through the base station key, generate an integrity check code, and send the integrity check code to the relay station.

Step 318: The relay station sends the received security algorithm and integrity check code to the terminal.

Step 319: After receiving the security algorithm and the integrity check code, the terminal performs integrity verification on the message forwarded by the relay station, and after the verification succeeds, sends a verification confirmation message to the relay station.

Step 320: The relay station sends the received verification confirmation message to the base station.

Step 321: The base station sends the received verification confirmation message to the mobility management entity. Step 322: After the mobile management entity receives the verification confirmation message, the terminal and the The security algorithm negotiation and key agreement are completed between the base stations, and the establishment of the security association is completed. In this embodiment, optionally, in step 302, when the relay station sends the access request message, the relay station may send its own relay capability to the mobility management entity. In step 315, the mobility management entity may perform the terminal capability. , relay capabilities and base station capabilities to select security algorithms.

In the solution provided in steps 301 to 322 of this embodiment, the relay station has no security association between the terminal and the base station, and there is no information about the terminal. The relay station transparently transmits the message between the terminal and the network side. The embodiment may further include full association to establish a security association between the terminal and the relay station, so that communication between the terminal and the relay station is more secure.

Step 323: The base station sends a security association key (such as an RRC key and an UP key) established by the terminal and the base station to the relay station, and a security algorithm (such as an RRC algorithm and an UP algorithm), where the security association key is generated by the base station; the relay station and the base station The message sent between the relay station and the base station can be protected by a security association between the relay station and the base station. The security association between the relay station and the base station is pre-existing between the relay station and the base station, and is established by the relay station after accessing the network, to protect the base station and The security of sending information between relay stations.

Step 324: After receiving the key and related algorithm sent by the base station, the relay station uses the security association established between the relay station and the base station to perform verification, and returns an acknowledgement message to the base station.

In this embodiment, if the relay station has a function of generating a radio network Temporary Identifier (C-RNTI), in step 323, the base station may send a base station key and a security algorithm, such as an RRC algorithm and an UP algorithm, to the relay station. The message sent between the relay station and the base station can be protected by a security association between the relay station and the base station. In step 324, after receiving the base station key and algorithm sent by the base station, the relay station derives a security association key, such as an RRC key and an UP key, based on the base station key and the C-RNTI, and sends a message between the relay station and the base station. It can be protected by a security association between the relay station and the base station. In this case, the security association established between the relay station and the terminal is different from the security association between the base station and the relay station. When the relay station receives the message sent by the terminal, the relay station needs to firstly be based on the security between the relay station and the terminal. The association is decrypted, and then re-encrypted by using the security association between the relay station and the base station, and then forwarded. Similarly, when the relay station receives the message sent by the base station, it first decrypts according to the security association between the relay station and the base station, and then uses the relay station. The security association with the terminal is encrypted and sent to the terminal.

In step 323 and step 324, the relay station passively receives the message from the base station, and obtains the security association between the terminal and the network side. In this method, the relay station may actively request the base station to obtain the relevant security association. Therefore, step 323 and step 324 may be respectively Step 323, and step 324, are as follows:

Step 323: The relay station sends a terminal security association request to the base station, requesting the base station to send the security association related information that the terminal and the base station have established, and the message sent between the relay station and the base station can be protected by the security association between the relay station and the base station.

Step 324: The base station sends a request response message to the relay station, where the message includes a security algorithm, such as an RRC algorithm and an UP algorithm, and a security association key generated by the base station, such as an RRC key and an UP key; if the relay station can generate C - RNTI, the base station may not directly transmit the RRC key and the UP key, and the security message and the base station key are included in the response message. Based on the received information, the relay station can obtain security association information between the terminal and the base station.

Referring to FIG. 4, a third embodiment of the present invention is described. The method for establishing a security association between a terminal and a network is described. In this embodiment, the terminal has passed the initial access network and is in an idle state to enter an active state (idle to active). ), the method includes:

Step 401: The terminal sends an access request message to the network side by using the relay station, where the message includes a TMSI and a Key Set Identifier Access System Management Entity (KSIasme). The device has already learned the terminal capability of the terminal. Therefore, the terminal capability may not be included in the access request message unless the terminal capability is changed.

Steps 402 through 414 may refer to the contents described in steps 302 through 314 of the second embodiment.

Step 415: The mobility management entity derives the base station key according to the shared root key.

Step 416: The mobility management entity sends the base station key to the base station. Step 417: The base station sends a security mode command to the relay station, and includes a security algorithm and an integrity check code in the command.

Step 418: The relay station sends the received security algorithm and integrity check code to the terminal.

Step 419: After receiving the security algorithm and the integrity check code sent by the relay station, the terminal performs integrity verification on the message forwarded by the relay station. After the verification succeeds, the terminal sends a horse complete certificate confirmation message to the relay station.

Step 420: The relay station forwards the verification confirmation message to the base station.

Step 421: After receiving the verification confirmation message, the base station performs security check, and the security algorithm and key agreement are completed between the terminal and the base station.

Step 422: The base station sends an acknowledgement message to the mobility management entity to inform the establishment of the security association.

In the solution provided in steps 401 to 422 of this embodiment, the relay station does not have a security association between the terminal and the base station, and the relay station transparently transmits the message between the terminal and the base station. The embodiment may further include the following steps, so that the relay station in this embodiment can obtain the security association between the terminal and the base station:

Step 423: The base station sends, to the relay station, a security association key generated by the base station itself, such as an RRC key and an UP key, and a security algorithm, such as an RRC algorithm and an UP algorithm. The message sent between the relay station and the base station may pass through the relay station and the base station. Protection between the security associations.

Step 424: After receiving the key and algorithm sent by the base station, the relay station uses the security association established between the relay station and the base station to perform verification, and returns the confirmation information to the base station.

In this embodiment, if the relay station has the function of generating the C-RNTI, in step 423, the base station may send the base station key and the security algorithm, such as the RRC algorithm and the UP algorithm, to the relay station; the message sent between the relay station and the base station may pass through the relay station. Protection with the security association between the base station. In step 424, after receiving the base station key and algorithm sent by the base station, the relay station derives a security association key, such as an RRC key and an UP key, based on the base station key and the C-RNTI, and sends a message between the relay station and the base station. It can be protected by a security association between the relay station and the base station. In this case, the relay station obtains the terminal The security association established between the base station and the relay station is different. When the relay station receives the message sent by the terminal, the relay station needs to first decrypt according to the security association between the relay station and the terminal, and then utilize the security between the relay station and the base station. The association performs re-encryption and then forwards. Similarly, when the relay station receives the message sent by the base station, it first decrypts according to the security association between the relay station and the base station, and then encrypts by using the security association between the relay station and the terminal, and then sends the message to the terminal. terminal.

In step 423 and step 424, the relay station passively receives the message from the base station, and obtains the access layer security association information between the terminal and the network side. In this method, the relay station may actively request the base station to acquire the relevant security association. Therefore, step 423 and steps are performed. 424 can be step 423, and step 424, respectively, as follows:

Step 423: The relay station sends a terminal security association request to the base station, requesting the base station to send the security association key that the terminal and the base station have established, and the message sent between the relay station and the base station can be protected by the security association between the relay station and the base station.

Step 424: The base station sends a request response message to the relay station, where the message includes a security algorithm, such as an RRC algorithm and an UP algorithm, and a security association key generated by the base station, such as an RRC key and an UP key; if the relay station can generate C - RNTI, the base station may not directly transmit the security association key, and the security message and the base station key are included in the response message. The relay station derives a security association key, such as an RRC key and an UP key, based on the base station key and the C-RNTI, so that a security association with the terminal can be obtained.

The following is a description of the fourth embodiment of the present invention. As shown in FIG. 5, the method for establishing a security association between a terminal and a base station, according to the technical solution provided in this embodiment, can speed up the establishment of a security association time in the entire system. This embodiment includes step 501. Step 522 is substantially the same as step 301 to step 322 in the second embodiment, except that in step 517, the base station generates the security association generated by the base station while transmitting the security algorithm and the integrity check code to the relay station. The key, such as the RRC key and the UP key, is sent to the relay station; in step 520, the relay station forwards the terminal confirmation command and also transmits a confirmation message that the relay station receives the terminal security association.

If the relay station has the function of generating a C-RNTI, in step 517, the base station sends the security algorithm and the integrity check code to the relay station, and sends the base station key to the middle. The relay station may derive a security association key according to the base station key and the C-RNTI. In step 520, the relay station forwards the terminal confirmation command and also sends a confirmation message that the relay station receives the terminal security association.

In this embodiment, the establishment of a security association between the terminal and the base station is achieved, and the establishment of a security association between the terminal and the relay station is also achieved, thereby saving the time for the entire system to establish a security association.

The fifth embodiment of the present invention is described below. As shown in FIG. 6, the embodiment includes steps 601 to 622, which are basically the same as steps 401 to 422 in the third embodiment, except that in step 617, the base station is transmitting. At the same time as the security mode command, the security association key generated by the base station itself, such as the RRC key and the UP key, is sent to the relay station; in step 620, the relay station forwards the terminal confirmation command, and also sends the relay station to receive the terminal security association. A confirmation message for the message.

If the relay station has the function of generating the C-RNTI, in step 617, the base station sends the base station key to the relay station while transmitting the security mode command, and the relay station can derive the security association key according to the base station key and the C-RNTI. In step 620, the relay station forwards the terminal confirmation command, and also sends a confirmation message that the relay station receives the terminal security association.

The technical solution provided by the embodiment of the present invention solves the problem that the terminal establishes a security association between the relay station and the base station after the introduction of the relay station in the LTE system, and not only enables the terminal to establish a security association with the base station through the relay station, and further, the terminal and the relay station can be established. The security association between the two systems makes the communication of the entire system more secure, and at the same time, the time for establishing a security association in the LTE relay system can be saved. In addition, the technical solution provided by the embodiment of the present invention inherits the security mechanism of the LTE system, and combines the forwarding feature and the distributed feature of the relay station without substantially changing the existing security mechanism, without increasing the complexity of the system. The security of the mobile communication system after joining the relay station is guaranteed. A sixth embodiment of the present invention, with reference to FIG. 7, relates to a communication network system 700, including a first receiving unit 701, configured to receive an access request message sent by a relay station forwarding terminal, and a key obtaining unit 702, configured to The access request message received by the first receiving unit 701 obtains the shared root key after the terminal authentication and authentication; the selecting unit 703 is configured to select a security algorithm, where the security algorithm is an algorithm supported by both the terminal and the base station; a deriving unit 704, configured to derive a base station key according to the shared root key obtained by the key obtaining unit 702. The first sending unit 705 is configured to send, by using a relay station, a security mode command, where the security mode command includes a selection The security algorithm selected by unit 703.

Further, the first receiving unit 701 is further configured to receive an authentication confirmation message sent by the terminal through the relay station.

In the solution provided by the foregoing embodiment, the relay station does not have a security association between the terminal and the base station, and there is no information about the terminal. The relay station only transparently transmits the message between the terminal and the base station. Preferably, the communication network system further includes a second sending unit and a second receiving unit; the deriving unit is further configured to generate a network side security association key;

The second sending unit is configured to: after the first receiving unit receives the verification confirmation message sent by the terminal, send the security algorithm and the network side security association key to the relay station;

The second receiving unit is configured to receive an acknowledgment message sent by the relay station, where the acknowledgment message is an acknowledgment message sent by the relay station to the network side after obtaining the security association key between the terminal and the terminal according to the security algorithm and the security association key. Security association to establish a security association between the terminal and the relay station, making communication between the terminal and the relay station more secure.

If the relay station can generate a C-RNTI, when establishing a security association between the relay station and the terminal, preferably, the communication network system can further include a third transmitting unit and a third receiving unit.

The third sending unit is configured to: after receiving the verification confirmation message sent by the terminal, the first receiving unit sends a security algorithm and a base station key to the relay station, where the relay station generates a C-RNTI;

The third receiving unit is configured to receive an acknowledgement message sent by the relay station, where the acknowledgement message is The acknowledgment message sent by the relay station to the network side after obtaining the security association key with the terminal according to the C-RNTI and the received base station key and security algorithm.

The relay station can passively receive the relevant security association information sent by the communication network system, and can also actively request the relevant security association information to the communication network system. Preferably, the communication network system further includes a fourth sending unit and a fourth receiving unit;

The fourth receiving unit is configured to receive a terminal security association request sent by the relay station; the derivative unit is further configured to generate a network side security association key;

The fourth sending unit is configured to send a request response message to the relay station, where the message includes a security algorithm and a security association key on the network side.

When the relay station can generate the C-RNTI, when the communication network system receives the request of the relay station, the security association key may not be directly sent, but the base station key may be sent. Preferably, the communication network system further includes a fifth sending unit and a fifth receiving unit;

The fifth receiving unit is configured to receive a terminal security association request sent by the relay station to the network side;

The fifth sending unit is configured to send a request response message to the relay station, where the message includes a security algorithm and a base station key;

The fifth receiving unit is further configured to receive a confirmation message sent by the relay station to the base station after obtaining the security association key of the terminal according to the C-RNTI and the received base station key and the security algorithm.

The communication network system is provided in the embodiment of the present invention, so that the terminal can establish a security association between the terminal and the network side in the LTE evolution system, and further establish a security association between the terminal and the relay station, so that the communication is more secure, and The technical solution provided by the embodiment of the present invention inherits the security mechanism of the LTE system, and ensures the security of the mobile communication system after joining the relay station without substantially changing the existing security mechanism and without increasing the complexity of the system.

Through the description of the above embodiments, those skilled in the art can clearly understand that the present invention can be implemented by hardware, or by software plus necessary general hardware platform. Based on such understanding, the technical solution of the present invention can be embodied in the form of a software product, which can be stored in a non-volatile storage medium ( In the case of a CD-ROM, a USB flash drive, a mobile hard disk, etc., a number of instructions are included to cause a computer device (which may be a personal computer, server, or network device, etc.) to perform the methods described in various embodiments of the present invention.

In conclusion, the above description is only a preferred embodiment of the present invention and is not intended to limit the scope of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and scope of the present invention are intended to be included within the scope of the present invention.

Claims

Rights request

A method for establishing a security association, the method comprising:

Receiving an access request message sent by the relay station forwarding terminal;

Obtaining a shared root key after authenticating the terminal according to the access request message; selecting a security algorithm, where the security algorithm is an algorithm supported by the terminal and the network side; and deriving a base station key according to the shared root key;

The security algorithm is transmitted to the terminal by the relay station.

2. The method for establishing a security association according to claim 1, wherein after the step of transmitting the security mode command to the terminal by the relay station, the method further comprises: receiving the verification confirmation message sent by the relay station forwarding terminal .

The method for establishing a security association according to claim 2, wherein the transmitting the security algorithm to the terminal by using the relay station includes:

The base station transmits a security mode command to the terminal through the relay station, the security mode command including the security algorithm.

The method for establishing a security association according to claim 2, wherein, when the access request message is an initial access request message, the sending the security algorithm to the terminal by using the relay station includes:

The mobility management entity sends a security mode command to the base station;

After receiving the security mode command, the base station sends the security mode command to the terminal through the relay station, where the security command includes the security algorithm.

The method for establishing a security association according to claim 3 or 4, wherein after receiving the verification confirmation message sent by the relay station, the method further includes: the base station sending a security mode command to the relay station, where The security mode command includes the security algorithm, and a security association key generated by the base station; the base station receives an acknowledgement message sent by the relay station, and the acknowledgement message is that the relay station is secure according to the security algorithm Correlating a key, obtaining a message sent to the base station after the security association key with the terminal; or

Receiving, by the base station, a terminal security association request sent by the relay station; The station sends a request response message, which includes a security algorithm and a security association key generated by the base station.

The method for establishing a security association according to claim 3 or 4, wherein, when the relay station generates a cell radio network temporary identifier C-RNTI, after receiving the verification confirmation message sent by the relay station forwarding terminal, Includes:

The base station sends a base station key and a security mode command, where the security mode command includes the security algorithm to the relay station; the base station receives an acknowledgement message sent by the relay station, and the acknowledgement message is the relay station according to the The C-RNTI and the received base station key and the security algorithm obtain a message sent to the base station after obtaining a security association key with the terminal; or

Receiving, by the base station, a terminal security association request sent by the relay station to the base station; the base station sending a request response message to the relay station, where the message includes a security algorithm and a base station key; the base station receiving the acknowledgement message sent by the relay station, The acknowledgement message is a message that the relay station sends to the base station after obtaining the security association key with the terminal according to the C-RNTI and the received base station key and the security algorithm.

The method for establishing a security association according to claim 3 or 4, wherein the base station further transmits a security association key generated by the base station when the relay station sends a security mode command to the terminal.

The method for establishing a security association according to claim 3 or 4, wherein when the relay station generates a C-RNTI, the base station further transmits a base station key when the relay station sends a security mode command to the terminal. .

9. A communication network system, comprising:

a first receiving unit, configured to receive an access request message sent by the relay station forwarding terminal;

a key obtaining unit, configured to obtain a shared root key after authenticating the terminal according to the access request message received by the first receiving unit;

a selection unit, configured to select a security algorithm, where the security algorithm is an algorithm supported by both the terminal and the network side;

a derivation unit for deriving a base based on the shared root key obtained by the key acquisition unit Station key; the chosen security algorithm.

The communication network system according to claim 9, wherein the first receiving unit is further configured to receive a verification confirmation message sent by the terminal through the relay station.

The communication network system according to claim 10, wherein the system further comprises a second sending unit and a second receiving unit; the deriving unit is further configured to generate a security association key;

The second sending unit is configured to: after the first receiving unit receives the verification confirmation message sent by the terminal, send a security mode command, where the security mode command includes the security algorithm, and a security association key to the Relay station

The second receiving unit is configured to receive an acknowledgment message sent by the relay station, where the acknowledgment message is that the relay station obtains a security association key with the terminal according to the security algorithm and a security association key. A message sent to the network side.

12. The communication network system according to claim 10, wherein the system further comprises a third transmitting unit and a third receiving unit;

The third sending unit is configured to: after the first receiving unit receives the verification confirmation message sent by the terminal, send a security mode command, where the security mode command includes the security algorithm, and a base station key to the a relay station, the relay station generates a C-RNTI; the third receiving unit is configured to receive an acknowledgement message sent by the relay station, where the acknowledgement message is that the relay station according to the C-RNTI and the received base station key and The security algorithm obtains a message sent to the network side after the security association key between the terminal and the terminal.

The communication network system according to claim 10, wherein the system further comprises a fourth transmitting unit and a fourth receiving unit;

The fourth receiving unit is configured to receive a terminal security association request sent by the relay station; the derivation unit is further configured to generate a network side security association key;

14. The communication network system according to claim 10, wherein: said network The network side further includes a fifth sending unit and a fifth receiving unit;

The fifth sending unit is configured to send a request response message to the relay station, where the message includes a security algorithm and a base station key.