WO2013029461A1

WO2013029461A1 - Secure data transmission method and associated device

Info

Publication number: WO2013029461A1
Application number: PCT/CN2012/079801
Authority: WO
Inventors: 常俊仁; 李亚娟; 张亮亮; 张永平
Original assignee: 华为技术有限公司
Priority date: 2011-08-29
Filing date: 2012-08-08
Publication date: 2013-03-07
Also published as: CN102958052B; CN102958052A

Abstract

A secure data transmission method and an associated device. Secure data transmission includes: user equipment (UE) sending a first measurement report message to a first station, the first station being a current service station of the UE; receiving a cell adding command message returned by the first station, the cell adding a command message containing the physical cell identifier (PCI) and frequency of a newly added cell as well as the security algorithm identifier of a second station to which the newly added cell belongs, wherein the newly added cell is determined as a newly added service cell for the UE by the first station based on the first measurement report message; generating a security key based on the PCI and frequency of the newly added cell and the security algorithm specified by the security algorithm identifier; and carrying out secure data transmission using the generated security key and the second station. The technical solution provided in the embodiments of the present invention can realize secure data transmission between UE and different service stations.

Description

A data security transmission method

This application claims priority to Chinese Patent Application No. 201110251201.5, entitled "A Data Security Transmission Method and Related Equipment", filed on August 29, 2011, the entire contents of which are incorporated herein by reference. In the application.

Technical field

The present invention relates to the field of communications, and in particular, to a data security transmission method and related equipment. Background technique

In order to meet the requirements of IMT-Advanced (International Mobile Telecommunications-Advanced), supporting peak data rates up to 1 Gbps, the Enhanced Long Term Evolution-Advanced (LTE-A, Long Term Evolution-Advanced) has agreed to aggregate carriers. (CA, Carrier Aggregation) technology as a way to extend system bandwidth. The main idea of carrier aggregation is to aggregate multiple component carriers (CCs) into a larger bandwidth carrier to support high-speed data rates.

The carrier aggregation is further divided into an intra-band CA and an inter-band CA. For the intra-band CA, since the aggregated multiple carriers are in the same frequency band, the coverage can be consistent, and for the inter-band CA, if the aggregation is involved If the frequency bands of the two carriers are far apart, the coverage of the two carriers also has a large difference. Generally, the carrier coverage of the low frequency band is large, and the carrier coverage of the high frequency band is small.

Assuming that the user equipment (UE, User Equipment) is in the center of a certain cell, the UE can simultaneously aggregate the high and low frequency carriers for use. However, if the UE moves to the edge of the cell, the high frequency carrier may not cover the area. Then, the UE will not be able to use the high frequency carrier for data transmission and reception. Therefore, the user at the cell edge will have a much lower user throughput than the cell center.

Therefore, in order to improve the throughput of the cell edge user and expand the coverage of the high frequency carrier, the relay station can be used to expand the coverage of the high frequency carrier. However, if the relay station is used to expand the coverage of the high frequency carrier, the UE at the cell edge needs to When the component carriers of the high frequency band and the low frequency band are used at the same time, the UE needs to aggregate the carriers from two different stations, that is, the carrier of the low frequency band is from the macro base station, and the carrier of the high frequency band is from the relay station, and the UE needs to ensure that the UE can simultaneously be in the macro base station and Relay station between two different sites According to secure transmission. However, when the UE needs to perform data secure transmission with more than one site, there is currently no related solution to ensure that the UE simultaneously performs data security transmission between different sites. Summary of the invention

Embodiments of the present invention provide a data security transmission method and related device, which are used to implement data security transmission between a UE and different service sites.

To solve the above technical problem, the embodiment of the present invention provides the following technical solutions:

A data security transmission method under multiple sites, including:

The user equipment UE sends a first measurement report message to the first station, where the first station is the current serving station of the UE;

And receiving, by the foregoing first station, a cell addition command message, where the cell increase command message includes a physical cell identifier PCI and a frequency of the newly added cell, and a security algorithm identifier of the second site to which the new cell belongs, where the foregoing new The cell is determined by the first station to be the service cell added by the UE according to the foregoing first measurement report message;

Generating a security key based on the PCI and frequency of the newly added cell and the security algorithm indicated by the security algorithm identifier;

The data security transmission is performed with the second site by using the generated security key.

A data security transmission method under multiple sites, including:

Receiving, by the first station, a first measurement report message sent by the user equipment UE;

Sending a cell addition command message to the UE, where the cell increase command message includes a physical cell identifier PCI and a frequency of the newly added cell, and a security algorithm identifier of the second site to which the new cell belongs, so that the UE is added based on the foregoing The security algorithm indicated by the PCI and the frequency of the cell and the security algorithm identifier of the second site generates a security key, where the newly added cell is determined by the first station to be added to the UE according to the first measurement report message. Service area.

A data security transmission method under multiple sites, including:

The user equipment UE sends a first measurement report message to the first station, where the first station is the foregoing UE's current monthly service site;

And receiving, by the first station, a cell addition command message, where the cell addition command message includes a physical cell identifier PCI and a frequency of the newly added cell, where the newly added cell is a cell in a coverage of the second site, and is the first site. Determining, according to the foregoing first measurement report message, a service cell added by the UE;

Generating a security key based on the PCI and frequency of the newly added cell and the security algorithm used by the first site;

Data security transmission is performed with the above second site by using the above security key.

A data security transmission method under multiple sites, including:

Sending a cell addition command message to the UE, where the cell increase command message includes a PCI and a frequency of the newly added cell, so that the UE generates a security key based on the PCI and frequency of the new cell and the security algorithm used by the first site. The new cell is determined by the first station to be a new serving cell of the UE based on the first measurement report message.

A user equipment, including:

a sending unit, configured to send a first measurement report message to the first station, where the first site is a current service site of the user equipment;

a receiving unit, configured to receive a cell addition command message returned by the first station, where the cell increase command message includes a physical cell identifier pci and a frequency of the newly added cell, and a security algorithm identifier of the second site to which the new cell belongs, The new cell is determined by the first station to be a service cell added by the user equipment based on the first measurement report message;

a generating unit, configured to generate a security key based on the PCI and frequency of the newly added cell and the security algorithm indicated by the security algorithm identifier;

And a transmission unit, configured to perform data security transmission with the second station by using the security key generated by the generating unit.

A network site, including: a receiving unit, configured to receive a first measurement report message sent by the user equipment UE, and a sending unit, configured to send a cell addition command message to the UE, where the cell increase command message includes a physical cell identifier PCI and a frequency of the newly added cell, and the foregoing Adding a security algorithm identifier of the second site to which the cell belongs, so that the UE generates a security key based on the PCI and frequency of the newly added cell and the security algorithm indicated by the security algorithm identifier of the second site, where The newly added cell is determined by the first station to be a new serving cell of the UE according to the first measurement report message.

A user equipment, including:

a receiving unit, configured to receive a cell addition command message returned by the first station, where the cell increase command message includes a physical cell identifier PCI and a frequency of the newly added cell, where the newly added cell is the first station based on the first measurement The report message is determined to be a new service cell added to the user equipment;

a generating unit, configured to generate a security key based on the PCI and frequency of the newly added cell and a security algorithm used by the first site;

A network site, including:

a receiving unit, configured to receive a first measurement report message sent by the user equipment UE;

a sending unit, configured to send a cell addition command message to the UE, where the cell increase command message includes a physical cell identifier PCI and a frequency of the newly added cell, so that the UE is used according to the PCI and frequency of the newly added cell, and the foregoing network site The security algorithm generates a security key, where the new cell is determined by the first station to be a new serving cell of the UE based on the first measurement report message. It can be seen that, according to the technical solution provided by the embodiment of the present invention, on the one hand, after receiving the cell addition command message, the UE may generate a security key according to the indication of the cell increase command message, and use the security key and the added site. Data security transmission is implemented, and data security transmission between the UE and the newly added service station is implemented in a scenario where the cell is added; on the other hand, when the UE needs to switch from the current service site to more than two target sites, Receiving an indication of the handover command message, generating a security key for secure transmission of data with the target site, and implementing data security between the UE and the target site to be switched when switching from the current service site to the multiple target sites transmission. In summary, the technical solution provided by the embodiment of the present invention can implement data security transmission between the UE and different service sites. DRAWINGS

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the embodiments or the description of the prior art will be briefly described below. Obviously, the drawings in the following description It is merely some embodiments of the present invention, and those skilled in the art can obtain other drawings according to the drawings without any inventive labor.

FIG. 1 is a schematic flowchart of an embodiment of a data security transmission method according to the present invention; FIG. 1B is a schematic flowchart of an embodiment of a security key generation mechanism in an LTE system; FIG. 3 is a schematic flowchart of still another embodiment of a data security transmission method according to the present invention; FIG. 4 is a schematic diagram of a data security transmission method provided by the present invention; FIG. 5 is a schematic flowchart of still another embodiment of a data security transmission method according to the present invention; FIG. 6 is a schematic flowchart of still another embodiment of a data security transmission method according to the present invention; A flow chart of still another embodiment of a data security transmission method provided by the present invention; FIG. 8 is a schematic flowchart of still another embodiment of a data security transmission method according to the present invention; FIG. 9 is a data provided by the present invention. A schematic flowchart of still another embodiment of a secure transmission method; FIG. 10 is a user equipment provided by the present invention It shows a structure of an embodiment;

FIG. 11 is a schematic structural diagram of an embodiment of a network site according to the present invention. detailed description

Embodiments of the present invention provide a data security transmission method and related equipment.

The technical solutions in the embodiments of the present invention will be clearly and completely described in conjunction with the drawings in the embodiments of the present invention. The embodiments are merely a part of the embodiments of the invention, and not all of the embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention.

A data security transmission method in the embodiment of the present invention is described below with reference to the UE. Referring to FIG. 1 - a, an embodiment of a data security transmission method includes:

101. The UE sends a first measurement report message to the first station.

The first site is the current serving site of the UE.

In a practical application, when the UE needs to add a new serving cell, it may perform measurement on the cell in the first station or the cell in the neighboring site of the first station, and send the measurement result to the first through the first measurement report message. Site. The first station determines, according to the first measurement report message and the traffic of the UE, the serving cell to be added by the UE, to determine a serving cell added for the UE.

It should be noted that, when the UE accesses the first station, the UE and the first station may generate a security key by using a key generation mechanism defined by the LTE system, and the UE may use the switch from the first site to another site. The security key is securely transmitted with the first site. Specifically, the key generation mechanism can be as shown in Figure 1-b:

S1. When the UE accesses the first site, the UE and the mobility management entity (MME, Mobility)

Management Entity ) generates the same base key ^Kasme ;

The S2. UE and the MME further derive an intermediate key K, a second key ^NAS, and a hop (NH, Next Hop) parameter value based on the KASME;

Specifically, the process of deriving K _ENB from KASME has been described in the prior art, and a specific example is described here as follows:

First determine the following parameters:

- FC = 0x11;

- P0 = upstream non-access stratum COUNT, where the COUNT value consists of the superframe number and the sequence number of the packet;

- L0 = length of the upstream non-access stratum COUNT value; Then combine the above parameters into an input chain S;

Finally, based on the HMAC-SHA-256 key derivation function, it is calculated:

^K ^ = HMAC-SHA-256 ( ^k ^ME , s ).

Among them, the HMAC-SHA-256 key derivation function is defined by the IETF RFC 2104 (1997) and ISO/IEC 1 0118-3:2004 standards.

Specifically, the method of deriving the NH value from ^k ASME is as follows:

First determine the following parameters:

- FC = 0x12;

- P0 = SYNC-input, this parameter takes the new ^κ in the first generation of NH in the subsequent ΝΗ generation, always taking the previous ΝΗ value;

- L0 = SYNC-length value of the input;

Then combine the above parameters into an input chain S;

Finally, based on the HMAC-SHA-256 key derivation function, it is calculated:

NH = HMAC-SHA-256 ( ^κ S ).

Among them, the HMAC-SHA-256 key derivation function is composed of IETF RFC 2104 (1997) and

ISO/IEC 1 0118-3:2004 standard.

53. The MME sends the generated ^{κ NAS} and NH parameter values to the first site;

54. The UE generates a security key according to the security algorithm used by the ^κ and the first site, where the security key includes ^KuPenc , ^KcPenc, and ^Kcpint , where ^{KuPenc is} used for the strength of the user plane data, and ^{KcPenc is} used for control signaling. Encryption, ^K cp _{mt is} used to control the integrity protection of signaling;

55. The first site generates a security key according to the security algorithm used by the ^κ and the first site. Similarly, the security key includes ^KuPenc , ^KcPenc, and ^Kc ^{p int} ;

56. The UE and the first site use the generated security key for secure data transmission.

102. Receive a cell addition command message returned by the first station.

The UE receives the cell addition command message returned by the first station, where the cell addition command message includes a physical cell identifier (Physic, Physical Cell Identity) and a frequency of the newly added cell, and a security algorithm identifier of the second station.

In the embodiment of the present invention, the first station determines, according to the foregoing first measurement report message, the cell under the second site as the new serving cell of the UE. For convenience of description, the first site is determined to be newly added by the UE. The cell is called a new cell. The first site can be based on the PCI and frequency of the newly added cell, and The first intermediate key used by the UE for data security transmission (hereinafter replaced by ^^) generates a second intermediate key (hereinafter replaced by ^κ ), or the first station may be based on the PCI and frequency of the newly added cell, and The current ΝΗ parameter value of the first site generates ^κ · , specifically, whether the first site generates ^κ based on the ΝΗ parameter value * depends on the count of the next hop chain counter ( NCC, Next Hop Chaining Count ) maintained locally by the first site Value, if the count value of the NCC overflows, the first station generates NB* based on the NH parameter value, and if not overflows, generates ^k ₆ N _B * based on ^κ , specifically, based on the PCI and frequency of the newly added cell, and Alternatively, based on the PCI and frequency of the newly added cell, and the process of generating ^k B* by NH, refer to the prior art, which is described by way of an example, as follows: First, the input parameters are determined:

- FC = 0x13;

- P0 = PCI of the newly added cell;

- L0 = PCI length of the target cell;

- P1 = frequency of the target cell EARFCN-DL;

- L1 = frequency of the target cell EARFCN-DL length;

Then combine the above parameters into an input chain S;

Finally, based on the HMAC-SHA-256 key derivation function, it is calculated:

K _eNB * = HMAC-SHA-256 ( ^κ ^ , S ) or ^κ HMAC-SHA-256 (NH ,

S)

Among them, the HMAC-SHA-256 key derivation function is defined by the IETF RFC 2104 (1997) and ISO/IEC 10118-3:2004 standards.

After generating κ _{ε ΝΒ} *, the first site sends ^κ · to the second site, and the second site can generate a security key based on the security algorithm used by ^κ · and the second site, and return the security algorithm used by the first site to the first site. The security algorithm identifier, after receiving the security algorithm identifier returned by the second station, the first station sends a cell addition command message to the UE, instructing the UE to generate a security key for data security transmission with the second station.

It can be understood that, in actual applications, if there are multiple new cells, the first station may generate multiple ^ΝΒ6ΝΒ *s based on the PCI and frequency of the multiple newly added cells, and send multiple ^Κ * to the first The second site generates multiple sets of security keys based on multiple ^κ *s by the second site. Since the UE and the different cells under the same site can share a set of security keys for data security transmission, the first station may indicate a new one for generating a security key in the cell addition command message sent to the UE. Increase the PCI of the cell And the frequency, in addition, the cell addition command message may carry the PCI and frequency of multiple other newly added cells. Alternatively, the second station may be based on a plurality of ^ generate a security key, and notifies the first station Κ generated security key used by the message, the first station generates K ₆ NB * New cell The PCI and the frequency are sent to the UE, which is not limited herein.

In one application scenario, the first station may also receive security algorithm identifier returned by the second station, using a security algorithm security key updates the security algorithm identifier ^κ · indication and the second site, so as thereafter Secure transmission of data with the UE using the security key.

In an application scenario, when the first site determines that a new site (such as the second site) joins, the current serving cell of the UE also needs to suspend work to suspend data with the first site due to the update of the security key. Secure transmission, therefore, the first station may carry the transmission suspension time in the cell addition command message, so that the U 暂停 may suspend data security transmission with the first station within the time period indicated by the transmission suspension time, or The station may also not carry the transmission pause time in the cell addition command message, and the UE pauses the data security transmission with the first station within the preset time period after receiving the cell increase command message, or the UE may also succeed. After the uplink synchronization of the newly added cell is obtained, the data is securely transmitted with the first site, and the data is securely transmitted with the first site after the security key is successfully generated, which is not limited herein. It should be noted that the above data security transmission refers to data transmission requiring encryption and/or integrity protection.

103. Generate a security key based on the PCI and the frequency of the newly added cell and the security algorithm indicated by the security algorithm identifier.

After receiving the cell increase command message from the first station, the UE may use the indication of the cell increase command message, based on the PCI and frequency of a new cell used to generate the security key indicated by the cell increase command message, and The security algorithm indicated by the security algorithm identifier of the second site generates a security key. Specifically, the step of generating a security key may include:

The UE determines whether the count value of the locally maintained NCC overflows, and if so, generates ^κ * according to the PCI and frequency of the newly added cell and the current ΝΗ parameter value of the UE, and if not, according to the PCI and frequency of the newly added cell And the first intermediate key generation ^K eNB* used by the UE for data secure transmission;

Using the security algorithm indicated by the security algorithm identifier of the second site, and the generated ^K B* to generate a security key (including, for ^{example, KuP} ^ ² , ^K CPenc2 ^ K _{cpint2 )?} Specifically, the process of generating a security key can be found in the existing Technology, described here as an example, as follows: First, determine the following parameters:

- FC = 0x15;

- P0 = algorithm similar identification value (determined by Table 1);

- L0 = the length of the algorithm similar to the identification value;

- P1 = algorithm identifier;

- L1 = algorithm identifier length;

Table 1

Then combine the above parameters into an input chain S;

Finally, based on the HMAC-SHA-256 key derivation function, it is calculated:

Security Key = HMAC-SHA-256 ( ^κ , S )

Here, taking different parameters for Table 1, ^K ^n can be obtained according to the above formula. 2, that is, the user plane encryption key, ^K cp^, that is, the control plane RRC encryption key, and ^K cp^, that is, the control plane RRC integrity protection key.

104. Perform secure data transmission with the second site by using the generated security key.

After the security key is generated by the step 103, the UE can use the security key to perform data secure transmission with the second station.

It can be understood that if the first site does not update the security key used by the UE for data security transmission, the UE and the first station still use the original security key for data security transmission, if the first site receives After the security algorithm identifier returned by the second site, the security key is also updated based on the security algorithm indicated by the security algorithm identifier of the ^κ and the second site, and the UE may perform data with the first site by using the security key generated in step 103. Secure transmission.

The foregoing first site and the second site may be, for example, a base station or a relay station, etc., and are not limited herein. Set.

It can be seen that, according to the technical solution provided by the embodiment of the present invention, on the one hand, after receiving the cell addition command message, the UE may generate a security key according to the indication of the cell increase command message, and use the security key and the added site. The data is transmitted securely, so that the UE can perform data security transmission with the original service site, and can also perform data security transmission with the newly added site, thereby realizing secure data transmission between the UE and different service stations.

The data security transmission method in the embodiment of the present invention is described below with reference to the first site. Referring to FIG. 2, another embodiment of the data security transmission method includes:

201. The first station receives a first measurement report message sent by the UE.

In a practical application, when the UE needs to add a new serving cell, it may perform measurement on the cell in the first station or the cell in the neighboring site of the first station, and send the measurement result to the first through the first measurement report message. One site.

After receiving the first measurement report message sent by the UE, the first station may determine, according to the first measurement report message and the traffic of the UE, the serving cell to be added by the UE, to determine the UE. New service area.

In the embodiment of the present invention, the first station determines, according to the foregoing first measurement report message, the cell under the second site as the new serving cell of the UE. For convenience of description, the first site is determined to be newly added by the UE. The cell is called a new cell. The first station may generate a second intermediate key (hereinafter replaced by ^κ ) based on the PCI and frequency of the newly added cell, and the first intermediate key (hereinafter replaced by ^^) used by the UE for data secure transmission, or The first station may generate ^κ based on the PCI and frequency of the newly added cell and the current ΝΗ parameter value of the first station. Specifically, whether the first site is generated based on the ΝΗ parameter value or not depends on the local maintenance of the first site. NCC count value, if

If the count value of the NCC overflows, the first station generates a K _eNB * based on the K _eNB if it does not overflow based on the NH parameter value.

Further, after generating the ^k B*, the first station may send the ^κ · carried in the cell addition request message to the second station, requesting the second station to provide the UE with the service. After receiving the cell addition request message, the second station may return a cell addition request acknowledgement message to the first station, and carry the security algorithm identifier of the security algorithm used by the cell in the cell increase request acknowledgement message, and may be based on ^κ and The security algorithm used by the security algorithm generates a security key, so that after the security key is subsequently generated by the UE, the security key can be used to securely transmit data with the second site. In an actual application, if there are multiple new cells, the first site may generate multiple*s based on the PCI and frequency of the multiple newly added cells, and send multiple bearer cell addition request messages to the second site. * generate sets a security key, or by selecting a second site from a plurality of ^K eNB * ^K eNB *, to generate a security key ^K eNB * based on the selected second station based on the plurality of ^K _B.

In an application scenario, the second site may include the security algorithm identifier of the second site in the cell increase request acknowledgement message, or may transmit the second site security algorithm identifier to the first site by using other independent messages. Site, here is not limited.

In an application scenario, after receiving the security algorithm identifier of the second site returned by the second site, the first site may update the security key by using a security algorithm indicated by the security algorithm identifier of the second site and the second site. Thereafter, the security key is used to securely transmit data with the UE.

202. Send a cell addition command message to the UE.

After receiving the cell addition request acknowledgement message returned by the second station, the first station sends a cell addition command message to the UE, instructing the UE to generate a security key for data security transmission with the second station, and carrying the message in the cell addition command message. The PCI and frequency of a new cell used to generate the security key, and the security algorithm identifier of the second site, so that the UE is based on the PCI and frequency of the newly added cell, and the security algorithm indicated by the security algorithm identifier of the second site Generate a security key.

It can be understood that, in actual applications, there may be multiple new cells, because the UE and the different cells under the same site can share a set of security keys for data security transmission, so the first station is sent to the UE. The cell addition command message may indicate the PCI and the frequency of the newly added cell used to generate the security key. In addition, the cell addition command message may carry the PCI and the frequency of the multiple other newly added cells, or After the second site is configured to generate the ^κ * of the security key, the PCI and the frequency of the generated new cell are sent to the UE, which is not limited herein.

In an application scenario, when the first site determines that the second site joins, the update of the security key may cause the current serving cell of the UE to also suspend work to suspend data transmission with the first site. Therefore, The first station may carry the transmission suspension time in the cell addition command message, so that the UE may suspend data security transmission with the first station during the time period indicated by the transmission suspension time, or the first station may not increase in the cell. The command message carries the transmission pause time, and the UE pauses the data security transmission with the first station in the preset time period after receiving the cell increase command message, or the UE may successfully acquire the new cell. After the uplink synchronization, pause the data security transmission with the first site, and resume the data with the first site after the security key is successfully generated. Secure transmission, not limited here. It should be noted that the above data security transmission refers to data transmission requiring encryption and/or integrity protection.

The first site and the second site may be, for example, a base station or a relay station, and are not limited herein.

It can be seen that, according to the technical solution provided by the embodiment of the present invention, after receiving the cell addition command message, the UE may generate a security key according to the indication of the cell addition command message, and use the security key to perform with the newly added site. The data is securely transmitted, so that the UE can perform data secure transmission with the original service site, and can also perform data secure transmission with the newly added site, thereby realizing secure data transmission between the UE and different service stations.

In order to facilitate a better understanding of the technical solution of the present invention, a data security transmission method in the embodiment of the present invention is described in an application scenario. In this application scenario, the first site does not update the security key. Referring to FIG. 3, Includes:

301 UE accesses the first station, at this time, the UE and the MME generate the same basic key ^k ASME

302 UE and MME further derive intermediate key ^, second key ¹ ^^ and NH parameter values based on KASME.

303 The MME sends the generated ^{κ NAS} and ΝΗ parameter values to the first station.

The 304 UE generates a security key 0 according to the security algorithm used by the ^κ and the first site, where the security key 0 includes ^KlJPenc , KcPenc, and ^K CPmt

305. The first station generates a security key according to the security algorithm used by the ^κ and the first station. The UE and the first station use the generated security key 0 for data security transmission.

307 The UE sends a first measurement report message to the first station.

308. After receiving the first measurement report message sent by the UE, the first station determines, according to the information about the first measurement report message and the service volume of the UE, that the cell under the second site is used as the service cell added by the UE, and determining Whether the count value of the locally maintained NCC overflows, and if so, the first station generates a second intermediate key (substituted by ^κ ·) according to the determined PCI and frequency of the newly added cell and the current ΝΗ parameter value of the first station, If not, the first station generates K _ENB according to the determined PCI and frequency of the newly added cell, and the first intermediate key used by the UE for data secure transmission (substituted by ^κ )

309. Send a cell increase request message to the second site.

The first station sends a cell addition request message to the second station, requesting the second station to provide the UE with the The service, where the cell addition request message carries the ^K _B * generated by step 308.

After receiving the cell addition request message from the first site, the second station returns a cell addition request acknowledgement message to the first station, and may carry a black box in the cell increase request confirmation message, and the second box is included in the black box. The security algorithm identifier of the security algorithm used.

After receiving the cell addition request message, the first station does not parse the content in the black box, sends a cell addition command message to the UE, and carries the black box in the cell addition command message, that is, the second station The security algorithm identifier is carried in the cell addition command message, and the cell addition command message carries the PCI and frequency of the new cell used to generate the second security key.

After receiving the cell addition command message, the UE determines whether the count value of the locally maintained NCC overflows, and if yes, generates the PCI and the frequency of the newly added cell in the cell increase command message, and the current NH parameter value of the UE. ^κ · , if not, generating ^K eNB* according to the PCI and frequency of the newly added cell in the cell addition command message and the ^使用 used by the UE for data security transmission.

31 3. The UE and the second station generate a security key based on the security algorithm used by the ΝΒ* and the second site.

1 , wherein the security key 1 includes ^Κ υΡ 2, ^K CPenc2 ^ ^K CP mt 2 ;

It can be understood that the UE can learn the security algorithm used by the second station by using the security algorithm identifier of the second station carried in the cell addition command message.

31 4. The UE uses the security key 0 to perform data security transmission with the first site, and uses the security key 1 to securely transmit data with the second site.

It should be noted that, in step 31 3, the action of the second station to generate the security key 1 based on the security algorithm used by the ^κ · and the second site may be performed at any time in steps 309 to 31 3 without strictly restricting This is done in step 31 3.

In order to facilitate a better understanding of the technical solution of the present invention, a data security transmission method in the embodiment of the present invention is described in an application scenario. In this application scenario, the first site updates the security key. Please refer to Figure 4, including:

401 UE accesses the first station, at this time, the UE and the MME generate the same basic key ^k ASME

402 UE and MME further derive intermediate key ^, second key ¹ ^^ and NH parameter values based on KASME.

403 The MME sends the generated ^{κ NAS} and ΝΗ parameter values to the first site.

404 UE generates security key 0 according to ^κ and a security algorithm used by the first station, where security key 0 includes ^KlJPenc , KcPenc, and ^K CPmt

405. The first station generates a security key according to the security algorithm used by the ^κ and the first site.

406 The UE and the first station perform secure data transmission using the generated security key 0.

407 The UE sends a first measurement report message to the first station.

408. After receiving the first measurement report message sent by the UE, the first station determines, according to the information about the first measurement report message and the service volume of the UE, that the cell under the second site is used as a service cell added by the UE, and determining Whether the count value of the locally maintained NCC overflows, and if so, generates a second intermediate key (substituted by ^κ ·) according to the determined PCI and frequency of the newly added cell and the current ΝΗ parameter value of the first station. If not, generating ^Κ ^Β* according to the determined PCI and frequency of the newly added cell, and the first intermediate key used by the UE for data security transmission (hereinafter ^referred to as an alternative)

409. Send a cell increase request message to the second site.

The first station sends a cell addition request message to the second station, and requests the second station to provide the service for the UE, where the cell addition request message carries the ^K _B * generated by step 408.

After receiving the cell addition request message from the first station, the second station returns a cell addition request acknowledgement message to the first station, and may carry the security algorithm identifier of the security algorithm used by the second station in the cell increase request acknowledgement message. symbol.

411. After receiving the cell addition request message, the first station sends a cell addition command message to the UE, and carries the security algorithm identifier of the second site in the cell addition command message, and a new function for generating the second security key. Increase the PCI and frequency of the cell.

412. After receiving the cell addition command message, the UE determines whether the count value of the locally maintained NCC overflows. If yes, generates a ^K _B according to the PCI and frequency of the newly added cell in the cell increase command message, and the current NH parameter value of the UE. * if not, then the cell according to the PCI and the frequency increasing command message of the new cell, and the UE currently ^Κ for secure transfer of data is generated using ^K eNB * 413 UE, based on the first site and the second site ^K _B * And the security algorithm used by the second site 1 as a security key, wherein the security key comprises a ^_K w2, ^{K CP∞.} ₂ and ^K _CPint2 ;

It can be understood that the UE and the first station can learn the security algorithm used by the second station by using the security algorithm identifier of the second station.

414. The UE uses the security key 1 to perform data security transmission with the first site and the second site. It should be noted that, in step 413, the action of generating the security key 1 by the first station may be performed at any time in steps 411 to 413, and the action of generating the security key 1 by the second station may be performed in step 41 0 to the step. Any time in 413 is performed, and is not strictly limited in step 413.

In an application scenario, the UE may need to switch from the current serving site to work under other sites due to the UE's own mobile or signal changes. For example, the UE may need to go from the "first site + the second" during the mobile process. The data transfer mode of the site "switches to the data transfer mode of the "first target site + second target site". Assuming that the first site is responsible for the handover control of the UE, and the UE uses different security keys to perform data security transmission with the first site and the second site respectively, the security key generation process in this scenario may be as shown in FIG. :

501. The UE sends a second measurement report message to the first station.

502. The first station makes a handover decision based on the second measurement report message, and determines to switch the UE to work under the first target site and the second target site.

503. The first station sends a handover indication message to the second station, where the handover indication message carries the PCI and the frequency of the second target cell, where the second target cell is determined by the first station according to the second measurement report message. The cell to which the UE is handed over may be a cell under the first target site or a cell under the second target site, which is not limited herein.

504, the second site to generate intermediate key based on the PCI and the fourth frequency handover indication message in a second target cell (hereinafter to replace ^KeNB * ^2). Specifically, the second station 2 generates ^K eNB * process may be as follows: Determining whether the count value of the locally maintained NCC overflows, and if so, according to the PCI of the second target cell And the frequency, and the current NH parameter value of the second station, generating a fourth intermediate key, and if not, generating ^K according to the PCI and frequency of the second target cell and the second intermediate key (hereinafter replaced by NB*) eNB*2.

505. The second station sends a handover indication feedback message to the first station, where the handover indication feedback message carries the ^k ^B* ₂ generated by step 504.

506. The first station generates a third intermediate key based on the first target cell PCI and the frequency (hereinafter referred to as κ·^ generation). Specifically, the first station generates the ^k ₆ NB*^ process as follows: determining the locally maintained NCC Whether the count value overflows, if yes, according to the PCI and frequency of the first target cell, and the current NH parameter value of the first station,

If not, the target cell is generated according to the first PCI and the frequency, and the first intermediate key ^(Κ below to replace) ^K eNM.

507, the first station ^K 6NB * 1 and ^K ^ B * 2 are transmitted to a first target site and a second target site; In practical applications, the first station may be a handover request message ^{^K} ^ * ^ ^K ^ B * _{2 is} sent to the first target site and the second target site, or ^K eNB* ₂ can also be sent to the first target site and the second target site by other independent messages.

It should be noted that, in the embodiment of the present invention, the first target station and the second target station allow the UE to perform handover. In an actual application, the first target station and the second target station may also not allow the UE to switch to its site. Working, specifically, whether the UE is allowed to switch to the first target station and the second target station, may be determined by the first target station and the second target station by message negotiation, or may be decided by one of the stations as the control station. , here is not limited.

508. Obtain a security algorithm identifier of the first target site and the second target site.

The first target station and the second target station may return a handover request acknowledgement message to the first site after determining that the UE is allowed to switch to the site, and carry the security of the first target site and the second target site in the handover request acknowledgement message. Algorithm identifier. It is to be understood that the first target station and the second target station may each return a handover request acknowledgement message to the first site, and carry the security algorithm identifier of the locally used security algorithm in the respective handover request acknowledgement message returned, or The handover request acknowledgement message may be sent to the first site by using one of the sites as the control site, and the security request identifier of the first target site and the second target site is carried in the handover request acknowledgement message, or may be in the first target. After the negotiation between the site and the second target site, the one of the sites returns a handover request acknowledgement message to the first site, and the handover request acknowledgement message carries the security algorithm identifiers of the first target site and the second target site, where the security algorithm identifier is not used herein. limited. The first site can obtain the first from the received handover request confirmation message. The security algorithm identifiers of the first target site and the second target site may be obtained by other means, and are not limited herein.

509. The first station sends a handover command message to the UE.

The handover command message includes a PCI and a frequency of the first target cell, a PCI and a frequency of the second target cell, a security algorithm identifier of the first target station, and a first and a first associated with a PCI and a frequency of the first target cell. The security algorithm identifier of the target site, the ^κ associated with the PCI and frequency of the second target cell, and the security algorithm identifier of the second target site. In addition, the handover command message may also include PCI and frequency of other first target cells that are not security related, and PCI and frequency of other second target cells that are not security related. The so-called non-security related means that the PCI and frequency of these target cells are not used as security keys.

The UE generates a first security key based on the PCI and the frequency of the first target cell and the security algorithm indicated by the security algorithm identifier of the first target station according to the received indication of the handover command message, and is based on the second target cell. PCI and frequency, and a security algorithm indicated by the security algorithm identifier of the second target site generates a second security key;

Specifically, the step of the UE generating the first security key may be as follows: determining whether the count value of the locally maintained NCC overflows, and if yes, generating according to the PCI and frequency of the second target cell and the current parameter value of the UE. If not, generating a first security key according to the PCI and frequency of the first target cell, and ^κ generating a security algorithm indicated by the security algorithm identifier of the first target station, and the generated K _eNM ;

The step of the UE generating the second security key may be as follows: determining whether the count value of the locally maintained NCC overflows, and if yes, generating ^κ ^* ₂ according to the PCI and frequency of the first target cell and the current NH parameter value of the UE. If not, generating K _eNB * ₂ according to the PCI and frequency of the first target cell, and ^κ _; generating a second security key by using the security algorithm indicated by the security algorithm identifier of the first target site, and the generated ^κ · ₂ .

51 1. The first target site generates a first security key based on a security algorithm used locally.

51 2. The second target site generates a second security key based on ^Κ 2 and its locally used security algorithm.

51. The UE performs data security transmission with the first target station and the second target station by using the first security key and the second security key, respectively. Incidentally, in the embodiment ^Κ · ² is the first site to a second site generated by the embodiment of the present invention, in practice, the first station may be a request to the second site a second Web site currently used ^κ *, after learning ^κ · second station currently in use, and a PCI-based frequency and the second target cell ^κ · generating ^κ ^ * _2, or the first site may be generated based on the PCI target and the second cell ^[kappa] ^κ ^ * ₂ , and in the handover command message sent to the UE, the UE is instructed to generate ^κ ^* ₂ based on the ^κ and the PCI of the second target cell, which is not limited herein.

It should be noted that the foregoing step 51 1 and step 51 2 may also be performed after step 507 to before step 51 0 , which is not limited herein.

It should be noted that the embodiment of the present invention is described based on the foregoing method embodiment, where the first site and the second site are switched to the first target site and the second target site, and in actual applications, the service site of the UE may also be The third site and the fourth site are used. If the third site is the site responsible for UE handover control, the first intermediate key in this embodiment may be replaced with the third site currently used for data security transmission with the UE. The intermediate key can replace the second intermediate key in the embodiment of the present invention with an intermediate key currently used by the fourth station for data security transmission with the UE.

The first site, the second site, the first target site, and the second target site may be, for example, a base station or a relay station, and are not limited herein.

It can be seen that, according to the technical solution provided by the embodiment of the present invention, when the UE needs to switch from the current serving site to more than two target sites, it may be generated for performing with the target site according to the indication of the received handover command message. The security key of data security transmission realizes the secure transmission of data between the UE and the target station to be switched when switching from the current service site to multiple target sites.

In an application scenario, the UE may use the same security key to perform data security transmission with the first site and the second site. In this scenario, the security key generation process when the UE switches to work at other sites may be used. As shown in Figure 6:

601. The UE sends a second measurement report message to the first station.

602. The first station makes a handover decision based on the second measurement report message, and determines to switch the UE to work under the first target site and the second target site.

603. Generate a third intermediate key (hereinafter referred to as an alternative) based on the PCI and the frequency of the target cell. The target cell is a cell that the first station determines to switch the UE to based on the second measurement report message, where the target cell may be one. Alternatively, if there are multiple target cells, multiple processes may be generated. Specifically, the process of generating the third intermediate key may be as follows: Whether the count value of the protected NCC overflows, and if so, according to the PCI and frequency of the target cell, and the current NH parameter value of the first station, if not, according to the PCI and frequency of the target cell, and the first intermediate key ( The following is an alternative to generating κ^ΝΜ.

604. The first station sends a handover request message to the target station, and is carried in the handover indication message, where the target site is a site that the first site decides to switch the UE to based on the second measurement report message, and the target site may be one. There may be multiple. If there are multiple target sites, the first site may separately send a handover request message to multiple target sites, or send the handover request message to one of the target sites, and the target site forwards to the other site. The target site, or the handover request message may be sent to a target site, and the target site performs the admission control, and then the other target station UE is notified of the handover by using a message (such as a handover indication message), which is not limited herein.

605. The first station receives a handover request acknowledgement message returned by the target station, where the handover request acknowledgement message carries the PCI and frequency of the target cell that is used by the target site to generate the first security key, and the security algorithm identifier of the security algorithm. Further, the handover request acknowledgement message also carries the PCI and frequency of other target cells that are not security related.

It should be noted that the PCI and frequency of the target cell used to generate the first security key determined by the target station included in the handover request acknowledgement message, and the security algorithm identifier may be determined by a single target site, or may be How many target sites are negotiated and determined. For example, if the target station includes the first target station and the second target station, the first target station may perform the admission control after receiving the handover request message sent by the first station, and determine the target cell used for the handover by the UE, The PCI and frequency of the target cell used to generate the first security key, and the security algorithm used to generate the first security key, and then send the PCI and frequency of the target cell and the security algorithm identifier of the security algorithm to the first The second target station notifies the second target station that the UE will switch to work under its site, and instructs the second target station to generate the first security key based on the PCI and frequency of the target cell and the security algorithm identifier of the security algorithm. The target node only needs to determine the PCI and frequency of the target cell used to generate the first security key, and the security algorithm identifier of the security algorithm, and can send the above handover request acknowledgement message to the first station without generating After the first security key, the foregoing handover request acknowledgement message is sent to the first station.

606. The first station sends a handover command message to the UE, and carries, in the handover command message, a PCI and a frequency of the target cell that is used by the target station to generate the first security key, and is related to the PCI and the frequency of the target cell. The ^^ and security algorithm identifiers. Further, switching lives The message also carries the PCI and frequency of other target cells that are not security related.

607. The UE generates a first security secret according to the indication of the received handover command message, based on the PCI and frequency of the target cell used to generate the first security key, and the security algorithm indicated by the security algorithm identifier indicated in the handover command message. Key

Specifically, the step of the UE generating the first security key may be as follows:

Determining whether the count value of the locally maintained NCC overflows, and if so, generating a ^κ according to the PCI and the frequency in the handover command message and the current NH parameter value of the UE, according to the PCI and the frequency in the handover command message, and ^κ ΝΜ ; The first security key is generated using the security algorithm indicated by the security algorithm identifier in the handover command message, and the generated ^κ ^*ι.

608. The target station generates the first security key by using the security algorithm used by the foregoing determination and the ^κ ·ι.

609. The UE uses the first security key to perform data security transmission with the target site.

It should be noted that the foregoing step 608 may be performed after step 604 to before step 608, which is not limited herein.

It should be noted that the embodiment of the present invention is described based on the foregoing method embodiment, where the first site and the second site are switched to the target site, and in actual applications, the service site of the UE may also be the third site and the fourth site. If the third site is the site responsible for the UE handover control, the first intermediate key in this embodiment may be replaced with the intermediate key currently used by the third site for data security transmission with the UE.

The first site, the second site, and the target site may be, for example, a base station or a relay station, and the like, which is not limited herein.

It can be seen that, according to the technical solution provided by the embodiment of the present invention, when the UE needs to switch from the current serving site to another site, according to the indication of the received handover command message, the data for secure transmission with the target site may be generated. The security key enables secure transmission of data between the UE and the target site to be switched when switching from the current serving site to other target sites.

The present invention can also be used to generate a security key based on the security algorithm used by the first site. The following describes the data security transmission method in the embodiment of the present invention by using the UE as a description body. Referring to FIG. 7, the method includes:

701. The UE sends a first measurement report message to the first station.

For details, refer to the description of step 1 01 in Figure 1-a, and details are not described here.

702. Receive a cell addition command message returned by the first station. The UE receives the cell addition command message returned by the first station, where the cell addition command message includes the PCI and the frequency of the newly added cell.

In the embodiment of the present invention, the first station determines, according to the foregoing first measurement report message, the cell under the second site as the new serving cell of the UE. For convenience of description, the first site is determined to be newly added by the UE. The cell is called a new cell. The first station may generate a second intermediate key (hereinafter replaced by ^κ ) based on the PCI and frequency of the newly added cell, and the first intermediate key (hereinafter replaced by ^^) used by the UE for data secure transmission, or ^κ · first station may be generated based on the current parameter value of the new cell ΝΗ PCI and frequency, and a first station, particularly, the first station based on the parameter values to generate or ΝΗ ^{Κ Β} * dependent on the first local site maintenance the (NCC, Next Hop Chaining count) count value, if the NCC count value overflows, the first station based on the parameter values to generate NH ^{K sNB} *, if no overflow, the ^K ^ B is generated based on the ^{K sNB} *. After generating ^K sNB*, the first site transmits the security algorithm identifier of the first site to the second site, and the second site may be based on

The K _eNB * and the security algorithm used by the first station generate a security key, and return a cell addition request acknowledgement message to the first station. After receiving the cell increase request acknowledgement message returned by the second station, the first station sends a cell to the UE. The command message is added to instruct the UE to generate a security key for secure transmission of data with the second station.

It can be understood that, in actual applications, there may be multiple new cells, and the first station may generate multiple ^Κ6ΝΒ * based on PCI and frequency of multiple newly added cells, and send multiple ^ΚβΝΒ * to the second. At the site, the second site generates multiple sets of security keys based on multiple ^κ *s. Since the UE and the different cells under the same site can share a set of security keys for data security transmission, the first station may indicate a new one for generating a security key in the cell addition command message sent to the UE. PCI frequency cell growth and, in addition, the cell increase command message carries a plurality of other cells of the new safety-related and frequency may be a PCI, or the second site may also be generated based on a plurality of security in a ^{Κ Β} _* The key is used to notify the first site to generate the security key by using the message , ^Β *, and the first station sends the PCI and the frequency of the new cell that generates the ^k ^ B* to the UE, which is not limited herein.

In one application scenario, the first station may be received at a second cell site adding request returned confirmation message, using a security key updates the security algorithm identifier and first site ^{Κ Β *} use, in order to use thereafter The security key is securely transmitted with the UE.

In an application scenario, when the first site determines that a new site (such as the second site) joins, the current serving cell of the UE also needs to suspend work to stop and first because the security key is updated. The data transmission of the station is securely transmitted. Therefore, the first station may carry the transmission suspension time in the cell addition command message, so that the UE may suspend data security transmission with the first station during the time period indicated by the transmission suspension time, or The first station may also not carry the transmission pause time in the cell addition command message, and the UE pauses the data security transmission with the first station in the preset time period after receiving the cell increase command message, or the UE may also After the uplink synchronization of the newly added cell is successfully obtained, the data is securely transmitted with the first site, and the data is securely transmitted to the first site after the security key is successfully generated, which is not limited herein. It should be noted that the above data security transmission refers to data transmission requiring encryption and/or integrity protection.

703. Generate a security key based on the PCI and frequency of the newly added cell and a security algorithm used by the first station.

After receiving the cell increase command message from the first station, the UE may indicate, according to the cell increase command message, a PCI and a frequency of a new cell used to generate the security key, and the first according to the indication of the cell increase command message. The security algorithm used by the site generates a security key. Specifically, the step of generating a security key may include:

The UE determines whether the count value of the locally maintained NCC overflows, and if so, generates ^k B* according to the PCI and frequency of the newly added cell and the current NH parameter value of the UE, and if not, according to the PCI of the newly added cell Frequency, and the first intermediate key used by the UE for data secure transmission to generate ^K eNB*;

Use the security algorithm used by the first site, and the generated ^K _B * to generate a security key (including Kup _enc2 , K _CPenc2 and _{cp Μ 2} ).

704. Perform secure data transmission with the second site by using the generated security key.

After the security key is generated in step 703, the UE can use the security key to perform data secure transmission with the second station.

It can be understood that if the first station does not update the security key used by the UE for data security transmission, the UE and the first station still use the original security key for data security transmission, if the first station is based on κ· The security algorithm used by the first site updates the security key, and the UE can perform data security transmission with the first site by using the security key generated in step 703.

It can be seen that, according to the technical solution provided by the embodiment of the present invention, on the one hand, the UE receives the small After the command message is added to the area, the security key can be generated according to the indication of the cell addition command message, and the security key is used to securely transmit data with the newly added station, so that the UE can perform data security transmission with the original service station. It can also transmit data securely with the newly added sites, and realize the secure transmission of data between the UE and different service sites.

The present invention can also be used to generate a security key based on the security algorithm used by the first site. The data security transmission method in the embodiment of the present invention is described below with reference to the first site.

801. The first station receives a first measurement report message sent by the UE.

In the embodiment of the present invention, the first station determines, according to the foregoing first measurement report message, the cell under the second site as the new serving cell of the UE. For convenience of description, the first site is determined to be newly added by the UE. The cell is called a new cell. The first station may generate a second intermediate key (hereinafter replaced by ^κ ) based on the PCI and frequency of the newly added cell, and the first intermediate key (hereinafter replaced by ^^) used by the UE for data secure transmission, or The first station may generate ^κ * based on the PCI and frequency of the newly added cell and the current lower flea parameter value of the first station. Specifically, the first station generates ^κ based on the κ or ΝΗ parameter value* depending on the first The count value of the NCC maintained locally by the station. If the count value of the NCC overflows, the first station generates ^κ * based on the ΝΗ parameter value, and if it does not overflow, generates K _eNB * based on ^K e B .

Further, the first station after generating ^KB *, ^K B * may be carried to the second station in a cell transmits a message addition request, a second request for the station serving the UE, further, the first site can be used The security algorithm identifier of the security algorithm is carried in the cell addition request message, or the security algorithm identifier of the security algorithm used by the security algorithm is sent to the second site by other independent messages, which is not limited herein. After receiving the cell increase request message, the second site may return a cell increase request acknowledgement message to the first site. Further, after the second site learns the security algorithm used by the first site, the second site may be based on the ^κ and the first site. The security algorithm used generates a security key for subsequent UE lifetime After the security key is formed, the security key can be used to securely transmit data to the second site. In an actual application, if there are multiple new cells, the first site may generate multiple*s based on the PCI and frequency of the multiple newly added cells, and send multiple bearer cell addition request messages to the second site. by the second station based on the plurality of sets of ^K _B * generated security key, or by selecting a second site from a plurality of ^{K sNB} ^{K sNB} * *, * generating a security key based on the selected ^{K sNB.}

In one application scenario, the first station receiving the request to increase the cell site are returned after the second acknowledgment message, using a security algorithm may update the security key security algorithm identifier and first site ^Κ · indication, in order to Thereafter, the security key is used to securely transmit data with the UE.

802. Send a cell addition command message to the UE.

After receiving the cell addition request acknowledgement message returned by the second station, the first station sends a cell addition command message to the UE, instructing the UE to generate a security key for data security transmission with the second station, and carrying the message in the cell addition command message. The PCI and frequency of a new cell used to generate the security key, so that the UE generates a security key based on the PCI and frequency of the newly added cell and the security algorithm used by the first site.

It can be understood that, when the UE accesses the first station, the UE can learn the security algorithm used by the first station, and therefore does not need to carry the security algorithm identifier of the first station in the cell addition command message. In the actual application, there may be multiple new cells, because the UE and the different cells under the same site can share a set of security keys for data security transmission. Therefore, the first station adds a command message to the cell sent to the UE. The PCI and the frequency of the newly added cell that is used to generate the security key may be instructed, and the cell addition command message may carry the PCI and the frequency of the multiple other newly added cells, or may be used to learn the second site. to generate a security key ^{Κ Β} _* after the ^ generated, the frequency of the new cell and the PCI transmission to the UE, is not limited herein.

In an application scenario, when the first site determines that the second site joins, the current serving cell of the UE also needs to suspend work to stop the data transmission with the first site due to the update of the security key. Therefore, The first station may carry the transmission suspension time in the cell addition command message, so that the UE may suspend data security transmission with the first station during the time period indicated by the transmission suspension time, or the first station may not increase in the cell. The command message carries the transmission pause time, and the UE pauses the data security transmission with the first station in the preset time period after receiving the cell increase command message, or the UE may successfully acquire the new cell. After the uplink synchronization, pause the data security transmission with the first site, and resume the data with the first site after the security key is successfully generated. Secure transmission, not limited here. It should be noted that the above data security transmission refers to data transmission requiring encryption and/or integrity protection.

In order to facilitate a better understanding of the technical solution of the present invention, a data security transmission method in the embodiment of the present invention is described in an application scenario. In this application scenario, the first site updates the security key, see FIG. 9, including :

901 UE accesses the first station, at this time, the UE and the MME generate the same basic key ^k ASME

902 The UE and the MME further derive an intermediate key ^, a second key ¹ ^^ and an NH parameter value based on the KASME.

903 The MME sends the generated ^{κ NAS} and ΝΗ parameter values to the first site.

904 UE generates security key 0 according to ^κ and a security algorithm used by the first station, where security key 0 includes ^KlJPenc , KcPenc, and ^K CPmt

905. The first station generates a security key according to the security algorithm used by the ^κ and the first station. The UE and the first station use the generated security key 0 for data security transmission.

907 The UE sends a first measurement report message to the first station.

908. After receiving the first measurement report message sent by the UE, the first station determines, according to the information about the first measurement report message and the service volume of the UE, that the cell under the second site is used as a service cell added by the UE, and determining Whether the count value of the locally maintained NCC overflows, and if so, generates a second intermediate key (substituted by ^κ ·) according to the determined PCI and frequency of the newly added cell and the current lower flea parameter value of the first station. If not, a new cell is determined according to the PCI and the frequency, and a first intermediate key that the UE currently used for secure transfer of data (hereinafter to replace ^[kappa]) generated ^κ ·.

909. Send a cell increase request message to the second site.

The first station sends a cell addition request message to the second station, requesting the second station to provide the UE with the service, where the cell increase request message carries the ^κ generated by step 908 and the first station enables The security algorithm identifier of the security algorithm used.

91: After receiving the cell addition request message from the first station, the second station returns a cell addition request acknowledgement message to the first station.

911. After receiving the cell increase request acknowledgement message, the first station sends a cell add command message to the UE, and the cell add command message carries the PCI and frequency of an added cell for generating the second security key.

912. After receiving the cell addition command message, the UE determines whether the count value of the locally maintained NCC overflows. If yes, according to the PCI and frequency of the newly added cell in the cell increase command message, and the current downlink hop NH parameter value of the UE. Generate ^κ ·. If not, the PCI and frequency of a newly added cell used to generate the security key in the cell addition command message, and the ^Ke generated ^KeNB * used by the UE for data security transmission are generated.

913. The UE, the first station and the second station generate a security key 1 based on ^K _B * and a security algorithm used by the first site, where the security key 1 includes ^K ^n. 2, K _cp∞ . ₂ and K _CPint2 .

914. The UE uses the second security key to perform data security transmission with the first site and the second site. It should be noted that, in step 913, the action of generating the security key 1 by the first station may be performed at any time in steps 911 to 913, and the action of generating the second security key by the second station may be performed in steps 910 to Any time in 913 is performed without strict limitation in step 913.

In an application scenario, the UE may need to switch from the current serving site to work under other sites due to the UE's own mobile or signal changes. For example, the UE may need to go from the "first site + the second" during the mobile process. The data transfer mode of the site "switches to the data transfer mode of the "first target site + second target site". The security key generation process in this scenario can be referred to the descriptions in FIG. 5 and FIG. 6, and details are not described herein again.

A user equipment in the embodiment of the present invention is described below. Referring to FIG. 10, the present invention is described. The user equipment 1 000 in the embodiment includes:

The sending unit 1 001 is configured to send a first measurement report message to the first station, where the first station is a current serving station of the user equipment 1000.

a receiving unit 1 002, configured to receive a cell addition command message returned by the first station, where the cell addition command message includes a PCI and a frequency of the newly added cell, and a security algorithm identifier of the second site to which the new cell belongs, where The new cell is determined by the first station to be a new serving cell added by the user equipment 1000 based on the first measurement report message.

The generating unit 1 003 is configured to generate a security key based on the PCI and the frequency of the newly added cell, and the security algorithm indicated by the security algorithm identifier included in the cell addition command message received by the receiving unit 1002.

Specifically, the generating unit 1 003 can include:

a determining unit, configured to determine whether a count value of the locally maintained NCC overflows;

a first generating unit, configured to generate a second intermediate key according to the PCI and frequency of the newly added cell and the current NH parameter value of the user equipment 1000 when the determining result of the determining unit is YES; If not, generating a second intermediate key according to the PCI and frequency of the newly added cell, and the first intermediate key used by the user equipment 1000 for data security transmission;

And a second generating unit, configured to generate a security key by using a security algorithm indicated by a security algorithm identifier included in the cell addition command message, and a second intermediate key generated by the first generating unit.

The user equipment 1 000 further includes: a transmission unit 1004, configured to perform data secure transmission with the second station by using the security key generated by the generating unit 1 003. Further transmission unit 1 004 can also be used for secure data transmission with the first site using the security key generated by the generating unit 1003.

In an application scenario, due to the movement of the user equipment 1 000 or the change of the signal, the user equipment 1 000 may need to switch from the current service station to work under other stations. For example, the UE may need to be from the mobile process. The data transmission mode of the first site + the second site is switched to the data transmission mode of the "first target site + second target site". Therefore, in an application scenario, when the user equipment 1000 performs data secure transmission with the first station and the second station respectively by using different security keys, the sending unit 1 001 may be further configured to send the second measurement report message to the first station. The first station is a station responsible for the handover control of the user equipment 1000. The receiving unit 1002 is further configured to receive a handover command message sent by the first station, where the handover command message includes a PCI and a frequency of the first target cell, and a second target. The PCI and frequency of the cell, and the PCI and frequency of the first target cell a first intermediate key and a security algorithm identifier of the first target site, a second intermediate key associated with the PCI and frequency of the second target cell, and a security algorithm identifier of the second target site, wherein a target cell and the second target cell are cells determined by the first station to switch the user equipment 1000 based on the second measurement report message, where the first target station and the second target station are based on the foregoing The second measurement report message determines the site to which the user equipment is switched; the generating unit 1 003 is further configured to: based on the indication of the foregoing handover command message, based on the PCI and frequency of the first target cell, and the security algorithm identifier of the first target station The security algorithm indicated by the symbol generates a first security key, based on the PCI and frequency of the second target cell, and the security algorithm indicated by the security algorithm identifier of the second target station generates a second security key; the transmission unit 1 004 further Can be used to perform the first security key generated by the generating unit 1 003 with the first target site According secure transmission; secure transmission of data to the second target site using the second security key generating unit 1003 generates.

In an application scenario, when the user equipment 1000 uses the same security key to perform data secure transmission with the first station and the second station, the sending unit 1001 may be configured to send a second measurement report message to the first station; The first command may be used to receive the handover command message sent by the first station, where the handover command message includes the PCI and frequency of the target cell used by the target station to generate the first security key, and is related to the PCI and frequency of the target cell. The first intermediate key and the security algorithm identifier, wherein the target station determines, for the first station, the site to which the user equipment 1000 is switched based on the second measurement report message; the generating unit 1003 is configured to use the handover command message according to the foregoing And generating, by the security algorithm indicated by the PCI and the frequency in the handover command message, and the security algorithm identifier, the first security key; the transmission unit 1004 is configured to use the first security key generated by the generating unit 1 003 and the foregoing The target site performs data security transmission.

It should be noted that the user equipment 1000 in this embodiment may be used as the user equipment in the foregoing method embodiments in FIG. 1 -a to FIG. 6 , and may be used to implement all the technical solutions in the foregoing method embodiments in FIG. 1 -a to FIG. The function of each of the functional modules may be specifically implemented according to the method in the foregoing method embodiment. For the specific implementation process, reference may be made to the related description in the foregoing embodiments, and details are not described herein again.

A network site in the embodiment of the present invention is described below. Referring to FIG. 11, the network site 11 00 in the embodiment of the present invention includes:

The receiving unit 11 01 is configured to receive a first measurement report message sent by the UE.

The sending unit 102 is configured to send a cell addition command message to the UE, where the cell is increased. The command message includes the PCI and frequency of the newly added cell, and the security algorithm identifier of the second site to which the new cell belongs, so that the UE is based on the PCI and frequency of the newly added cell, and the security algorithm identifier of the second site. The security algorithm indicated by the symbol generates a security key, where the new cell is determined by the network station 1 00 to be a new serving cell of the UE based on the received first measurement report message.

Further, the network site 11 00 further includes a determining unit 1103 and a generating unit 11 04, wherein: the determining unit 1103 is configured to determine whether the count value of the locally maintained lower hop chain counter NCC overflows;

The generating unit 1104 is configured to generate a second intermediate key according to the PCI and frequency of the newly added cell and the current NH parameter value of the network station 1100 when the determining result of the determining unit 1103 is YES; when the determining unit 11 03 determines the result If not, the second intermediate key is generated according to the PCI and frequency of the newly added cell, and the first intermediate key used by the UE for data security transmission.

In an actual application, the sending unit 102 is further configured to send a cell addition request message to the second station, where the cell increase request message carries the second intermediate key generated by the generating unit 1104; the receiving unit 1101 is further used to Receiving a cell increase request acknowledgement message returned by the second station.

In a practical application, the generating unit 104 is further configured to generate a new security key based on the security algorithm indicated by the security algorithm identifier of the second site, and the second intermediate key, so as to utilize the new security key and the foregoing The foregoing UE performs data security transmission, where the security algorithm identifier of the second site may be obtained from the cell addition request acknowledgement message received by the receiving unit 1101, or may also be obtained from other received messages from the second site. , here is not limited.

In an application scenario, the UE may need to switch from the current serving site to work under other sites due to the UE's own mobile or signal changes. For example, the UE may need to go from the "network site 1100 + the second" during the mobile process. The data transfer mode of the site "switches to the data transfer mode of the "first target site + second target site". Therefore, in an application scenario, when the UE performs data secure transmission with the network site 11 00 and the second site by using different security keys, the receiving unit 1101 may be further configured to receive a second measurement report message sent by the UE; 1102 is configured to send a handover indication message to the second station, where the handover indication message carries a PCI and a frequency of the second target cell, so that the second site generates a fourth intermediate key based on the PCI and the frequency of the second target cell. The second target cell is a cell that the network site 110 determines to switch the UE to based on the second measurement report message, and the receiving unit 1101 is configured to receive the handover indication sent by the second site. a feed message, where the handover indication feedback message carries a fourth intermediate key generated by the second station based on the PCI and frequency of the second target cell; and the generating unit 10 04 is further configured to use the PCI and the frequency based on the first target cell. Generating a third intermediate key, where the first target cell is a cell that the network site 11 00 determines to switch the UE to based on the second measurement report message; the sending unit 1102 is further configured to use the third intermediate key and the third The fourth intermediate key is sent to the first target station and the second target station, respectively, so that the first target station generates the first security key according to the third intermediate key and the security algorithm used by the first target station, and the second The target station generates a second security key according to the fourth intermediate key and the security algorithm used by the second target station, where the first target station and the second target station are the network station 1100 based on the received second measurement. The report message determines the site to which the UE is switched; further, the network site 1100 may further include an obtaining unit for Obtaining the security algorithm identifiers of the first target station and the second target station; the sending unit 102 is further configured to send a handover command message to the UE, where the handover command message includes the PCI and the frequency of the first target cell, and the foregoing a PCI and a frequency of the second target cell, and a first intermediate key associated with the PCI and frequency of the first target cell and a security algorithm identifier of the first target site, associated with the PCI and frequency of the second target cell a second intermediate key and a security algorithm identifier of the second target station, so that the UE can be based on the PCI and frequency of the first target cell and the security algorithm identifier of the first target station according to the indication of the handover command message The indicated security algorithm generates a first security key for secure transmission of data with the first target site, a PCI and frequency based on the second target cell, and a security algorithm indicated by the security algorithm identifier of the second target site Generating a second security key for secure transmission of data with the second target site described above.

In an application scenario, when the UE uses the same security key to perform data secure transmission with the network site 11 00 and the second site, the receiving unit 101 may be further configured to receive the second measurement report message sent by the UE. And the third intermediate key is further generated according to the PCI and the frequency of the target cell, where the target cell determines, by the network station 1 00, the cell to which the UE is switched based on the received second measurement report message; And sending, by the target station, a handover request message, where the handover request message carries the third intermediate key, so that the target station generates a first security key based on the third intermediate key, where the target site is a network. The station 1100 determines, according to the received second measurement report message, the station to which the UE is switched. The receiving unit 1101 is further configured to receive a handover request acknowledgement message returned by the target station, where the handover request acknowledges The information carries the target cell determined by the target station to generate the first security key.

The PCI and the frequency, and the security algorithm identifier of the security algorithm; the sending unit 1102 is further configured to send a handover command message to the UE, where the handover command message includes the target cell determined by the target station to generate the first security key. PCI and frequency, and a security algorithm identifier of the used security algorithm, so that the UE is generated based on the PCI and frequency of the target cell and the security algorithm indicated by the security algorithm identifier according to the indication of the handover command message. The first security key for secure transmission of data with the above target site.

It should be noted that the network site 1100 of this embodiment may be the first site in the foregoing method embodiment, FIG. 1 - a - FIG. 6 , and may be used to implement all the technologies in the foregoing method embodiments in FIG. 1 - a - FIG. For example, the functions of the respective functional modules may be specifically implemented according to the method in the foregoing method embodiment. For the specific implementation process, reference may be made to the related description in the foregoing embodiments, and details are not described herein again.

The following describes another user equipment in the embodiment of the present invention. The user equipment in the embodiment of the present invention includes:

And a sending unit, configured to send a first measurement report message to the first station, where the first site is a current serving site of the user equipment.

a receiving unit, configured to receive a cell addition command message returned by the first station, where the cell addition command message includes a PCI and a frequency of the newly added cell, where the newly added cell is determined by the first station according to the first measurement report message. A service cell added for the above user equipment.

a generating unit, configured to generate a security key based on the PCI and frequency of the newly added cell and the security algorithm used by the first site;

Specifically, the generating unit may include:

a first generating unit, configured to generate a second intermediate key according to the PCI and frequency of the newly added cell and the current NH parameter value of the user equipment when the determining result of the determining unit is YES; If not, generating a second intermediate key according to the PCI and frequency of the newly added cell, and the first intermediate key used by the user equipment for data security transmission;

And a second generating unit, configured to generate a security key by using a security algorithm used by the first site, and a second intermediate key generated by the first generating unit.

And a transmission unit, configured to perform data security transmission with the second site by using the security key generated by the generating unit. A further transmission unit can also be used to utilize the security key generated by the above generating unit The first site performs data security transmission.

It should be noted that the user equipment in this embodiment may be used as the user equipment in the foregoing method embodiments in FIG. 7 to FIG. 9 , and may be used to implement all the technical solutions in the foregoing method embodiments in FIG. 7 to FIG. 9 . For the specific implementation process, reference may be made to the related description in the foregoing embodiments, and details are not described herein again.

Another network site in the embodiment of the present invention is described below. The network site in the embodiment of the present invention includes:

a receiving unit, configured to receive a first measurement report message sent by the UE;

a sending unit, configured to send a cell addition command message to the UE, where the cell add command message includes a PCI and a frequency of the newly added cell, so that the UE is based on the PCI and frequency of the newly added cell, and the network station uses The security algorithm generates a security key, where the new cell is determined by the network station to be a new serving cell of the UE based on the first measurement report message.

Further, the network node further includes a determining unit and a generating unit, wherein the determining unit is configured to determine whether the count value of the locally maintained lower hop chain counter NCC overflows; and the generating unit is configured to: when the determining result of the determining unit is yes, according to Adding the physical cell identifier PCI and frequency of the cell, and the current NH parameter value of the network site to generate a second intermediate key; when the judgment result of the determining unit is no, according to the physical cell identifier PCI and frequency of the newly added cell And generating, by the first intermediate key used by the UE for data secure transmission, a second intermediate key.

The sending unit is further configured to send a cell addition request message to the second station to which the new cell belongs, where the cell increase request message carries the second intermediate key generated by the generating unit, and the receiving unit is further configured to receive the foregoing The cell returned by the second station adds a request acknowledgement message.

In an actual application, the generating unit may be further configured to generate a security key based on the security algorithm used by the network site and the second intermediate key, so as to perform data security transmission with the UE by using the security key.

It should be noted that the network device in this embodiment may be the network device in the foregoing method embodiment, and the network device in FIG. 7 to FIG. 9 may be used to implement all the technical solutions in the foregoing method embodiments in FIG. 7 to FIG. For the specific implementation process, reference may be made to the related description in the foregoing embodiments, and details are not described herein again.

A person skilled in the art can understand that all or part of the steps in implementing the above embodiments can be completed by a program to instruct related hardware, and the program can be stored in a computer. In the read storage medium, the above-mentioned storage medium may be a read only memory, a random access memory, a magnetic disk or an optical disk or the like.

The data security transmission method and the related device provided by the present invention are described in detail above. For those skilled in the art, according to the idea of the embodiment of the present invention, there are changes in the specific implementation manner and application scope. In conclusion, the contents of this specification are not to be construed as limiting the invention.

Claims

Rights request

A data security transmission method under a multi-site, characterized in that:

The user equipment UE sends a first measurement report message to the first station, where the first station is the current monthly service station of the UE;

Receiving, by the first station, a cell addition command message, where the cell addition command message includes a physical cell identifier PCI and a frequency of the newly added cell, and a security algorithm identifier of the second site to which the new cell belongs, where The new cell is determined by the first station to be a new serving cell of the UE based on the first measurement report message;

Generating a security key based on the PCI and frequency of the newly added cell and a security algorithm indicated by the security algorithm identifier;

Securely transmitting data to the second site using the generated security key.

2. The method of claim 1 wherein

The generating a security key includes:

Determine whether the count value of the NCC of the local maintenance of the next hop chain counter overflows.

If yes, generating a second intermediate key according to the PCI and the frequency of the newly added cell, and the current NH hop NH parameter value of the UE,

If not, generating a second intermediate key according to the PCI and frequency of the newly added cell and the first intermediate key used by the UE for data security transmission;

A security key is generated using the security algorithm indicated by the security algorithm identifier and the generated second intermediate key.

3. A method according to claim 1 or 2, characterized in that

After generating the security key, it also includes:

Securely transmitting data to the first site using the security key.

4. A method according to any one of claims 1 or 2, characterized in that

The cell increase command message further includes a transmission pause time;

After the receiving the cell addition command message returned by the first site, the method further includes: Data secure transmission with the first station is suspended during the time period indicated by the transmission pause time.

5. A method according to claim 1 or 2, characterized in that

After the receiving the cell addition command message returned by the first station, the method further includes: suspending data security transmission with the first station after successfully acquiring the uplink synchronization of the new cell.

6. A method according to claim 1 or 2, characterized in that

After the data security transmission with the second site by using the generated security key, the method further includes:

Sending a second measurement report message to the first station;

Receiving a handover command message sent by the first station, where the handover command message includes a PCI and a frequency of a first target cell, a PCI and a frequency of a second target cell, and a PCI and a frequency associated with the first target cell. a first intermediate key and a security algorithm identifier of the first target site, a second intermediate key associated with a PCI and a frequency of the second target cell, and a security algorithm identifier of the second target site, The first target cell and the second target cell are cells that the first station decides to switch the UE to based on the second measurement report message, the first target station and the second The target station is a site that the first station decides to switch the UE to based on the second measurement report message;

And generating, according to the indication of the handover command message, a first security secret based on a PCI and a frequency of the first target cell, the first intermediate key, and a security algorithm indicated by a security algorithm identifier of the first target station Key, generating a second security key based on a PCI and frequency of the second target cell, the second intermediate key, and a security algorithm indicated by a security algorithm identifier of the second target site; Securely transmitting data to the first target site;

Securely transmitting data to the second target site using the second security key.

7. The method of claim 6 wherein:

The generating the first security key includes: Determine whether the count value of the NCC of the local maintenance of the next hop chain counter overflows.

If yes, generating a third intermediate key according to the PCI and frequency of the first target cell and the current downlink hop NH parameter value of the UE,

If not, generating a third intermediate key according to the PCI and frequency of the first target cell and the first intermediate key;

Generating a first security key by using a security algorithm indicated by the security algorithm identifier of the first target site and the generated third intermediate key;

The generating the second security key includes:

If yes, according to the PCI and frequency of the second target cell, and the current downlink of the UE.

The NH parameter value, generating a fourth intermediate key,

If not, generating a fourth intermediate key according to the PCI and the frequency of the second target cell and the second intermediate key;

Generating a second security key using the security algorithm indicated by the security algorithm identifier of the second target site and the generated fourth intermediate key.

8. The method of claim 3, wherein

Sending a second measurement report message to the first station;

Receiving a handover command message sent by the first station, where the handover command message includes a PCI and a frequency of a target cell determined by the target station for generating the first security key, and is associated with a PCI and a frequency of the target cell. a first intermediate key and a security algorithm identifier, wherein the target station is a station that the first station decides to switch the UE to based on the second measurement report message; according to the indication of the handover command message Generating a first security key based on the PCI and frequency in the handover command message, the first intermediate key, and a security algorithm indicated by the security algorithm identifier; Securely transmitting data to the target site using the first security key.

9. The method of claim 8 wherein:

The generating the first security key includes:

If yes, generating a third intermediate key according to the PCI and the frequency in the handover command message, and the current downlink hop NH parameter value of the UE,

If not, generating a third intermediate key according to the PCI and the frequency in the handover command message, and the first intermediate key;

A first security key is generated using the security algorithm indicated by the security algorithm identifier in the handover command message and the generated third intermediate key.

10. A data security transmission method under a multi-site, characterized in that:

Sending a cell addition command message to the UE, where the cell addition command message includes a physical cell identifier PCI and a frequency of the newly added cell, and a security algorithm identifier of the second station to which the new cell belongs, to facilitate the UE Generating a security key based on a PCI and a frequency of the newly added cell and a security algorithm indicated by a security algorithm identifier of the second site, where the newly added cell is the first site based on the first measurement The report message is determined to be a new serving cell of the UE.

11. The method of claim 10, wherein

Before sending the cell addition command message to the UE, the method further includes:

If yes, generating a second intermediate key according to the PCI and frequency of the newly added cell and the current down-going NH parameter value of the first station,

Sending a cell addition request message to the second station, where the cell addition request message carries the generated second intermediate key; Receiving a cell increase request acknowledgement message returned by the second station.

12. The method of claim 11 wherein:

Receiving a security algorithm identifier of the second site sent by the second station;

Generating a new security key based on the security algorithm indicated by the security algorithm identifier of the second site and the second intermediate key to securely transmit data with the UE using the new security key.

13. Method according to claim 11 or 12, characterized in that

The cell increase command message further includes a transmission pause time;

After the sending the cell addition command message to the UE, the method further includes:

The data secure transmission with the UE is suspended during the period indicated by the transmission pause time.

14. Method according to claim 11 or 12, characterized in that

Receiving a second measurement report message sent by the UE;

Sending a handover indication message to the second station, where the handover indication message carries a PCI and a frequency of the second target cell, so that the second station generates a fourth intermediate key based on the PCI and the frequency of the second target cell. The second target cell is a cell that the first station decides to switch the UE to based on the second measurement report message;

And receiving, by the second station, a handover indication feedback message, where the handover indication feedback message carries a fourth intermediate key generated by the second station based on a PCI and a frequency of the second target cell; The PCI and the frequency generate a third intermediate key, wherein the first target cell is a cell that the first station decides to switch the UE to based on the second measurement report message;

Transmitting the third intermediate key and the fourth intermediate key to the first target site and the second target site, respectively, so that the first target site is used according to the third intermediate key and the first target site The security algorithm generates a first security key, and the second target site is based on the fourth intermediate key and The security algorithm used by the second target site generates a second security key, where the first target site and the second target site are that the first site decides to switch the UE based on the measurement report message To the site;

Obtaining a security algorithm identifier of the first target site and the second target site;

Sending a handover command message to the UE, where the handover command message includes a PCI and a frequency of the first target cell, a PCI and a frequency of the second target cell, and a PCI and a frequency related to the first target cell a first intermediate key and a security algorithm identifier of the first target site, a second intermediate key associated with a PCI and a frequency of the second target cell, and a security algorithm identifier of the second target site So that the UE is based on the indication of the handover command message, based on the PCI and frequency of the first target cell, the first intermediate key, and the security algorithm identifier of the first target station. a security algorithm generates a first security key for secure transmission of data with the first target site, a PCI and frequency based on the second target cell, the second intermediate key, and the second target site The security algorithm indicated by the security algorithm identifier generates a second security key for secure transmission of data with the second target site.

15. A method according to claim 11 or 12, characterized in that

Receiving a second measurement report message sent by the UE;

Sending a handover indication message to the second station, instructing the second station to feed back a second intermediate key used by the second station for data security transmission;

Receiving a handover indication feedback message sent by the second station, where the handover indication feedback message includes the second intermediate key;

Generating a third intermediate key based on the PCI and frequency of the first target cell, and the first intermediate key, generating a fourth intermediate key based on the PCI and frequency of the second target cell, and the second intermediate key, where The first target cell and the second target cell are cells that the first station decides to switch the UE to based on the second measurement report message;

Transmitting the third intermediate key and the fourth intermediate key to the first target site and the second mesh respectively Marking a site, so that the first target site generates a first security key according to the third intermediate key and a security algorithm used by the first target site, and the second target site is according to the fourth intermediate key And the security algorithm used by the second target site generates a second security key, where the first target station and the second target station are the first station, determining, according to the measurement report message, the UE Switch to the site;

Obtaining a security algorithm identifier of the first target station and the second target station; sending a handover command message to the UE, where the handover command message includes a PCI and a frequency of the first target cell, and the second a PCI and a frequency of the target cell, and the first intermediate key associated with the PCI and frequency of the first target cell and a security algorithm identifier of the first target site, and the second target cell And the second intermediate key associated with the frequency and the security algorithm identifier of the second target station, so that the UE is based on the PCI of the first target cell according to the indication of the handover command message a frequency, the first intermediate key, and a security algorithm indicated by a security algorithm identifier of the first target site generating a first security key for secure transmission of data with the first target site, based on the a PCI and frequency of the second target cell, the second intermediate key, and a security algorithm indicated by the security algorithm identifier of the second target site are generated for use with the second Site security standard for data transmission to the second security key.

16. The method of claim 12, wherein

Receiving a second measurement report message sent by the UE;

Generating a third intermediate key based on the PCI and the frequency of the target cell, where the target cell is a cell that the first station decides to switch the UE to based on the second measurement report message;

Sending a handover request message to the target station, where the handover request message carries the third intermediate key, so that the target station generates a first security key based on the third intermediate key, where the target site is Determining, by the first station, a site to which the UE is handed over based on the second measurement report message;

Receiving a handover request acknowledgement message returned by the target station, where the handover request acknowledgement message carries a PCI and a frequency of the target cell for generating the first security key determined by the target station, and a security algorithm identifier of the security algorithm;

Transmitting, to the UE, a handover command message, where the handover command message includes a PCI and a frequency of a target cell that is used by the target station to generate the first security key, and is related to a PCI and a frequency of the target cell. a first intermediate key and a security algorithm identifier, so that the UE is based on the PCI and frequency of the target cell, the first intermediate key, and the security algorithm according to the indication of the handover command message The security algorithm indicated by the identifier generates a first security key for secure transmission of data with the target site.

17. The method of claim 16 wherein:

The target node is specifically a first target node and a second target node;

The sending the handover request message to the target site includes:

Sending a handover request message to the first target station;

The receiving the handover request acknowledgement message returned by the target site includes:

Receiving a handover request acknowledgement message returned by the first target station;

The PCI and frequency of the target cell for generating the first security key determined by the target station carried in the handover request acknowledgement message, and the security algorithm identifier of the security algorithm are determined by:

After receiving the handover request message, the first target station determines a PCI and a frequency of a target cell used to generate the first security key, and a security algorithm;

Transmitting, to the second target station, a handover indication message, the handover indication message including a third intermediate key associated with the determined PCI and frequency of the target cell for generating the first security key, and a security algorithm identifier of the security algorithm, such that the second target site generates a first security key based on the third intermediate key and a security algorithm indicated by the security algorithm identifier; The first target station returns a handover indication acknowledgement message, and confirms the handover to the first target site.

18. A method for secure transmission of data under a multi-site, comprising: The user equipment UE sends a first measurement report message to the first station, where the first station is a current monthly service station of the UE;

Receiving, by the first station, a cell addition command message, where the cell addition command message includes a physical cell identifier PCI and a frequency of the newly added cell, where the newly added cell is a cell in the coverage of the second station, Determining, by the first station, that the UE is a new serving cell according to the first measurement report message;

Generating a security key based on the PCI and frequency of the newly added cell and a security algorithm used by the first station;

Securely transmitting data to the second site using the security key.

19. The method of claim 18, wherein

The generating a security key includes:

If yes, generating a second intermediate key according to the PCI and frequency of the newly added cell, and the current down-hop NH parameter value of the UE,

If not, generating a second intermediate key according to the PCI and frequency of the newly added cell, and the first intermediate key used by the UE for data security transmission;

A security key is generated using the security algorithm used by the first site and the generated second intermediate key.

20. A method according to claim 18 or 19, characterized in that

After the generating the security key, the method further includes:

Securely transmitting data to the first site using the security key.

21. A method according to claim 18 or 19, characterized in that

The cell increase command message further includes a transmission pause time;

After the receiving the cell addition command message returned by the first station, the method further includes: suspending data security transmission with the first station within a time period indicated by the transmission suspension time.

22. A method according to claim 18 or 19, characterized in that

A data security transmission method under a multi-site, characterized in that:

Sending a cell addition command message to the UE, where the cell addition command message includes a PCI and a frequency of the newly added cell, so that the UE is based on the PCI and frequency of the newly added cell, and the security used by the first station. The algorithm generates a security key, where the newly added cell is determined by the first station to be a new serving cell of the UE based on the first measurement report message.

24. The method of claim 23, wherein

If yes, generating a second intermediate key according to the PCI and frequency of the newly added cell, and the current NH parameter value of the first station,

Sending a cell addition request message to the second station to which the new cell belongs, where the cell addition request message carries the generated second intermediate key;

Receiving a cell increase request acknowledgement message returned by the second station.

25. The method of claim 24, wherein

The cell addition request message further carries a security algorithm identifier of the first site.

26. A method according to claim 24 or 25, characterized in that

Generating a new security key based on the security algorithm used by the first site and the second intermediate key to perform data secure transmission with the UE through the new security key.

The method according to any one of claims 23 to 25, wherein the cell addition command message further includes a transmission pause time;

28. A user equipment, comprising:

a sending unit, configured to send a first measurement report message to the first station, where the first site is a current serving site of the user equipment;

a receiving unit, configured to receive a cell addition command message returned by the first station, where the cell increase command message includes a physical cell identifier pci and a frequency of the newly added cell, and a security algorithm of the second site to which the newly added cell belongs An identifier, where the newly added cell is a serving cell that is determined by the first station to be added to the user equipment based on the first measurement report message;

a generating unit, configured to generate a security key based on a PCI and a frequency of the newly added cell and a security algorithm indicated by the security algorithm identifier;

And a transmission unit, configured to perform data security transmission with the second station by using a security key generated by the generating unit.

29. The user equipment of claim 28, wherein

The generating unit includes:

a judging unit, configured to determine whether the count value of the locally maintained down hopping chain counter NCC overflows; the first generating unit, configured to: when the determining result of the determining unit is yes, according to the PCI and frequency of the newly added cell, And generating, by the current NH parameter value of the user equipment, a second intermediate key; when the determining result of the determining unit is negative, performing data security according to the PCI and frequency of the newly added cell, and the user equipment And generating, by the first intermediate key used by the transmission, a second intermediate key; the second generating unit, configured to generate security by using a security algorithm indicated by the security algorithm identifier and a second intermediate key generated by the first generating unit Key.

30. The user equipment according to claim 28 or 29, characterized in that

The transmission unit is further configured to use the security key generated by the generating unit and the first site Secure data transmission.

The user equipment according to claim 28 or 29, characterized in that

The sending unit is further configured to send a second measurement report message to the first station;

The receiving unit is further configured to receive a handover command message sent by the first station, where the handover command message includes a PCI and a frequency of the first target cell, a PCI and a frequency of the second target cell, and the first target cell. PCI and frequency associated first intermediate key and security algorithm identifier of the first target site, second intermediate key associated with PCI and frequency of the second target cell, and the second target a security algorithm identifier of the station, where the first target cell and the second target cell are cells that the first station decides to switch the user equipment to based on the second measurement report message, where a target site and the second target site are sites at which the first site decides to switch the user equipment based on the second measurement report message;

The generating unit is further configured to indicate, according to the indication of the handover command message, based on a PCI and a frequency of the first target cell, the first intermediate key, and a security algorithm identifier of the first target station. The security algorithm generates a first security key, and generates a second security secret based on the PCI and frequency of the second target cell, the second intermediate key, and a security algorithm indicated by the security algorithm identifier of the second target site. Key

The transmission unit is further configured to perform data security transmission with the first target station by using the first security key; and perform data security transmission with the second target site by using the second security key.

32. The user equipment of claim 30, and wherein

The receiving unit is further configured to receive a handover command message sent by the first station, where the handover command message includes a PCI and a frequency of a target cell used by a target station to generate a first security key, and a target cell a first intermediate key and a security algorithm identifier associated with the PCI and the frequency, wherein the target site is a site at which the first station decides to switch the user equipment based on the second measurement report message;

The generating unit is further configured to perform, according to the indication of the handover command message, based on the handover command The PCI and the frequency, the first intermediate key, and the security algorithm indicated by the security algorithm identifier generate a first security key;

The transmission unit is further configured to perform data security transmission with the target site by using the first security key.

33. A network site, comprising:

a sending unit, configured to send a cell addition command message to the UE, where the cell increase command message includes a physical cell identifier PCI and a frequency of the newly added cell, and a security algorithm identifier of the second site to which the newly added cell belongs, So that the UE generates a security key based on the PCI and frequency of the newly added cell and the security algorithm indicated by the security algorithm identifier of the second site, where the newly added cell is based on the first site. The first measurement report message is determined to be a new serving cell of the UE.

The network site according to claim 33, further comprising:

a determining unit, configured to determine whether the count value of the local hop chain counter NCC is overflowed, and a generating unit, configured to: when the determining result of the determining unit is yes, according to the newly added cell

a PCI and a frequency, and a current NH parameter value of the network site, generating a second intermediate key; when the determining result of the determining unit is no, according to the PCI and frequency of the newly added cell, and the current Generating a second intermediate key by using a first intermediate key used for data secure transmission;

The sending unit is further configured to send a cell addition request message to the second station, where the cell increase request message carries a second intermediate key generated by the generating unit;

The receiving unit is further configured to receive a cell addition request acknowledgement message returned by the second station.

35. The network site of claim 34, wherein:

The receiving unit is further configured to receive a security algorithm identifier of the second site sent by the second station;

The generating unit is further configured to generate a new security key based on a security algorithm indicated by the security algorithm identifier of the second site, and the second intermediate key, so as to utilize the new security key and the security key The UE performs data security transmission.

36. A network station according to claim 34 or 35, characterized in that

The receiving unit is further configured to receive a second measurement report message sent by the UE.

The sending unit is further configured to send a handover indication message to the second station, where the handover indication message carries a PCI and a frequency of the second target cell, so that the second site is based on the PCI of the second target cell. The frequency generates a fourth intermediate key, where the second target cell is a cell that the network station decides to switch the UE to based on the second measurement report message;

The receiving unit is further configured to receive a handover indication feedback message sent by the second station, where the handover indication feedback message carries a fourth intermediate density generated by the second station based on a PCI and a frequency of the second target cell. Key

The generating unit is further configured to generate a third intermediate key based on a PCI and a frequency of the first target cell, where the first target cell is that the network station decides to switch the UE according to the second measurement report message To the community;

The sending unit is further configured to send the third intermediate key and the fourth intermediate key to the first target site and the second target site, respectively, so that the first target site is according to the third intermediate key and The security algorithm used by the first target site generates a first security key, and the second target site generates a second security key according to the fourth intermediate key and a security algorithm used by the second target site, where The first target station and the second target station are stations that the network station decides to switch the UE to based on the second measurement report message;

The network site further includes an obtaining unit, configured to acquire a security algorithm identifier of the first target station and the second target station, including a PCI and a frequency of the first target cell, and a second target cell a PCI and frequency, and a first intermediate key associated with the PCI and frequency of the first target cell and a security algorithm identifier of the first target site, associated with PCI and frequency of the second target cell a second intermediate key and a security algorithm identifier of the second target site, so that the UE cancels according to the handover command An indication of a security algorithm based on the PCI and frequency of the first target cell, the first intermediate key, and the security algorithm identifier of the first target site is generated for use with the first target site a first security key for data secure transmission, a PCI and frequency based on the second target cell, the second intermediate key, and a security algorithm identifier indicated by the second target site's security algorithm identifier are generated for A second security key for secure transmission of data with the second target site.

37. A network station according to claim 34 or 35, characterized in that

The sending unit is further configured to send a handover indication message to the second station, to instruct the second site to feed back a second intermediate key used by the second site for data security transmission;

The receiving unit is further configured to receive a handover indication feedback message sent by the second station, where the handover indication feedback message includes the second intermediate key;

The generating unit is further configured to generate a third intermediate key based on a PCI and a frequency of the first target cell, and a first intermediate key, based on a PCI and a frequency of the second target cell, and the second intermediate key generation a fourth intermediate key, where the first target cell and the second target cell are cells that the first station decides to switch the UE to based on the second measurement report message;

The sending unit is further configured to send the third intermediate key and the fourth intermediate key to the first target site and the second target site, respectively, so that the first target site is according to the third intermediate key and The security algorithm used by the first target site generates a first security key, and the second target site generates a second security key according to the fourth intermediate key and a security algorithm used by the second target site, where The first target station and the second target station are stations that the first station decides to switch the UE to based on the measurement report message;

The network site further includes an obtaining unit, configured to acquire a security algorithm identifier of the first target station and the second target station, including a PCI and a frequency of the first target cell, and a second target cell PCI and frequency, and the first intermediate key and the first target associated with PCI and frequency of the first target cell a security algorithm identifier of the station, the second intermediate key associated with the PCI and frequency of the second target cell, and a security algorithm identifier of the second target site, to facilitate the UE to switch according to the An indication of a command message, based on a PCI and frequency of the first target cell, the first intermediate key, and a security algorithm indicated by a security algorithm identifier of the first target site, generated for use with the first target a first security key for data secure transmission by the station, a PCI and frequency based on the second target cell, the second intermediate key, and a security algorithm identifier indicated by the security algorithm identifier of the second target site And a second security key for data security transmission with the second target site.

38. The network site of claim 35, wherein

The generating unit is further configured to generate a third intermediate key based on the PCI and the frequency of the target cell, where the target cell determines, according to the second measurement message, that the network station switches the UE to Community

The sending unit is further configured to send a handover request message to the target station, where the handover request message carries the third intermediate key, so that the target station generates a first security key based on the third intermediate key, The target site is a site that the network site decides to switch the UE to based on the second measurement report message;

The receiving unit is further configured to receive a handover request acknowledgement message returned by the target station, where the handover request acknowledgement message carries a PCI of a target cell that is used by the target site to generate the first security key. a frequency, and a security algorithm identifier of the used security algorithm; a PCI and a frequency of the target cell determined by the target station for generating the first security key, and a number associated with the PCI and frequency of the target cell An intermediate key and a security algorithm identifier, so that the UE is based on the indication of the handover command message, based on the PCI and frequency of the target cell, the first intermediate key, and the security algorithm identifier indication The algorithm generates a first security key for secure transmission of data with the target site.

39. A user equipment, comprising: a sending unit, configured to send a first measurement report message to the first station, where the first site is a current serving site of the user equipment;

a receiving unit, configured to receive a cell addition command message returned by the first station, where the cell increase command message includes a physical cell identifier PCI and a frequency of the newly added cell, where the newly added cell is based on the first site The first measurement report message is determined to be a service cell added by the user equipment;

a generating unit, configured to generate a security key based on a PCI and a frequency of the newly added cell, and a security algorithm used by the first site;

40. The user equipment of claim 39, wherein

The generating unit includes:

a judging unit, configured to determine whether the count value of the locally maintained down link counter NCC overflows; the first generating unit, configured to: when the judgment result of the judging unit is yes, according to the PCI and the frequency of the newly added cell, And generating, by the user equipment, a current intermediate hop NH parameter value, generating a second intermediate key; when the determining result of the determining unit is negative, determining the PCI and frequency of the newly added cell, and the user equipment Generating a second intermediate key by using a first intermediate key used for data security transmission;

And a second generating unit, configured to generate a security key by using a security algorithm used by the first site, and a second intermediate key generated by the generating unit.

41. The user equipment according to claim 39 or 40, wherein

The transmission unit is further configured to perform data security transmission with the first station by using a security key generated by the generating unit.

42. A network site, comprising:

a sending unit, configured to send a cell addition command message to the UE, where the cell adds a command cancellation The information includes the physical cell identifier PCI and the frequency of the newly added cell, so that the UE generates a security key based on the PCI and the frequency of the newly added cell, and a security algorithm used by the network site, where the new cell is generated. And determining, by the first station, a serving cell added to the UE according to the first measurement report message.

The network node according to claim 42, further comprising:

a judging unit, configured to determine whether the count value of the locally maintained lower hop chain counter NCC overflows; generating unit, when the judgment result of the judging unit is yes, according to the PCI and frequency of the newly added cell, and the network a current intermediate parameter of the site, generating a second intermediate key; when the determining result of the determining unit is no, according to the PCI and frequency of the newly added cell, and the first use of the data security transmission currently performed by the UE The intermediate key generates a second intermediate key;

The sending unit is further configured to send a cell addition request message to the second station to which the new cell belongs, where the cell increase request message carries the second intermediate key generated by the generating unit;

The receiving unit is further configured to receive a cell increase request acknowledgement message returned by the second station.

44. The network site of claim 43 wherein:

The generating unit is further configured to generate a new security key based on the security algorithm used by the network site, and the second intermediate key, to perform data secure transmission with the UE by using the new security key.

+