WO2016101617A1

WO2016101617A1 - Security information processing method in switching procedure, access gateway, and base station

Info

Publication number: WO2016101617A1
Application number: PCT/CN2015/085363
Authority: WO
Inventors: 高音; 和峰
Original assignee: 中兴通讯股份有限公司
Priority date: 2014-12-26
Filing date: 2015-07-28
Publication date: 2016-06-30
Also published as: CN105792189A

Abstract

Disclosed are a security information processing method in a switching procedure, an access gateway, and a base station. The method comprises: receiving a first request message, and determining, according to a result obtained by parsing the first request message, whether current switching is cross-base station switching in a same gateway; and when it is determined that the current switching is cross-base station switching in a same gateway, sending a first response message, in the first response message, security text information of user equipment (UE) is not delivered or an information element being set, so as to enable a target base station at a peer end to ignore the security text information of the UE or deliver reset security text information of the UE.

Description

Method for processing safety information in switching process, access gateway and base station

Technical field

The present invention relates to a handover technology, and in particular, to a method, a access gateway, and a base station for processing security information in a handover process under an access gateway.

Background technique

In the process of implementing the technical solutions of the embodiments of the present application, at least the following technical problems exist in the related technologies:

With the continuous evolution of wireless communication technologies and standards, mobile packet services have been greatly developed, and the data throughput capability of single terminals is constantly improving. Taking the Long Term Evolution (LTE) system as an example, data transmission with a maximum downlink rate of 100 Mbps can be supported in a 20 M bandwidth. In subsequent enhanced advanced long-term evolution (LTE, LTE Advanced) networks, the data transmission rate will be further advanced. Upgrade, even up to 1Gbps.

According to the design of the user plane data protocol stack of the existing LTE, the downlink data received by the evolved base station (eNB, Evolved Node B) from the core network via the GPRS Tunneling Protocol for the User Plane (GTP-U), After unpacking, the Packet Data Convergence Protocol (PDCP) sublayer, the Radio Link Control (RLC) protocol sublayer, and the Medium Access Control (MAC) sublayer and The physical layer (PHY) process is sent to the user equipment (UE, User Equipment); the processing of the uplink data is the same as the downlink data processing, except that the transmission direction is reversed.

In order to meet the growing demand for data traffic and the geographically uneven nature of services, operators are also adding low-power nodes (LPN, Low Power Node) or small in the process of deploying next-generation communication networks, such as LTE. A cell (Small Cell) or a micro base station (Pico eNB) is used for hotspot enhancement. As the number of LPN cells increases, the network deployment environment becomes more complicated. It also brought some problems. First, because the number of LPN cells is relatively large, when a UE or a terminal moves within the network, frequent inter-cell handovers may occur, resulting in frequent data service terminals and even dropped calls, which may also result in The user's data throughput and user experience are declining. At the same time, such frequent handovers may also cause the terminal and the network, especially the core network, to receive a large amount of signaling impact, which may cause system resources to be congested or even paralyzed. In addition, the LPN base stations are all connected to the core network (ie, the S1 interface), and the number of interfaces that the core network needs to process is increasing. In some scenarios, such as paging (Paging) or other broadcast services, the core network needs to send data on all relevant interfaces, which also poses great challenges to the processing power of the core network. This situation will become more and more serious with the increase in the number of LPN cells deployed by operators and individuals in the future. Therefore, a solution is needed to alleviate or solve the above problems. One of the access anchor architecture schemes can effectively solve the above problems. As shown in FIG. 2, on the control plane, a mobility anchor (MA) acts as an interface proxy between the base station eNB and the mobility management entity (MME) of the core network, and shields the core network from the existence of the eNB, namely: From the perspective of the base station, the access gateway is equivalent to the MME; from the perspective of the MME, the access gateway is equivalent to the ordinary base station. On the user side, the MA acts as the gateway of the access network, and carries data transmission between the serving gateway (S-GW) and the base station. From the perspective of the base station, the MA is equivalent to the S-GW; from the perspective of the S-GW, the MA is equivalent to Ordinary base station.

After the access anchor (or the access gateway) is introduced, when the UE performs the X2 handover under the same access gateway, the path switching request procedure may be terminated at the access gateway to reduce the handover signaling pair. The impact of the core network. However, in the existing handover procedure, when the X2 handover or the intra-base station handover, the source side sends the current key KeNB and NCC information to the target side, and the target side calculates the current handover usage key according to the security information. In the S1 handover process, the core network carries the UE security text information {NCC, NH} to the target base station in the S1 handover request message, and the target base station calculates the current handover usage key according to the foregoing security information. In the X2 handover process, the path switch request response message carries the UE security text information {NCC, NH} for the next X2. Key generation for handover or internal handover of the base station. When the access gateway terminates the path switching request process in the X2 handover, how to handle the security information is a problem to be solved.

Summary of the invention

In view of this, the embodiment of the present invention is to provide a method for processing security information in a handover procedure, an access gateway, and a base station, and at least implements a scheme for processing security information in a scenario of a path switching request in an X2 handover.

The technical solution of the embodiment of the present invention is implemented as follows:

A method for processing security information in a handover process according to an embodiment of the present invention, where the method includes:

Receiving a first request message, and determining, according to a result obtained by parsing the first request message, whether the current handover is a handover of a base station under the same gateway;

When it is determined that the current handover is a handover between the same gateway and the base station, the first response message is sent;

The user equipment UE security text information or the setting cell is not sent in the first response message, so that the target base station of the opposite end ignores the UE security text information or delivers the reset UE security text information.

In the above solution, the first request message is a path switch request message;

The first response message is a path switch request response message, and the UE security text information is not sent in the path switch request response message.

The first response message is a path switch request response message, and the UE security text information is set to a specified value in the path switch request response message, where the specified value is used to cause the target base station of the opposite end to ignore the UE security text. information.

The first response message is a path switch request response message, and the indication message is newly added in the path switch request response message, and the UE security text information is arbitrarily written, and the indication cell is used to ignore the target base station of the opposite end. The UE security text information.

In the above solution, the first request message is a bearer modification indication message;

The first response message is a bearer modification confirmation message, and the bearer modification confirmation message does not include the self-attribute of the UE security text information, and the UE security text information is not sent in the bearer modification confirmation message;

The bearer modification confirmation message is a message in the existing handover or a new message.

The first response message is a path switch request response message, and the reset UE security text information is encapsulated in the path switch request response message, where the reset UE security text information is used for next handover or internal base station Switched key generation.

Sending a first request message;

Receiving the first response message, parsing the first response message, and obtaining a UE that does not include the user equipment UE security text information or parsing the set in the first response message to ignore the UE security text information or parse the reset UE Secure text information;

It is determined that the current handover is a handover between the base station and the base station, and the processing corresponding to the analysis result is performed.

The first response message is a path switch request response message, and the path switch request response message is parsed to obtain that the UE security text information is not sent in the path switch request response message, and the current switch is determined to be the same The handover of the gateway under the gateway and the processing corresponding to the parsing result are:

It is determined that the current handover is a handover between the base station and the base station, and the current process is ended.

The first response message is a path switch request response message, and the path switch request response message is parsed, and the UE security text information is obtained in the path switch request response message. If the value is determined, the process of determining that the current handover is the same gateway cross-base station handover and executing the corresponding analysis result is:

It is determined that the current handover is the handover of the base station under the same gateway, and the UE security text information is ignored according to the specified value, and the current process is ended.

The first response message is a path switch request response message, and the path switch request response message is parsed to obtain that a new indication cell exists in the path switch request response message, and the current switch is determined to be the same gateway. The process of switching across base stations and performing the corresponding parsing result is:

Determining that the current handover is a handover of the same gateway under the same base station, and omitting the UE security text information according to the newly added indication cell, and ending the current process.

The first response message is a bearer modification confirmation message, and the bearer modification confirmation message is parsed, so that the UE security text information is not sent in the bearer modification confirmation message, and the current handover is determined to be the same gateway downlink. The handover of the base station and the processing corresponding to the parsing result are:

The first response message is a path switch request response message, and the path switch request response message is parsed, and the path switch request response message includes the key used for key generation for next handover or base station internal handover. If the UE security text information is reset, the process of determining that the current handover is the same gateway cross-base station handover and performing the corresponding analysis result is:

It is determined that the current handover is the handover of the base station under the same gateway, and the reset UE security text information is used for key generation of the next handover or internal handover of the base station, and the current procedure is ended.

An access gateway according to an embodiment of the present invention, where the access gateway includes:

The first receiving unit is configured to receive the first request message, and determine, according to the result obtained by parsing the first request message, whether the current handover is a handover of the same gateway under the base station;

The determining and sending unit, configured to determine that the current handover is the handover of the same gateway, the first response message, where the user equipment UE security text information is not sent or the set cell is set to be the peer end The target base station ignores the UE security text information or delivers the reset UE security text information.

The determining and sending unit is further configured to: the first response message is a path switch request response message, and the UE security text information is not sent in the path switch request response message.

The determining and transmitting unit is further configured to: the first response message is a path switch request response message, and the path switch request response is sent after the UE security text information is set to a specified value in the path switch request response message. The message, the specified value is used to cause the target base station of the opposite end to ignore the UE security text information.

The determining and transmitting unit is further configured to: the first response message is a path switch request response message, add an indication cell in the path switch request response message, and arbitrarily write the UE security text information, and then send the A path switch request response message, where the indication cell is used to cause the target base station of the opposite end to ignore the UE security text information.

The determining and sending unit is further configured to: the first response message is a bearer modification confirmation message, and the bearer modification confirmation message does not include the self-attribute of the UE security text information, and is not included in the bearer modification confirmation message. Sending the UE security text information;

The determining and sending unit is further configured to: the first response message is a path switch request response message, and the path switch request response is sent after the reset UE security text information is encapsulated in the path switch request response message The message, the reset UE security text information is used for key generation of the next handover or internal handover of the base station.

The first receiving unit, the determining and transmitting unit may use a central processing unit (CPU), a digital signal processor (DSP, Digital Singnal Processor) or a programmable logic array (FPGA) when performing processing. Field-Programmable Gate Array) implementation.

A base station, where the base station is a target base station, includes:

a first sending unit, configured to send a first request message;

The processing unit is configured to receive the first response message, parse the first response message, and obtain a cell that does not include the user equipment UE security text information or parse the first response message to ignore the UE security text information. The result of the analysis or the parsed UE security text information is parsed, and it is determined that the current handover is the handover of the same gateway under the base station and the processing corresponding to the analysis result is executed.

The processing unit is further configured to: the first response message is a path switch request response message, and the path switch request response message is parsed, so that the UE security text information is not sent in the path switch request response message, and the current Switch to the switchover between the base stations and the base station to end the current process.

The processing unit is further configured to: the first response message is a path switch request response message, parse the path switch request response message, and obtain, in the path switch request response message, the UE security text information is a specified value, and determine Currently switching to the handover of the base station under the same gateway, The UE security text information is ignored according to the specified value, and the current flow is ended.

The processing unit is further configured to: the first response message is a path switch request response message, parse the path switch request response message, and obtain a new indication cell in the path switch request response message, and determine that the current switch is The handover between the same gateway and the base station ignores the UE security text information according to the newly added indicator cell, and ends the current process.

The processing unit is further configured to: the first response message is a bearer modification confirmation message, and the bearer modification confirmation message is parsed, so that the UE security text information is not sent in the bearer modification confirmation message, and the current handover is determined to be the same The handover between the gateways and the base station ends the current process.

The first response message is a path switch request response message, and the path switch request response message is parsed, and the path switch request response message includes the key used for key generation for next handover or base station internal handover. The reset UE security text information determines that the current handover is the handover of the same gateway under the base station, and the reset UE security text information is used for the next handover or key handover of the base station internal handover, and the current flow is ended.

The first sending unit and the processing unit may use a central processing unit (CPU), a digital signal processor (DSP), or a programmable logic array (FPGA, Field-) when performing processing. Programmable Gate Array) implementation.

The method for processing the security information in the handover process of the access gateway in the embodiment of the present invention includes: receiving the first request message, determining, according to the result obtained by parsing the first request message, whether the current handover is a handover of the same gateway under the base station; The first response message is sent when the current handover is the same as the cross-base station of the same gateway; the user equipment UE security text information is not sent in the first response message, or the set cell is configured to make the target base station of the opposite end ignore the UE security text. Information or delivery Reset UE security text information.

The user equipment UE security text information is not sent in the first response message or the setting cell is configured to cause the peer target base station to ignore the UE security text information, so that the path switching request procedure can be terminated at the access gateway to reduce the handover information. The impact on the core network is achieved, and the security information processing in the scenario of the path switching request process in the X2 handover is terminated by the access gateway.

DRAWINGS

1 is a schematic structural diagram of an access gateway system in the prior art;

2 is a schematic diagram of an implementation process of an embodiment of a method according to the present invention;

3 is a schematic diagram of a security information processing flow of an application scenario 1 in which an embodiment of the present invention is applied;

4 is a schematic diagram of a security information processing flow of application scenario 2 in which an embodiment of the present invention is applied;

FIG. 5 is a schematic diagram of a security information processing flow of an application scenario 3 in which an embodiment of the present invention is applied;

6 is a schematic flowchart of a security information processing process of an application scenario 4 in which an embodiment of the present invention is applied;

7 is a schematic diagram of a security information processing flow of an application scenario 5 in which an embodiment of the present invention is applied;

FIG. 8 is a schematic structural diagram of an embodiment of an access gateway according to the present invention.

detailed description

The implementation of the technical solution will be further described in detail below with reference to the accompanying drawings.

A method for processing security information in a handover process of an access gateway according to an embodiment of the present invention specifically relates to an access gateway architecture and a function implementation method in a mobile communication system, which is a long-term evolution system in which an access network is introduced under an anchor point. The processing scheme for switching security information in the process.

A method for processing security information in a handover process of an access gateway in an embodiment of the present invention is as shown in FIG. 2, where the method includes:

Step 101: Receive a first request message.

Step 102: When it is determined that the current handover is a handover of the same gateway under the base station, the first response message is sent.

Here, determining, according to the result obtained by parsing the first request message, whether the current handover is a handover of the same gateway under the base station;

Step 103: The user equipment UE security text information or the setting cell is not sent in the first response message, so that the target base station of the opposite end ignores the UE security text information or delivers the reset UE security text information.

In an embodiment of the present invention, the first request message is a path switch request message; correspondingly, the first response message is a path switch request response message, and is not sent in the path switch request response message. The UE security text information.

In an embodiment of the present invention, the first request message is a path switch request message; correspondingly, the first response message is a path switch request response message, and the path is set in the path switch request response message. The UE security text information is a specified value, and the specified value is used to cause the target base station of the opposite end to ignore the UE security text information.

In an embodiment of the present invention, the first request message is a path switch request message; correspondingly, the first response message is a path switch request response message, and an indication cell is added in the path switch request response message. And writing the UE security text information arbitrarily, the indication information element is used to cause the target base station of the opposite end to ignore the UE security text information.

In an embodiment of the present invention, the first request message is a bearer modification indication message; correspondingly, the first response message is a bearer modification acknowledgement message, and the bearer modification acknowledgement message does not include the UE security. The UE security text information is not sent in the bearer modification confirmation message; the bearer modification confirmation message is an existing handover message or a new message.

In an embodiment of the present invention, the first request message is a path switch request message; correspondingly, the first response message is a path switch request response message, and the path is encapsulated in the path switch request response message. The reset UE security text information is used for key handover of the next handover or base station internal handover.

A method for processing security information in a handover process of an access gateway according to an embodiment of the present invention, where the method includes:

Step 201: Send a first request message.

Step 202: Receive a first response message, parse the first response message, and obtain a cell that does not include the user equipment UE security text information or parsing the first response message to ignore the UE security text information or parse the re Set the UE security text information.

Step 203: Determine that the current handover is a handover of the same gateway under the base station and perform processing corresponding to the analysis result.

In an embodiment of the present invention, the first request message is a path switch request message; correspondingly, the first response message is a path switch request response message, and the path switch request response message is parsed to obtain If the UE security text information is not sent in the path switch request response message, the process of determining that the current handover is the same gateway cross-base station handover and performing the analysis result is: determining that the current handover is the same gateway. Switching across base stations ends the current process.

In an embodiment of the present invention, the first request message is a path switch request message; correspondingly, the first response message is a path switch request response message, and the path switch request response message is parsed to obtain If the UE security text information in the path switch request response message is a specified value, the process of determining that the current handover is the same gateway cross-base station handover and executing the analysis result is: determining that the current handover is the same gateway. The handover of the base station is performed, and the UE security text information is ignored according to the specified value, and the current process is ended.

In an embodiment of the present invention, the first request message is a path switch request message; correspondingly, the first response message is a path switch request response message, and the path switch request response message is parsed to obtain If there is a new indication cell in the path switch request response message, the process of determining that the current handover is the same gateway cross-base station handover and performing the analysis result is: determining that the current handover is the same gateway downlink base station Switching according to the The new indicator cell ignores the UE security text information and ends the current process.

In an embodiment of the present invention, the first request message is a bearer modification indication message; correspondingly, the first response message is a bearer modification confirmation message, and the bearer modification confirmation message is parsed, and the bearer is obtained in the bearer. If the UE security text information is not sent in the modification confirmation message, the process of determining that the current handover is the same gateway cross-base station handover and performing the analysis result is: determining that the current handover is the same gateway cross-base station Switch to end the current process.

In an embodiment of the present invention, the first request message is a path switch request message; correspondingly, the first response message is a path switch request response message, and the path switch request response message is parsed to obtain the The path switch request response message includes the reset UE security text information used for key generation of the next handover or the base station internal handover, and the determining that the current handover is the handover of the same gateway and the execution of the cross-base station The processing corresponding to the analysis result is: determining that the current handover is the same gateway cross-base station handover, and the reset UE security text information is used for next handover or key handover of the base station internal handover, and the current procedure is ended.

The embodiment of the present invention interacts between the access gateway and the target base station, and is applicable to the cross-base station X2 handover of the UE under the same gateway, and at least the following five specific implementation schemes.

Option One:

The target base station sends a path switch request message to the access gateway, and the access gateway determines that the current switch is the same gateway cross-base station X2 handover, and the UE security text information is not sent in the path switch request response message.

Option II:

The target base station sends a path switch request message to the access gateway, and the access gateway determines that the current switch is the same gateway cross-base station X2 handover, and sets the UE security text information to a special value, such as NULL, in the path switch request response message. When the target base station receives the path switch request response message sent by the access gateway, if the target cell is determined to be a specified special value, it is determined that the current switch is the same. The gateway switches across the base station X2, and the cell information is ignored.

third solution:

The target base station sends a path switch request message to the access gateway, and the access gateway determines that the current switch is the same gateway cross-base station X2 handover, then adds an indication cell in the path switch request response message, and arbitrarily fills in the UE security text information. When the target base station receives the path switch request response message sent by the access gateway, the UE secure text information is ignored according to the indication cell content.

Option 4:

The target base station determines that the current handover is the same gateway cross-base station X2 handover, and sends a bearer modification indication message to the access gateway, where the message includes the S1 interface connection identifier information, the Source MME UE S1AP ID, and/or the MME allocated to the UE. S1 interface connection flag information assigned by the gateway to the UE, source MA UE S1AP ID. And the service bearer information that needs to be modified. The access gateway sends a bearer modification confirmation message, where the message includes the information of the service bearer that is successfully modified and the service bearer information that fails to be modified. And the S1 interface connection flag information that is allocated by the MME to the UE, and/or the S1 interface connection flag information that the access gateway allocates to the UE. Does not contain UE security text information.

The bearer modification indication/confirmation message may use an existing S1AP message or a new message.

Option 5:

The target base station sends a path switch request message to the access gateway, and the access gateway determines that the current switch is the same gateway cross-base station X2 handover, and then resets the UE security text information in the path switch request response message, for example, calculates a new {NCC, NH }. When the target base station receives the path switch request response message sent by the access gateway, the target cell is parsed and used for key generation of the next X2 handover or base station internal handover.

With the foregoing embodiment and its specific implementation, the X2 handover procedure under the same access gateway can be terminated on the access gateway, and the impact on the core network due to frequent handover of the user equipment between the cells is avoided. At the same time, the processing of the security information of the handover process is realized, and the processing load of the core network is alleviated.

The various application scenarios of the embodiments of the present invention are specifically described below.

The architecture of the access gateway in the following application scenarios includes: the access gateway acts as an interface proxy between the base station and the core network, respectively connects the base station and the core network, and shields the impact of the access network on the core network; The screening is performed to ensure that the UE is used as an access anchor of the user equipment in the access network, as shown in FIG. 1 . The access gateway is used as an access anchor of the user equipment in the access network. When the user equipment moves between cells served by the access gateway, the access gateway remains unchanged. When the UE performs X2 handover across the base station under the access gateway, the X2 handover procedure may terminate at the access gateway, the source SeNB is an instance of the source base station, the target SeNB is an instance of the target base station, and the access anchor MA is connected. An instance of the gateway.

Application scenario 1:

As shown in FIG. 3, in the embodiment of the present invention, the specific implementation steps in the application scenario 1 include:

Step 301: After the X2 handover preparation, the air interface reconfiguration, and the ground data forwarding are completed, the target base station sends a path switch request message to the access gateway.

Step 302: The access gateway determines that the current handover is the same gateway, and the UE security text information is not sent in the path switch request response message sent by the target base station.

Application scenario 2:

As shown in Figure 4, in the embodiment of the present invention, the specific implementation steps in the application scenario 2 include:

Step 401: After the X2 handover preparation, the air interface reconfiguration, and the ground data forwarding are completed, the target base station sends a path switch request message to the access gateway.

Step 402: The access gateway determines that the current handover is the same gateway cross-base station X2 handover, and sets the UE security text information to a special value, such as NULL, in the path switch request response message sent to the target base station.

Step 403: When the target base station receives the path switch request response message sent by the access gateway, if the cell is determined to be a specified special value, it is determined that the current switch is the same gateway. Change, the cell information is ignored.

Application scenario three:

As shown in Figure 5, in the embodiment of the present invention, the specific implementation steps in the application scenario 3 include:

Step 501: After the X2 handover preparation, the air interface reconfiguration, and the ground data forwarding are completed, the target base station sends a path switch request message to the access gateway.

Step 502: The access gateway determines that the current handover is the same gateway cross-base station X2 handover, and adds a security information ignore indication cell in the path switch request response message, for example, the presence of the cell indicates that the UE security text information needs to be ignored, or The cell is set to TRUE, indicating that the UE security text information needs to be ignored; or the handover type indication cell is added, for example, indicating that the current handover is a handover under the same access gateway; and the UE security text information is arbitrarily filled.

Step 503: When the target base station receives the path switch request response message sent by the access gateway, the secure text information of the UE is ignored according to the newly added indication cell.

Application scenario four:

As shown in Figure 6, in the embodiment of the present invention, the specific implementation steps in the application scenario 4 include:

Step 601: After the X2 handover preparation, the air interface reconfiguration, and the ground data forwarding are completed, the target base station determines that the current handover is the same gateway cross-base station X2 handover, and sends a bearer modification indication message to the access gateway, where the message includes the MME to allocate to the UE. The S1 interface connection flag information, the Source MME UE S1AP ID, and/or the S1 interface connection flag information allocated by the access gateway to the UE, the source MA UE S1AP ID. And service bearer information that needs to be modified;

Step 602: The access gateway sends a bearer modification confirmation message, where the message includes the information of the service bearer that is successfully modified and the service bearer information that fails to be modified. And the S1 interface connection flag information that is allocated by the MME to the UE, and/or the S1 interface connection flag information that the access gateway allocates to the UE. Does not contain UE security text information.

Application scenario five:

As shown in Figure 7, the specific implementation steps in the application scenario 5 include:

Step 701: After the X2 handover preparation, the air interface reconfiguration, and the ground data forwarding are completed, the target base station sends a path switch request message to the access gateway.

Step 702: The access gateway determines that the current handover is the same gateway cross-base station X2 handover, and then resets the UE security text information in the path switch request response message, for example, calculates a new {NCC, NH}. When the target base station receives the path switch request response message sent by the access gateway, the target cell is parsed and used for key generation of the next X2 handover or base station internal handover.

As shown in FIG. 8, the access gateway of the embodiment of the present invention includes:

The first receiving unit 11 is configured to receive the first request message, and determine, according to the result obtained by parsing the first request message, whether the current handover is a handover of the same gateway under the base station;

The determining and transmitting unit 12 is configured to send a first response message when the current handover is the same as the handover of the same gateway, and the user response message is not sent in the first response message. The target base station of the terminal ignores the UE security text information or delivers the reset UE security text information.

In an embodiment of the present invention, the first request message is a path switch request message;

The determining and transmitting unit is further configured to: the first response message is a path switching request In response to the message, the indication cell is newly added in the path switch request response message, and the path switch request response message is sent after the security text information is arbitrarily written, and the indication cell is used to make the target base station of the opposite end ignore the The UE security text information.

In an embodiment of the present invention, the first request message is a bearer modification indication message;

In the base station of the embodiment of the present invention, the base station is a target base station, and includes:

a first sending unit, configured to send a first request message;

The processing unit is configured to receive the first response message, parse the first response message, and obtain a cell that does not include the user equipment UE security text information or parse the first response message to ignore the UE security text information. The analysis result or the reconfigured UE security text information is analyzed, and it is determined that the current handover is the handover of the same gateway under the base station and the processing corresponding to the analysis result is executed.

The processing unit is further configured to: the first response message is a path switch request response message, parse the path switch request response message, and obtain, in the path switch request response message, the UE security text information is a specified value, and determine Currently, switching to the handover of the base station under the same gateway, omitting the UE security text information according to the specified value, and ending the current process.

Here, the English-Chinese comparison of the English in the drawings of the specification is as follows:

Mobility anchor A: Mobility anchor A;

Mobility anchor B: Mobility anchor B;

Macro eNB: Enhanced Macro Base Station

MME: mobile management entity;

S-GW: Service Gateway

SeNB1: a base station 1 under the mobility anchor;

SeNB2: a base station 2 under the mobility anchor point;

SeNB3: a base station 3 under the mobility anchor;

UE: User equipment.

The integrated modules described in the embodiments of the present invention may also be stored in a computer readable storage medium if they are implemented in the form of software functional modules and sold or used as separate products. Based on such understanding, the technical solution of the embodiments of the present invention may be embodied in the form of a software product in essence or in the form of a software product stored in a storage medium, including a plurality of instructions. A computer device (which may be a personal computer, server, or network device, etc.) is caused to perform all or part of the methods described in various embodiments of the present invention. The foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, and the like. . Thus, embodiments of the invention are not limited to any specific combination of hardware and software.

Correspondingly, the embodiment of the present invention further provides a computer storage medium, wherein the computer program is used to execute a method for processing security information in a handover process under the access gateway according to the embodiment of the present invention.

The above is only the preferred embodiment of the present invention and is not intended to limit the scope of the present invention.

Industrial applicability

The method for processing the security information in the handover process of the access gateway in the embodiment of the present invention includes: receiving the first request message, determining, according to the result obtained by parsing the first request message, whether the current handover is a handover of the same gateway under the base station; The first response message is sent when the current handover to the handover of the same gateway is performed, and the user equipment UE security text is not sent in the first response message. The information or setting cell is such that the target base station of the opposite end ignores the UE security text information or delivers the reset UE security text information. The user equipment UE security text information is not sent in the first response message or the setting cell is configured to cause the peer target base station to ignore the UE security text information, so that the path switching request procedure can be terminated at the access gateway to reduce the handover information. The impact on the core network is achieved, and the security information processing in the scenario of the path switching request process in the X2 handover is terminated by the access gateway.

Claims

A method for processing security information in a handover process, the method comprising:

Receiving a first request message, and determining, according to a result obtained by parsing the first request message, whether the current handover is a handover of a base station under the same gateway;

When it is determined that the current handover is a handover between the same gateway and the base station, the first response message is sent;

The user equipment UE security text information or the setting cell is not sent in the first response message, so that the target base station of the opposite end ignores the UE security text information or delivers the reset UE security text information.
The method of claim 1, wherein the first request message is a path switch request message;

The first response message is a path switch request response message, and the UE security text information is not sent in the path switch request response message.
The method of claim 1, wherein the first request message is a path switch request message;

The first response message is a path switch request response message, and the UE security text information is set to a specified value in the path switch request response message, where the specified value is used to cause the target base station of the opposite end to ignore the UE security text. information.
The method of claim 1, wherein the first request message is a path switch request message;

The first response message is a path switch request response message, and the indication message is newly added in the path switch request response message, and the UE security text information is arbitrarily written, and the indication cell is used to ignore the target base station of the opposite end. The UE security text information.
The method of claim 1, wherein the first request message is a bearer modification indication message;

The first response message is a bearer modification acknowledgement message, and the acknowledgement message is modified by using the bearer. The UE security text information is not sent in the bearer modification confirmation message, and the UE security text information is not included in the bearer modification confirmation message;

The bearer modification confirmation message is a message in the existing handover or a new message.
The method of claim 1, wherein the first request message is a path switch request message;

The first response message is a path switch request response message, and the reset UE security text information is encapsulated in the path switch request response message, where the reset UE security text information is used for next handover or internal base station Switched key generation.
A method for processing security information in a handover process, the method comprising:

Sending a first request message;

Receiving the first response message, parsing the first response message, and obtaining a UE that does not include the user equipment UE security text information or parsing the set in the first response message to ignore the UE security text information or parse the reset UE Secure text information;

It is determined that the current handover is a handover between the base station and the base station, and the processing corresponding to the analysis result is performed.
The method of claim 7, wherein the first request message is a path switch request message;

The first response message is a path switch request response message, and the path switch request response message is parsed to obtain that the UE security text information is not sent in the path switch request response message, and the current switch is determined to be the same The handover of the gateway under the gateway and the processing corresponding to the parsing result are:

It is determined that the current handover is a handover between the base station and the base station, and the current process is ended.
The method of claim 7, wherein the first request message is a path switch request message;

The first response message is a path switch request response message, and the path switch request is parsed And in response to the message, if the UE security text information is a specified value in the path switch request response message, the process of determining that the current handover is the same gateway cross-base station handover and performing the parsing result is:

It is determined that the current handover is the handover of the base station under the same gateway, and the UE security text information is ignored according to the specified value, and the current process is ended.
The method of claim 7, wherein the first request message is a path switch request message;

The first response message is a path switch request response message, and the path switch request response message is parsed to obtain that a new indication cell exists in the path switch request response message, and the current switch is determined to be the same gateway. The process of switching across base stations and performing the corresponding parsing result is:

Determining that the current handover is a handover of the same gateway under the same base station, and omitting the UE security text information according to the newly added indication cell, and ending the current process.
The method according to claim 7, wherein the first request message is a bearer modification indication message;

The first response message is a bearer modification confirmation message, and the bearer modification confirmation message is parsed, so that the UE security text information is not sent in the bearer modification confirmation message, and the current handover is determined to be the same gateway downlink. The handover of the base station and the processing corresponding to the parsing result are:

It is determined that the current handover is a handover between the base station and the base station, and the current process is ended.
The method of claim 7, wherein the first request message is a path switch request message;

The first response message is a path switch request response message, and the path switch request response message is parsed, and the path switch request response message includes the key used for key generation for next handover or base station internal handover. Reset the UE security text information, then the judgment The process of disconnecting the current handover to the base station under the same gateway and performing the corresponding parsing result is:

It is determined that the current handover is the handover of the base station under the same gateway, and the reset UE security text information is used for key generation of the next handover or internal handover of the base station, and the current procedure is ended.
An access gateway, the access gateway includes:

The first receiving unit is configured to receive the first request message, and determine, according to the result obtained by parsing the first request message, whether the current handover is a handover of the same gateway under the base station;

The determining and sending unit, configured to determine that the current handover is the handover of the same gateway, the first response message, where the user equipment UE security text information is not sent or the set cell is set to be the peer end The target base station ignores the UE security text information or delivers the reset UE security text information.
The access gateway according to claim 13, wherein the first request message is a path switch request message;

The determining and sending unit is further configured to: the first response message is a path switch request response message, and the UE security text information is not sent in the path switch request response message.
The access gateway according to claim 13, wherein the first request message is a path switch request message;

The determining and transmitting unit is further configured to: the first response message is a path switch request response message, and the path switch request response is sent after the UE security text information is set to a specified value in the path switch request response message. The message, the specified value is used to cause the target base station of the opposite end to ignore the UE security text information.
The access gateway according to claim 13, wherein the first request message is a path switch request message;

The determining and sending unit is further configured to: the first response message is a path switch request response message, add an indication cell in the path switch request response message, and arbitrarily write the UE The path switch request response message is sent after the security text information is used, and the indication cell is used to cause the target base station of the opposite end to ignore the UE security text information.
The access gateway according to claim 13, wherein the first request message is a bearer modification indication message;

The determining and sending unit is further configured to: the first response message is a bearer modification confirmation message, and the bearer modification confirmation message does not include the self-attribute of the UE security text information, and is not included in the bearer modification confirmation message. Sending the UE security text information;

The bearer modification confirmation message is a message in the existing handover or a new message.
The access gateway according to claim 13, wherein the first request message is a path switch request message;

The determining and sending unit is further configured to: the first response message is a path switch request response message, and the path switch request response is sent after the reset UE security text information is encapsulated in the path switch request response message The message, the reset UE security text information is used for key generation of the next handover or internal handover of the base station.
A base station, where the base station is a target base station, including:

a first sending unit, configured to send a first request message;

The processing unit is configured to receive the first response message, parse the first response message, and obtain a cell that does not include the user equipment UE security text information or parse the first response message to ignore the UE security text information. The result of the analysis or the parsed UE security text information is parsed, and it is determined that the current handover is the handover of the same gateway under the base station and the processing corresponding to the analysis result is executed.
The base station according to claim 19, wherein the first request message is a path switch request message;

The processing unit is further configured to: the first response message is a path switch request response message, and the path switch request response message is parsed, and is obtained in the path switch request response message. Sending the UE security text information, determining that the current handover is the handover of the same gateway under the base station, and ending the current process.
The base station according to claim 19, wherein the first request message is a path switch request message;

The processing unit is further configured to: the first response message is a path switch request response message, parse the path switch request response message, and obtain, in the path switch request response message, the UE security text information is a specified value, and determine Currently, switching to the handover of the base station under the same gateway, omitting the UE security text information according to the specified value, and ending the current process.
The base station according to claim 19, wherein the first request message is a path switch request message;

The processing unit is further configured to: the first response message is a path switch request response message, parse the path switch request response message, and obtain a new indication cell in the path switch request response message, and determine that the current switch is The handover between the same gateway and the base station ignores the UE security text information according to the newly added indicator cell, and ends the current process.
The base station according to claim 19, wherein the first request message is a bearer modification indication message;

The processing unit is further configured to: the first response message is a bearer modification confirmation message, and the bearer modification confirmation message is parsed, so that the UE security text information is not sent in the bearer modification confirmation message, and the current handover is determined to be the same The handover between the gateways and the base station ends the current process.
The base station according to claim 19, wherein the first request message is a path switch request message;

The first response message is a path switch request response message, and the path switch request response message is parsed, and the path switch request response message includes the key used for key generation for next handover or base station internal handover. Resetting the UE security text information, determining that the current handover is the handover of the same gateway under the base station, and using the reset UE security text information The key is generated for the next handover or internal handover of the base station, and the current flow is ended.