WO2017118269A1

WO2017118269A1 - Method and apparatus for protecting air interface identity

Info

Publication number: WO2017118269A1
Application number: PCT/CN2016/110194
Authority: WO
Inventors: 祝建建; 甘露; 金兹伯格菲利普
Original assignee: 华为技术有限公司
Priority date: 2016-01-06
Filing date: 2016-12-15
Publication date: 2017-07-13
Also published as: CN106954210A; CN106954210B

Abstract

The present invention relates to the technical field of wireless communications. Disclosed are a method and apparatus for protecting an air interface identity, which can resolve the problem of risks in user privacy information and network security caused by leakage of an air interface ID. In an embodiment of the present invention, an upper-layer network control node receives a network access connection request sent by a UE, the network access connection request comprising an identity of the UE; the upper-layer network control node obtains a root key corresponding to the identity of the UE; the upper-layer network control node generates a first air interface ID protection key according to the root key corresponding to the identity of the UE and a first preset parameter; and the upper-layer network control node sends the first air interface ID protection key to a wireless access node, so that the wireless access node encrypts a first air interface ID according to the first air interface ID protection key and sends the encrypted first air interface ID to the UE. The solution provided in embodiments of the present invention is used when an air interface ID is transmitted.

Description

Method and device for protecting air interface identification

The present application claims priority to Chinese Patent Application No. 201610006376.2, entitled "A Method and Apparatus for Protecting Air Interfaces", which is filed on January 06, 2016, the entire contents of which are incorporated herein by reference. In the application.

Technical field

The present invention relates to the field of wireless communication technologies, and in particular, to a method and an apparatus for protecting an air interface identifier.

Background technique

In the existing wireless communication network, the wireless network access point allocates an air interface ID (Identity) to the accessed user equipment, and the wireless network access point can complete the interaction with the user equipment through the air interface ID. data transmission. When the user equipment accesses different wireless network access nodes during the mobile process, the new wireless network access node allocates a new air interface ID to the user equipment, and the new wireless network access node completes according to the new air interface ID. Data transfer with the user device.

However, the wireless network access node sends the air interface ID assigned to the user equipment to the user equipment through the air interface signaling message. If the attacker continuously obtains the air interface ID of the user equipment for a long time, the attacker can obtain the air interface ID based on the air interface ID. The user's mobile track, service characteristics and other information will pose a threat to the user's private information and network security.

Summary of the invention

The embodiments of the present invention provide a method and an apparatus for protecting an air interface identifier, which can solve the problem that the user's private information and the network security are at risk due to the air interface ID leakage.

A first aspect of the present invention provides a method for protecting an air interface identifier, the method comprising:

The upper network control node receives the network connection request sent by the user equipment UE, where the network connection request includes the identifier of the UE;

The upper layer network control node acquires a root key corresponding to the identifier of the UE;

The root network corresponding to the identifier of the UE and the first preset by the upper layer network control node The parameter generates a first air interface identifier ID protection key, where the first preset parameter includes an identifier of the UE, a network device ID, a public land mobile network PLMN ID to which the UE belongs, a security algorithm ID, and a random number. One or any combination, the network device ID is an ID of a cell corresponding to the wireless access point accessed by the UE or an ID of a base station corresponding to the wireless access point accessed by the UE;

The upper network control node sends the first air interface ID protection key to the wireless access node, so that the wireless access node encrypts and transmits the first air interface ID by using the first air interface ID protection key. The first air interface ID is an air interface ID allocated by the wireless access node to the UE.

The present invention generates a first air interface ID protection key for the first air interface ID by using the upper layer network control node, and the wireless access node can pass the first, as compared with the prior art, the air interface ID leakage causes the user's private information and the network security to be at risk. The air interface ID protection key encrypts the first air interface ID, so that the first air interface ID is transmitted in an encrypted form, which avoids the persistent acquisition of the air interface ID by the attacker, and protects the user's private information and network security.

With reference to the first aspect, the method further includes: after the upper layer network control node generates the first air interface ID protection key according to the root key corresponding to the identifier of the UE and the first preset parameter, the method further includes:

The upper layer network control node sends the first air interface ID protection key to the UE.

In combination with the first aspect, optionally, after the upper layer network control node receives the network connection request sent by the UE, the method further includes:

The upper layer network control node sends the first preset parameter to the UE, so that the UE generates the first air interface according to the root key corresponding to the identifier of the UE and the first preset parameter. ID protection key.

On the basis of the first aspect, optionally, when the wireless access node that is accessed by the UE is switched from the original wireless access node to the new wireless access node, the method further includes:

Receiving, by the upper layer network control node, a key request message sent by the new wireless access node, where the key request message includes an identifier of the UE;

Obtaining, by the upper layer network control node, the first air interface ID protection key according to the identifier of the UE;

Sending, by the upper layer network control node, the first air interface ID protection key to the new radio access node, so that the new radio access node performs the second air interface ID by using the first air interface ID protection key. Encrypted transmission, where the second air interface ID is an air interface ID allocated by the new radio access node to the UE.

With reference to the first aspect, optionally, when the wireless access point that the UE accesses is switched from the original wireless access node to the new wireless access node, the method further includes:

The upper network control node generates the second air interface ID protection key according to the first air interface ID protection key and the second preset parameter, where the second preset parameter is the new wireless access point ID, The new wireless access point corresponds to one of the carrier frequency and the second air interface ID of the cell, and the second air interface ID is an air interface ID allocated by the new wireless access node to the UE;

Sending, by the upper layer network control node, the second air interface ID protection key to the new radio access node, so that the new radio access node performs the second air interface ID by using the second air interface ID protection key. Encrypted transmission.

Compared with the prior art, the air interface ID leakage causes the user's private information and the network security to be at risk, the embodiment of the present invention still needs to allocate the second wireless communication node to the UE after the UE switches to the new wireless access node. The air interface ID acquires the first air interface ID protection key or generates a second air interface ID protection key, so that the second air interface ID is encrypted and transmitted through the first air interface ID protection key or the second air interface ID protection key, thereby protecting user privacy and the network. Safety. In addition, the access method of the air interface identifier provided by the embodiment of the present invention can be applied to a scenario in which the UE switches the wireless access node, and is more applicable to the new network architecture, and the air interface ID is allocated by the wireless access node, and is generated by the upper layer network control node. The air interface ID protects the key, so that the transmission air interface ID has better timeliness.

In the solution described in the first aspect, when the UE has a new wireless access node, the method further includes:

Sending, by the upper layer network control node, the first air interface to the newly added wireless access node The ID protects the key, so that the newly added wireless access node performs encrypted transmission on the third air interface ID by using the first air interface ID protection key, where the third air interface ID is The air interface ID assigned by the UE.

Optionally, when the UE has a new wireless access node, the method further includes:

The upper network control node generates the third air interface ID protection key according to the first air interface ID protection key and a third preset parameter, where the third preset parameter includes the newly added wireless access node ID And the new air access node corresponds to one of the carrier frequency and the third air interface ID, and the third air interface ID is allocated by the new wireless access node to the UE. Air interface ID;

Sending, by the upper layer network control node, the third air interface ID protection key to the new wireless access node, so that the newly added wireless access node protects the third air interface by using the third air interface ID The ID is encrypted for transmission.

In the technical solution of the present invention, when there is a newly added wireless access node, the upper layer network control node acquires the first air interface ID protection key, compared with the prior art, the air interface ID leakage causes the user's private information and the network security to be at risk. Or generating a third air interface ID protection key, so that the third air interface ID is encrypted and transmitted by the first air interface ID protection key or the third air interface ID protection key, and the first air interface ID is still encrypted and transmitted through the first air interface ID protection key. Protect user privacy and network security.

Optionally, when the at least two wireless access nodes serve the UE, the sending, by the upper layer network control node, the first air interface ID protection key to the wireless access node includes:

The upper network control node sends the first air interface ID protection key to one of the wireless access nodes or at least two wireless access nodes serving the UE.

For the technical solution proposed by the present invention, when there are multiple radio access nodes serving the UE, the upper layer control network sends the generated first air interface ID protection key to the plurality of radio access nodes, so that the radio access nodes The first air interface ID can be encrypted and transmitted through the first air interface ID protection key, thereby avoiding the situation that the first air interface ID is leaked.

A second aspect of the present invention provides a protection device for an air interface identifier, including:

a receiving unit, configured to receive an incoming network connection request sent by the user equipment UE, where the network connection request includes an identifier of the UE;

An obtaining unit, configured to obtain a root key corresponding to the identifier of the UE;

a generating unit, configured to generate a first air interface identifier ID protection key according to the root key and the first preset parameter corresponding to the identifier of the UE, where the first preset parameter includes an identifier of the UE and a network device ID And one or any combination of a public land mobile network PLMN ID, a security algorithm ID, and a random number to which the UE belongs, where the network device ID is an ID of a cell corresponding to the radio access point accessed by the UE or the UE The accessed wireless access point corresponds to the ID of the base station;

a sending unit, configured to send the first air interface ID protection key to the wireless access node, so that the wireless access node encrypts and transmits the first air interface ID by using the first air interface ID protection key, where The first air interface ID is an air interface ID allocated by the wireless access node to the UE.

With reference to the second aspect, it is to be noted that the sending unit is further configured to send the first air interface ID protection key to the UE, and send the first preset parameter to the UE, And causing the UE to generate the first air interface ID protection key according to the root key corresponding to the identifier of the UE and the first preset parameter.

In the second aspect, it can be understood that when the radio access node accessed by the UE is switched from the original radio access node to the new radio access node,

The receiving unit is further configured to receive a key request message sent by the new wireless access node, where the key request message includes an identifier of the UE;

The acquiring unit is further configured to acquire the first air interface ID protection key according to the identifier of the UE;

The sending unit is further configured to send the first air interface ID protection key to the new wireless access node, so that the new wireless access node protects the second air interface by using the first air interface ID The ID is encrypted, and the second air interface ID is an air interface ID allocated by the new radio access node to the UE.

With reference to the second aspect, optionally, when the wireless access node accessed by the UE is switched from the original wireless access node to the new wireless access node,

The generating unit is further configured to: protect the key and the second preset according to the first air interface ID The parameter generates the second air interface ID protection key, where the second preset parameter is one of the new wireless access point ID, the carrier frequency of the cell corresponding to the new wireless access point, and the second air interface ID. Or any combination, the second air interface ID is an air interface ID allocated by the new radio access node to the UE;

The sending unit is further configured to send the second air interface ID protection key to the new wireless access node, so that the new wireless access node protects the second air interface by using the second air interface ID The ID is encrypted for transmission.

In combination with the second aspect, optionally, when the UE has a new wireless access node,

The obtaining unit is further configured to acquire a first air interface ID protection key according to the identifier of the UE;

The sending unit is further configured to send the first air interface ID protection key to the new wireless access node, so that the newly added wireless access node protects the key pair by using the first air interface ID. The three air interface IDs are encrypted and transmitted, and the third air interface ID is an air interface ID allocated by the newly added wireless access node to the UE.

The generating unit is further configured to generate the third air interface ID protection key according to the first air interface ID protection key and a third preset parameter, where the third preset parameter includes the newly added wireless access One or any combination of a node ID, a carrier frequency of the cell corresponding to the new wireless access node, and the third air interface ID, where the third air interface ID is the new wireless access node is the UE The assigned air interface ID;

The sending unit is further configured to send the third air interface ID protection key to the new wireless access node, so that the newly added wireless access node protects the key pair by using the third air interface ID. The three air interface IDs are encrypted for transmission.

With reference to the second aspect, optionally, when there are at least two wireless access nodes serving the UE,

The sending unit is further configured to send the first air interface ID protection key to one of the wireless access nodes serving the UE or at least two wireless access nodes.

In a third aspect, an embodiment of the present invention provides a protection device for an air interface identifier, including:

a memory for storing information including program instructions;

a receiver, configured to receive an incoming network connection request sent by the user equipment UE, where the network connection is The request includes the identifier of the UE;

a processor, coupled to the memory, the receiver, and the transmitter, for controlling execution of the program instruction, specifically, acquiring a root key corresponding to the identifier of the UE; and corresponding to the identifier of the UE The first key parameter and the first preset parameter generate a first air interface identifier ID protection key, where the first preset parameter includes an identifier of the UE, a network device ID, and a public land mobile network PLMN ID to which the UE belongs. And one or any combination of a security algorithm ID and a random number, where the network device ID is an ID of a cell corresponding to the wireless access point accessed by the UE or an ID of a base station corresponding to the wireless access point accessed by the UE;

The transmitter is configured to send the first air interface ID protection key to the wireless access node, so that the wireless access node performs encrypted transmission on the first air interface ID by using the first air interface ID protection key. The first air interface ID is an air interface ID allocated by the wireless access node to the UE.

In combination with the third aspect, optionally, the transmitter is further configured to send the first air interface ID protection key to the UE. The transmitter is further configured to send the first preset parameter to the UE, so that the UE generates the first according to a root key corresponding to the identifier of the UE and the first preset parameter. An air interface ID protection key.

With reference to the third aspect, it can be understood that when the radio access node accessed by the UE is switched from the original radio access node to the new radio access node,

The receiver is further configured to receive a key request message sent by the new wireless access node, where the key request message includes an identifier of the UE;

The processor is further configured to acquire the first air interface ID protection key according to the identifier of the UE;

The transmitter is further configured to send the first air interface ID protection key to the new wireless access node, so that the new wireless access node protects the second air interface by using the first air interface ID The ID is encrypted, and the second air interface ID is an air interface ID allocated by the new radio access node to the UE.

With reference to the third aspect, it can be understood that when the wireless access point accessed by the UE is switched from the original wireless access node to the new wireless access node,

The processor is further configured to generate the second air interface ID protection key according to the first air interface ID protection key and a second preset parameter, where the second preset parameter is the new wireless access point The ID, the new radio access point corresponds to one of the carrier frequency and the second air interface ID, and the second air interface ID is an air interface ID allocated by the new radio access node to the UE;

The transmitter is further configured to send the second air interface ID protection key to the new wireless access node, so that the new wireless access node protects the second air interface by using the second air interface ID The ID is encrypted for transmission.

With reference to the third aspect, it can be understood that when the UE has a new wireless access node,

The processor is further configured to acquire a first air interface ID protection key according to the identifier of the UE;

The transmitter is further configured to send the first air interface ID protection key to the new wireless access node, so that the newly added wireless access node protects the key pair by using the first air interface ID. The three air interface IDs are encrypted and transmitted, and the third air interface ID is an air interface ID allocated by the newly added wireless access node to the UE.

The processor is further configured to generate the third air interface ID protection key according to the first air interface ID protection key and a third preset parameter, where the third preset parameter includes the newly added wireless access One or any combination of a node ID, a carrier frequency of the cell corresponding to the new wireless access node, and the third air interface ID, where the third air interface ID is the new wireless access node is the UE The assigned air interface ID;

The transmitter is further configured to send the third air interface ID protection key to the new wireless access node, so that the newly added wireless access node protects the key pair by using the third air interface ID. The three air interface IDs are encrypted for transmission.

In conjunction with the third aspect, it should be noted that when there are at least two wireless access nodes serving the UE,

The transmitter is further configured to send the first air interface ID protection key to one of the wireless access nodes serving the UE or at least two wireless access nodes.

Method and device for protecting air interface identifier provided by embodiment of the present invention, upper layer network control node Receiving the network connection request sent by the UE, where the network connection request includes the identifier of the UE, and the upper network control node generates the first air interface ID protection key according to the root key corresponding to the identifier of the UE and the first preset parameter, and the upper network control node The first air interface ID protection key is sent to the wireless access node, so that the wireless access node encrypts the first air interface ID according to the first air interface ID protection key, and sends the encrypted first air interface ID to the UE. Compared with the prior art, the air interface ID can be used to generate the first air interface ID protection key for the first air interface ID, and the wireless access node can pass the The first air interface ID protection key encrypts the first air interface ID, so that the first air interface ID is transmitted in an encrypted form, which avoids the persistent acquisition of the air interface ID by the attacker, and protects the user's private information and network security.

DRAWINGS

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the embodiments or the description of the prior art will be briefly described below. Obviously, the drawings in the following description are only It is a certain embodiment of the present invention, and other drawings can be obtained from those skilled in the art without any creative work.

FIG. 1 is a schematic diagram of a logical structure of a protection system for an air interface identifier according to an embodiment of the present invention;

2 is a flowchart of a method for protecting an air interface identifier according to an embodiment of the present invention;

FIG. 3 is a flowchart of another method for protecting an air interface identifier according to an embodiment of the present invention;

FIG. 4 is a flowchart of another method for protecting an air interface identifier according to an embodiment of the present invention;

FIG. 5 is a flowchart of another method for protecting an air interface identifier according to an embodiment of the present invention;

FIG. 6 is a schematic diagram of a logical structure of a device for protecting an air interface identifier according to an embodiment of the present disclosure;

FIG. 7 is a schematic diagram of a logical structure of an upper layer control node in a method for protecting an air interface ID identifier according to an embodiment of the present invention.

detailed description

The technical solutions in the embodiments of the present invention are clearly and completely described in the following with reference to the accompanying drawings in the embodiments of the present invention. It is obvious that the described embodiments are only a part of the embodiments of the present invention. Rather than all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention.

In order to solve the problem that the user's private information and the network security are at risk due to the air interface ID leakage, the embodiment of the present invention provides a protection system for the air interface identifier. As shown in FIG. 1 , the system includes an upper layer network control node and a wireless access node. HSS (Home Subscriber Server) and UE (User Equipment).

The upper network control node may be a node configured by an SDT (Software Defined Topology) unit or an SDP (Software Defined Protocol) unit for managing user equipment service connectivity and mobility performance.

The SDT unit is configured to determine a radio access node serving the UE after the UE accesses the network.

The SDP unit is configured to implement the function of the upper layer network control node after the UE accesses the network.

The wireless access node is a wireless access node that the UE accesses through an air interface.

The same pre-shared root key in the USIM card of each UE is stored in the HSS for participation in the AKA (Authentication and Key Agreement) authentication.

The UE is a terminal device that accesses the wireless network.

In order to avoid the leakage of the air interface ID, the embodiment of the present invention provides a method for protecting the air interface identifier, which is applied to the protection system of the air interface identifier shown in FIG. 1 , as shown in FIG. 2 , the method includes:

201. The upper layer network control node receives the network connection request sent by the UE, where the network connection request includes the identifier of the UE.

The identifier of the UE may be an IMSI (International Mobile Subscriber Identity) of the UE.

202. The upper network control node acquires a root key corresponding to the identifier of the UE.

203. The upper network control node generates a first air interface ID protection key according to the root key corresponding to the identifier of the UE and the first preset parameter.

The first preset parameter includes the identifier of the UE, the network device ID, one of the PLMN (Public Land Mobile Network) ID, the security algorithm ID, and the random number to which the UE belongs, and the network device ID is The wireless access point accessed by the UE corresponds to the ID of the cell or the ID of the corresponding base station of the wireless access point accessed by the UE. First air interface ID protection key Is the encryption key and/or the security key.

Specifically, the first air interface ID protection key may be generated by using a random selection algorithm, for example, K=KDF (Key Derivation Function) (Key, time), K=KDF (Key, ID, time), K=KDF (Key, SN), K=KDF (Key, ID, SN), or K=KDF (Key, ID, SN, time); wherein k represents a random selection, and the Key may be a random number or a root corresponding to the identifier of the UE. The key; the ID may be one or a combination of the identity of the UE, the network device ID, the PLMN ID, and the security algorithm ID.

204. The upper network control node sends the first air interface ID protection key to the wireless access node, so that the wireless access node performs encrypted transmission on the first air interface ID by using the first air interface ID protection key.

The first air interface ID is an air interface ID allocated by the wireless access node for the UE, and the first air interface ID is used to identify the identity of the UE in the air interface, and the UE and the wireless access node perform data transmission by using the first air interface ID.

The method for protecting the air interface identifier provided by the embodiment of the present invention, the upper layer network control node receives the network connection request sent by the UE, and the network connection request includes the identifier of the UE, and the root network key corresponding to the identifier of the UE and the first pre-layer The parameter is generated to generate the first air interface ID protection key, and the upper network control node sends the first air interface ID protection key to the wireless access node, so that the wireless access node performs the first air interface ID according to the first air interface ID protection key. Encryption sends the encrypted first air interface ID to the UE. Compared with the prior art, the air interface ID can be used to generate the first air interface ID protection key for the first air interface ID, and the wireless access node can pass the The first air interface ID protection key encrypts the first air interface ID, so that the first air interface ID is transmitted in an encrypted form, which avoids the persistent acquisition of the air interface ID by the attacker, and protects the user's private information and network security.

With the system shown in FIG. 1 and the method flow shown in FIG. 2, after the upper-layer network control node receives the network connection request sent by the UE, it needs to perform authentication with the UE, and further, in order to enable the UE to encrypt the first air interface. The ID is decrypted, and the UE needs to know the first air interface ID protection key. Therefore, in another implementation manner provided by the embodiment of the present invention, the method for the UE to initially access a wireless access point air interface protection is performed. Description, as shown in Figure 3, in the above steps Step 201: After receiving the network connection request sent by the UE, the upper network control node further includes steps 205 and 206.

205. The upper-layer network control node obtains the authentication data information of the UE from the HSS according to the network connection request.

206. The upper layer network control node performs a two-way authentication operation with the UE by using the authentication data information.

After the mutual authentication is successful, step 202 is performed.

In addition, after the foregoing step 203, the upper layer network control node generates the first air interface ID protection key according to the root key corresponding to the identifier of the UE and the first preset parameter, the method further includes step 207 and step 208.

207. The upper network control node sends the first preset parameter to the UE.

The first preset parameter is the same as the related description in the foregoing step 202, and details are not described herein again.

208. The UE generates a first air interface ID protection key according to the root key corresponding to the identifier of the UE and the first preset parameter.

In another implementation manner provided by the embodiment of the present invention, the upper network control node may directly send the first air interface ID protection key to the UE, without performing steps 207 and 208.

It can be understood that, after acquiring or generating the first air interface ID protection key, the UE may decrypt the received first air interface ID according to the first air interface ID protection key.

In addition, in the foregoing step 204, the upper network control node sends the first air interface ID protection key to the wireless access node, so that the wireless access node encrypts and transmits the first air interface ID through the first air interface ID protection key. Step 2041 to step 2042.

2041. The upper network control node sends the first air interface ID protection key to the wireless access node.

2042. The wireless access node performs encrypted transmission on the first air interface ID by using the first air interface ID protection key.

The sending, by the wireless access node, the first air interface ID to the UE may be implemented in the following four steps.

In the first step, the wireless access node sends a negotiation message after the security operation to the UE, where the negotiation message includes a security parameter.

The completion operation refers to integrity protection, which refers to processing the negotiation message to make negotiation. Messages can be discovered in time after they cannot be tampered with or tampered with. The security parameters include encryption algorithms and guarantee algorithms.

In the second step, after the UE verifies the security operation and verifies the security parameter, the UE may respond to the wireless access node, and the security negotiation succeeds. If the verification fails, the negotiation is rejected.

In the third step, the wireless access node encrypts and transmits the first air interface ID to the UE according to the security parameter and the first air interface ID protection key.

The fourth step, after receiving the encrypted first air interface ID, the UE decrypts the first air interface ID according to the received first air interface ID protection key or the first air interface ID protection key generated by the UE, in the next operation. The first air interface ID is enabled to transmit data with the wireless access point.

The method for protecting the air interface identifier provided by the embodiment of the present invention, the upper layer network control node receives the network connection request sent by the UE, and the network connection request includes the identifier of the UE, and the upper layer network control node generates the first air interface ID protection key according to the identifier of the UE. And sending the first air interface ID protection key or the first preset parameter to the upper network control node, so that the UE acquires or generates the first air interface ID protection key, and then the upper network control node sends the first air interface ID protection key to the The wireless access node is configured to enable the wireless access node to encrypt the first air interface ID according to the first air interface ID protection key, and send the encrypted first air interface ID to the UE, and then the UE protects the key pair according to the first air interface ID. The first air interface ID is decrypted. Compared with the prior art, the air interface ID can be used to generate the first air interface ID protection key for the first air interface ID, and the wireless access node can pass the The first air interface ID protection key encrypts the first air interface ID, so that the first air interface ID is transmitted in an encrypted form, which avoids the persistent acquisition of the air interface ID by the attacker, and protects the user's private information and network security.

In the foregoing method, when the UE initially accesses the radio access node service set, that is, when there are at least two radio access nodes serving the UE, in another implementation manner provided by the embodiment of the present invention, the foregoing step 204, The upper network control node sends the first air interface ID protection key to the wireless access node, which can be implemented as follows:

The upper network control node transmits the first air interface ID protection key to one of the wireless access nodes serving the UE or at least two wireless access nodes.

For the embodiment of the present invention, when there are multiple wireless access nodes serving the UE, the upper layer control The network sends the generated first air interface ID protection key to the plurality of wireless access nodes, so that the wireless access nodes can encrypt and transmit the first air interface ID by using the first air interface ID protection key, thereby avoiding the An air interface ID is leaked.

During the UE mobile process, it is possible to move from one cell to another. Correspondingly, the wireless access point connected by the UE changes, when the wireless access point of the UE is switched from the original wireless access point to the new wireless connection. In another implementation manner provided by the embodiment of the present invention, as shown in FIG. 4, based on the method flow shown in FIG. 2 and FIG. 3, the method further includes:

401. The upper layer network control node receives a key request message sent by the new wireless access node, where the key request message includes an identifier of the UE.

402. The upper layer network control node acquires the first air interface ID protection key according to the identifier of the UE.

In this step, the upper layer network control node obtains the first air interface ID protection key generated last time according to the identifier of the UE. or,

The upper network control node acquires the root key corresponding to the identifier of the UE and the first preset parameter according to the identifier of the UE, and generates a first air interface ID protection key according to the root key corresponding to the identifier of the UE and the first preset parameter.

403. The upper network control node sends the first air interface ID protection key to the new wireless access node, so that the new wireless access node performs encrypted transmission on the second air interface ID by using the first air interface ID protection key.

The second air interface ID is an air interface ID allocated by the new wireless access node to the UE.

It can be understood that after the UE switches from the original wireless access node to the new wireless access node, the new air access node encrypts and transmits the second air interface ID to the UE through the first air interface ID protection key, and the original wireless access The node terminates the transmission of the first air interface ID.

It should be noted that, in another implementation manner provided by the embodiment of the present invention, the foregoing step 402 may be replaced by: the upper layer network control node generates the second air interface ID protection according to the first air interface ID protection key and the second preset parameter. The second preset parameter is one of a new wireless access point ID, a carrier frequency of the cell corresponding to the new wireless access point, and a second air interface ID.

It is to be noted that after the upper network control node generates the second air interface ID protection key, the upper network control node also needs to send the second air interface ID protection key or the second preset parameter to the UE, so that the UE acquires or generates. The second air interface ID protects the key. If the second preset parameter is Including the second air interface ID, the second preset parameter point may be sent to the UE through the original wireless access node, and the second air interface ID protection key is used to encrypt and transmit the second parameter.

If the upper network control node sends the second preset parameter to the UE, the new wireless access node also needs to trigger the operation of the UE to start generating the second air interface ID protection key, for example, the new wireless access node can transmit a specific counter. The parameter triggers the UE to perform an operation of generating a second air interface ID protection key.

Correspondingly, the foregoing step 403 may be replaced by: the upper network control node sends the second air interface ID protection key to the new wireless access node, so that the new wireless access node performs the second air interface ID through the second air interface ID protection key. Encrypted transmission.

The access method of the air interface identifier provided by the embodiment of the present invention, the upper layer network control node receives the key request message sent by the new wireless access node, and the upper layer network control node obtains the first air interface ID protection key according to the identifier of the UE, and the upper layer network control The node sends the first air interface ID protection key to the new wireless access node, so that the new wireless access node encrypts and transmits the second air interface ID through the first air interface ID protection key; or the upper network control node according to the identifier of the UE Corresponding root key and second preset parameter generate a second air interface ID protection key, and send the second air interface ID protection key to the new wireless access node, so that the new wireless access node protects the confidentiality through the second air interface ID. The key encrypts and transmits the second air interface ID. Compared with the prior art, the air interface ID leakage causes the user's private information and the network security to be at risk, the embodiment of the present invention still needs to allocate the second wireless communication node to the UE after the UE switches to the new wireless access node. The air interface ID acquires the first air interface ID protection key or generates a second air interface ID protection key, so that the second air interface ID is encrypted and transmitted through the first air interface ID protection key or the second air interface ID protection key, thereby protecting user privacy and the network. Safety. In addition, the access method of the air interface identifier provided by the embodiment of the present invention can be applied to a scenario in which the UE switches the wireless access node, and is more applicable to the new network architecture, and the air interface ID is allocated by the wireless access node, and is generated by the upper layer network control node. The air interface ID protects the key, so that the transmission air interface ID has better timeliness.

In addition, when the UE has a new wireless access node, in another implementation manner provided by the embodiment of the present invention, as shown in FIG. 5, the method is based on the method flow shown in FIG. 2 and FIG. Also includes:

501. The upper layer network control node acquires a first air interface ID protection key.

In this step, the upper layer network control node directly obtains the first air interface ID protection key generated last time. or,

The upper network control node generates a first air interface ID protection key according to the root key corresponding to the identifier of the UE and the first preset parameter.

502. The upper network control node sends the first air interface ID protection key to the newly added wireless access node, so that the newly added wireless access node encrypts and transmits the third air interface ID by using the first air interface ID protection key.

The third air interface ID is an air interface ID allocated by the newly added wireless access node for the UE.

It can be understood that when there is a new wireless access node, the newly added wireless access node encrypts and transmits the third air interface ID to the UE through the first air interface ID protection key, and the original wireless access node still passes the first air interface ID. The protection key encrypts the first air interface ID to the UE.

It should be noted that, in another implementation manner provided by the embodiment of the present invention, the foregoing step 502 may be replaced by: the upper layer network control node generates a third air interface ID protection according to the first air interface ID protection key and the third preset parameter. The third preset parameter includes one of a new wireless access node ID, a carrier frequency of the corresponding wireless access node, and a third air interface ID.

It is to be noted that after the upper network control node generates the third air interface protection key, the upper network control node also needs to send the third air interface ID protection key or the third preset parameter to the UE, so that the UE acquires or generates the first Three air interface ID protection key. When the third air interface ID is included in the third preset parameter, the third preset parameter may be sent to the UE through the original wireless access node, and the third air interface ID protection key is used to encrypt and transmit the third preset parameter.

If the upper network control node sends the third preset parameter to the UE, the newly added wireless access node needs to trigger the operation of the UE to start generating the third air interface ID protection key. For example, the newly added wireless access node can transmit the specific The counter parameter triggers the UE to perform an operation of generating a third air interface ID protection key.

Correspondingly, the foregoing step 503 may be replaced by: the upper layer network control node sends the third air interface ID protection key to the newly added wireless access node, so that the newly added wireless access node protects the key pair with the third air interface through the third air interface ID. The ID is encrypted for transmission.

At this time, the newly added wireless access node encrypts the third air interface ID through the third air interface ID protection key. After being transmitted to the UE, the original wireless access node still encrypts and transmits the first air interface ID to the UE through the first air interface ID protection key.

In the access method of the air interface identifier provided by the embodiment of the present invention, the upper layer network control node obtains the first air interface ID protection key, and sends the first air interface ID protection key to the newly added wireless access node, so that the new wireless access node is added. The node encrypts and transmits the first air interface ID by using the first air interface ID protection key, or the upper network control node generates a third air interface ID protection key according to the first air interface ID protection key and the third preset parameter, and adds wireless The access node sends the third air interface ID protection key, so that the new wireless access node encrypts and transmits the third air interface ID through the third air interface ID protection key. In the embodiment of the present invention, when there is a newly added wireless access node, the first air interface ID protection key is generated or a third air interface ID is generated, as compared with the prior art, the air interface ID leakage causes the user's private information and the network security to be at risk. Protecting the key, so that the third air interface ID is encrypted and transmitted by the first air interface ID protection key or the third air interface ID protection key, and the first air interface ID is still encrypted and transmitted through the first air interface ID protection key, thereby protecting user privacy and cyber security.

Corresponding to the foregoing method embodiment, in order to solve the problem that the privacy information of the user and the network security are at risk due to the leakage of the air interface ID, the embodiment of the present invention provides a protection device for the air interface identifier, and the device is applied to the upper network control node, such as As shown in FIG. 6, the apparatus includes: a receiving unit 601, an obtaining unit 602, a generating unit 603, and a transmitting unit 604.

The receiving unit 601 is configured to receive an incoming network connection request sent by the user equipment UE, where the network connection request includes an identifier of the UE;

The obtaining unit 602 is configured to acquire a root key corresponding to the identifier of the UE.

The generating unit 603 is configured to generate a first air interface identifier ID protection key according to the root key corresponding to the identifier of the UE and the first preset parameter, where the first preset parameter includes the identifier of the UE, the network device ID, and the public to which the UE belongs. One or any combination of a land mobile network PLMN ID, a security algorithm ID, and a random number, where the network device ID is an ID of a cell corresponding to a radio access point accessed by the UE or an ID of a base station corresponding to a radio access point accessed by the UE;

The sending unit 604 is configured to send the first air interface ID protection key generated by the generating unit 603 to the wireless access node, so that the wireless access node performs encrypted transmission on the first air interface ID by using the first air interface ID protection key.

The first air interface ID is an air interface ID allocated by the wireless access node to the UE.

In another embodiment of the present invention, the sending unit 604 is further configured to send the first air interface ID protection key to the UE.

In another embodiment of the present invention, the sending unit 604 is further configured to send the first preset parameter to the UE, so that the UE generates the first air interface ID protection according to the root key corresponding to the identifier of the UE and the first preset parameter. Key.

In another embodiment of the present invention, when the wireless access node accessed by the UE is switched from the original wireless access node to the new wireless access node, the receiving unit 601 is further configured to receive the key sent by the new wireless access node. a request message, where the key request message includes an identifier of the UE;

The obtaining unit 602 is further configured to acquire, according to the identifier of the UE, the first air interface ID protection key;

The sending unit 604 is further configured to send the first air interface ID protection key to the new wireless access node, so that the new wireless access node performs encrypted transmission on the second air interface ID by using the first air interface ID protection key.

The generating unit 603 is further configured to generate a second air interface ID protection key according to the first air interface ID protection key and the second preset parameter, where the second preset parameter is a new wireless access point ID, and a new wireless access point corresponding cell One or any combination of the carrier frequency and the second air interface ID;

The sending unit 604 is further configured to send, to the new wireless access node, the second air interface ID protection key generated by the generating unit 603, so that the new wireless access node encrypts and transmits the second air interface ID by using the second air interface ID protection key. .

In another embodiment of the present invention, when the UE has a new wireless access node, the acquiring unit 602 is further configured to acquire the first air interface ID protection key according to the identifier of the UE.

The sending unit 604 is further configured to send the first air interface ID protection key to the newly added wireless access node, so that the newly added wireless access node encrypts and transmits the third air interface ID by using the first air interface ID protection key.

In another embodiment of the present invention, when the UE has a new wireless access node, the generating unit 603 is further configured to generate a third air interface ID protection key according to the first air interface ID protection key and the third preset parameter. The third preset parameter includes one of a new wireless access node ID, a carrier frequency of the corresponding wireless access node corresponding cell, and a third air interface ID;

The sending unit 604 is further configured to send the third air interface ID protection key to the newly added wireless access node, so that the newly added wireless access node encrypts and transmits the third air interface ID by using the third air interface ID protection key.

The apparatus for protecting the air interface identifier provided by the embodiment of the present invention, the receiving unit receives the network connection request sent by the UE, where the network connection request includes the identifier of the UE, the acquiring unit acquires the root key corresponding to the identifier of the UE, and the generating unit corresponds to the identifier of the UE. The root key and the first preset parameter generate a first air interface ID protection key, and the sending unit sends the first air interface ID protection key to the wireless access node, so that the wireless access node protects the key according to the first air interface ID. The first air interface ID is encrypted, and the encrypted first air interface ID is sent to the UE. Compared with the prior art, the air interface ID can be used to generate the first air interface ID protection key for the first air interface ID, and the wireless access node can pass the The first air interface ID protection key encrypts the first air interface ID, so that the first air interface ID is transmitted in an encrypted form, which avoids the persistent acquisition of the air interface ID by the attacker, and protects the user's private information and network security.

An embodiment of the present invention further provides a device for signal processing. As shown in FIG. 7, the device is a hardware structure diagram of an upper layer network control node described in FIG. The upper network control node may include a memory 701, a processor 702, a receiver 703, a transmitter 704, and a bus 1005.

The memory 701 may be a ROM (Read Only Memory), a static storage device, a dynamic storage device, or a RAM (Random Access Memory). The memory 701 can store an operating system and other applications. When the technical solution provided by the embodiment of the present invention is implemented by software or firmware, the program code for implementing the technical solution provided by the embodiment of the present invention is stored in the memory 701 and executed by the processor 702.

The receiver 703 is used for communication between the device and other devices or communication networks (such as, but not limited to, Ethernet, RAN Radio Access Network, WLAN (Wireless Local Area Network), etc.).

The processor 702 can be a general-purpose central processing unit (CPU), a microprocessor, an application specific integrated circuit (ASIC), or one or more integrated circuits for executing related programs. The technical solution provided by the embodiment of the present invention is implemented.

Bus 1005 can include a path for communicating information between various components of the device, such as memory 701, receiver 703, transmitter 704, and processor 702.

It should be noted that although the hardware shown in FIG. 7 only shows the memory 701, the receiver 703, the transmitter 704 and the processor 702, and the bus 704, in a specific implementation process, those skilled in the art will understand that the device also Contains other devices necessary to achieve proper operation. At the same time, those skilled in the art will appreciate that hardware devices that implement other functions may also be included, depending on the particular needs.

Specifically, when the upper layer network control node shown in FIG. 7 is used to implement the apparatus shown in the embodiment of FIG. 6, the receiver 703 in the apparatus is configured to receive an incoming network connection request sent by the user equipment UE, where the network connection request is included. The identity of the UE.

The processor 702 is coupled to the memory 701, the receiver 703, and the transmitter 704, and is configured to control execution of the program instruction, where the root key corresponding to the identifier of the UE is obtained, and the root key corresponding to the identifier of the UE and the first The preset parameter generates a first air interface identifier ID protection key, where the first preset parameter includes an identifier of the UE, a network device ID, a public land mobile network PLMN ID to which the UE belongs, a security algorithm ID, a random number, or any combination The network device ID is the ID of the cell corresponding to the wireless access point accessed by the UE or the ID of the corresponding base station of the wireless access point accessed by the UE;

The transmitter 704 is configured to send the first air interface ID protection key to the wireless access node, so that the wireless access node performs encrypted transmission on the first air interface ID by using the first air interface ID protection key.

In another embodiment of the present invention, the transmitter 704 is further configured to send the first air interface ID protection key to the UE.

In another embodiment of the present invention, the transmitter 704 is further configured to send the first preset parameter to the UE, so that the UE generates the first space according to the root key corresponding to the identifier of the UE and the first preset parameter. Port ID protection key.

In another embodiment of the present invention, when the radio access node accessed by the UE is switched from the original radio access node to the new radio access node,

The receiver 703 is further configured to receive a key request message sent by the new wireless access node, where the key request message includes an identifier of the UE.

The processor 702 is further configured to acquire, according to the identifier of the UE, the first air interface ID protection key;

The transmitter 704 is further configured to send the first air interface ID protection key to the new wireless access node, so that the new wireless access node performs encrypted transmission on the second air interface ID by using the first air interface ID protection key.

In another embodiment of the present invention, when the wireless access point accessed by the UE is switched from the original wireless access node to the new wireless access node,

The processor 702 is further configured to generate a second air interface ID protection key according to the first air interface ID protection key and the second preset parameter, where the second preset parameter is a new wireless access point ID, a new wireless access point corresponding cell One or any combination of the carrier frequency and the second air interface ID;

The transmitter 704 is further configured to send the second air interface ID protection key to the new wireless access node, so that the new wireless access node performs encrypted transmission on the second air interface ID by using the second air interface ID protection key.

In another embodiment of the present invention, when the UE has a new wireless access node, the processor 702 is further configured to acquire the first air interface ID protection key according to the identifier of the UE.

The transmitter 704 is further configured to send the first air interface ID protection key to the newly added wireless access node, so that the newly added wireless access node encrypts and transmits the third air interface ID by using the first air interface ID protection key.

In another embodiment of the present invention, when the UE has a new wireless access node, the processor 702 is further configured to generate a third air interface ID protection key according to the first air interface ID protection key and the third preset parameter. The third preset parameter includes a newly added wireless access node ID, and a new wireless access node corresponding One or any combination of a carrier frequency and a third air interface ID of the cell;

The transmitter 704 is further configured to send the third air interface ID protection key to the newly added wireless access node, so that the newly added wireless access node encrypts and transmits the third air interface ID by using the third air interface ID protection key.

In another embodiment of the present invention, when there are at least two radio access nodes serving the UE, the transmitter 704 is further configured to send the first air interface ID protection key to one of the radio access nodes serving the UE. Or at least two wireless access nodes.

The apparatus for protecting the air interface identifier provided by the embodiment of the present invention, the receiver receives the network connection request sent by the UE, and the network connection request includes the identifier of the UE, and the processor generates the first according to the root key corresponding to the identifier of the UE and the first preset parameter. An air interface ID protection key, the sender sends the first air interface ID protection key to the wireless access node, so that the wireless access node encrypts the first air interface ID according to the first air interface ID protection key, and the encrypted The first air interface ID is sent to the UE. Compared with the prior art, the air interface ID can be used to generate the first air interface ID protection key for the first air interface ID, and the wireless access node can pass the The first air interface ID protection key encrypts the first air interface ID, so that the first air interface ID is transmitted in an encrypted form, which avoids the persistent acquisition of the air interface ID by the attacker, and protects the user's private information and network security.

Through the description of the above embodiments, those skilled in the art can clearly understand that the present invention can be implemented by means of software plus necessary general hardware, and of course, by hardware, but in many cases, the former is a better implementation. . Based on the understanding, the technical solution of the present invention, which is essential or contributes to the prior art, can be embodied in the form of a software product stored in a readable storage medium, such as a floppy disk of a computer. A hard disk or optical disk, etc., includes instructions for causing a computer device (which may be a personal computer, server, or network device, etc.) to perform the methods described in various embodiments of the present invention.

The above is only a specific embodiment of the present invention, but the scope of the present invention is not limited thereto, and any person skilled in the art can easily think of changes or substitutions within the technical scope of the present invention. It should be covered by the scope of the present invention. Therefore, the scope of the invention should be determined by the scope of the appended claims.

Claims

A method for protecting an air interface identifier, comprising:

The upper network control node receives the network connection request sent by the user equipment UE, where the network connection request includes the identifier of the UE;

The upper layer network control node acquires a root key corresponding to the identifier of the UE;

The upper network control node generates a first air interface identifier ID protection key according to the root key and the first preset parameter corresponding to the identifier of the UE, where the first preset parameter includes the identifier of the UE, and the network device ID, one or any combination of a public land mobile network PLMN ID, a security algorithm ID, and a random number to which the UE belongs, where the network device ID is an ID of a cell corresponding to the radio access point accessed by the UE or the The wireless access point accessed by the UE corresponds to the ID of the base station;

The upper network control node sends the first air interface ID protection key to the wireless access node, so that the wireless access node encrypts and transmits the first air interface ID by using the first air interface ID protection key. The first air interface ID is an air interface ID allocated by the wireless access node to the UE.
The method for protecting an air interface identifier according to claim 1, wherein after the first network control node generates the first air interface ID protection key according to the root key corresponding to the identifier of the UE and the first preset parameter, The method further includes:

The upper layer network control node sends the first air interface ID protection key to the UE.
The method for protecting an air interface identifier according to claim 1, wherein after the upper layer network control node receives the network connection request sent by the UE, the method further includes:

The upper layer network control node sends the first preset parameter to the UE, so that the UE generates the first air interface according to the root key corresponding to the identifier of the UE and the first preset parameter. ID protection key.
The method for protecting an air interface identifier according to any one of claims 1 to 3, wherein when the wireless access node accessed by the UE is switched from the original wireless access node to a new wireless access node, The method also includes:

Receiving, by the upper layer network control node, a key request message sent by the new wireless access node, where the key request message includes an identifier of the UE;

Obtaining, by the upper layer network control node, the first air interface ID protection key according to the identifier of the UE;

Sending, by the upper layer network control node, the first air interface ID protection key to the new radio access node, so that the new radio access node performs the second air interface ID by using the first air interface ID protection key. Encrypted transmission, where the second air interface ID is an air interface ID allocated by the new radio access node to the UE.
The method for protecting an air interface identifier according to any one of claims 1 to 3, wherein when the wireless access point accessed by the UE is switched from the original wireless access node to the new wireless access node, The method also includes:

Receiving, by the upper layer network control node, a key request message sent by the new wireless access node, where the key request message includes an identifier of the UE;

The upper network control node generates the second air interface ID protection key according to the first air interface ID protection key and the second preset parameter, where the second preset parameter is the new wireless access point ID, The new wireless access point corresponds to one of the carrier frequency and the second air interface ID of the cell, and the second air interface ID is an air interface ID allocated by the new wireless access node to the UE;

Sending, by the upper layer network control node, the second air interface ID protection key to the new radio access node, so that the new radio access node performs the second air interface ID by using the second air interface ID protection key. Encrypted transmission.
The method for protecting an air interface identifier according to any one of claims 1 to 3, wherein when the UE has a new wireless access node, the method further includes:

The upper layer network control node acquires a first air interface ID protection key;

Sending, by the upper layer network control node, the first air interface ID protection key to the new wireless access node, so that the newly added wireless access node protects the third air interface by using the first air interface ID The ID is encrypted, and the third air interface ID is an air interface ID allocated by the newly added wireless access node to the UE.
The method for protecting an air interface identifier according to any one of claims 1 to 3, wherein when the UE has a new wireless access node, the method further includes:

The upper network control node generates the third air interface ID protection key according to the first air interface ID protection key and a third preset parameter, where the third preset parameter includes the newly added wireless access node ID The carrier frequency of the cell corresponding to the newly added wireless access node, and the third air interface ID And the third air interface ID is an air interface ID allocated by the newly added wireless access node to the UE;

Sending, by the upper layer network control node, the third air interface ID protection key to the new wireless access node, so that the newly added wireless access node protects the third air interface by using the third air interface ID The ID is encrypted for transmission.
A protection device for an air interface identifier, comprising:

a receiving unit, configured to receive an incoming network connection request sent by the user equipment UE, where the network connection request includes an identifier of the UE;

An obtaining unit, configured to obtain a root key corresponding to the identifier of the UE;

a generating unit, configured to generate a first air interface identifier ID protection key according to the root key and the first preset parameter corresponding to the identifier of the UE, where the first preset parameter includes an identifier of the UE and a network device ID And one or any combination of a public land mobile network PLMN ID, a security algorithm ID, and a random number to which the UE belongs, where the network device ID is an ID of a cell corresponding to the radio access point accessed by the UE or the UE The accessed wireless access point corresponds to the ID of the base station;

a sending unit, configured to send the first air interface ID protection key to the wireless access node, so that the wireless access node encrypts and transmits the first air interface ID by using the first air interface ID protection key, where The first air interface ID is an air interface ID allocated by the wireless access node to the UE.
The apparatus for protecting an air interface identifier according to claim 8, wherein

The sending unit is further configured to send the first air interface ID protection key to the UE.
The apparatus for protecting an air interface identifier according to claim 8, wherein

The sending unit is further configured to send the first preset parameter to the UE, so that the UE generates the first according to a root key corresponding to the identifier of the UE and the first preset parameter. An air interface ID protection key.
The apparatus for protecting an air interface identifier according to any one of claims 8 to 10, wherein when the radio access node accessed by the UE is switched from the original radio access node to the new radio access node,

The receiving unit is further configured to receive a key request message sent by the new wireless access node, where the key request message includes an identifier of the UE;

The acquiring unit is further configured to acquire the first air interface ID protection according to the identifier of the UE. Key

The sending unit is further configured to send the first air interface ID protection key to the new wireless access node, so that the new wireless access node protects the second air interface by using the first air interface ID The ID is encrypted, and the second air interface ID is an air interface ID allocated by the new radio access node to the UE.
The apparatus for protecting an air interface identifier according to any one of claims 8 to 10, wherein when the radio access node accessed by the UE is switched from the original radio access node to the new radio access node,

The receiving unit is further configured to receive a key request message sent by the new wireless access node, where the key request message includes an identifier of the UE;

The generating unit is further configured to generate the second air interface ID protection key according to the first air interface ID protection key and a second preset parameter, where the second preset parameter is the new wireless access point The ID, the new radio access point corresponds to one of the carrier frequency and the second air interface ID, and the second air interface ID is an air interface ID allocated by the new radio access node to the UE;

The sending unit is further configured to send the second air interface ID protection key to the new wireless access node, so that the new wireless access node protects the second air interface by using the second air interface ID The ID is encrypted for transmission.
The apparatus for protecting an air interface identifier according to any one of claims 8 to 10, wherein when the UE has a new wireless access node,

The obtaining unit is further configured to acquire a first air interface ID protection key according to the identifier of the UE;

The sending unit is further configured to send the first air interface ID protection key to the new wireless access node, so that the newly added wireless access node protects the key pair by using the first air interface ID. The three air interface IDs are encrypted and transmitted, and the third air interface ID is an air interface ID allocated by the newly added wireless access node to the UE.
The apparatus for protecting an air interface identifier according to any one of claims 8 to 10, wherein when the UE has a new wireless access node,

The generating unit is further configured to generate the third air interface ID protection key according to the first air interface ID protection key and a third preset parameter, where the third preset parameter includes the newly added wireless access a node ID, a carrier frequency of the cell corresponding to the new wireless access node, and the third air interface ID One or any combination, the third air interface ID is an air interface ID allocated by the newly added wireless access node to the UE;

The sending unit is further configured to send the third air interface ID protection key to the new wireless access node, so that the newly added wireless access node protects the key pair by using the third air interface ID. The three air interface IDs are encrypted for transmission.