CN102869007B - The method of secure algorithm negotiation, device and network system - Google Patents

Abstract

The invention discloses a kind of method of secure algorithm negotiation, in system evolved framework/long evolving system, the method comprises: receive the security algorithm information that user terminal can be supported; According to described security algorithm information, select security algorithm; The mark representing described security algorithm is sent to described user terminal.Meanwhile, the invention also discloses device and the network system of secure algorithm negotiation, use technical scheme provided by the invention, Non-Access Stratum security algorithm and Access Layer security algorithm can be negotiated in SAE/LTE system.

Description

Method, device and network system for security algorithm negotiation

technical field

The invention relates to the field of communication technology, in particular to a method, device and network system for negotiation of security algorithms.

Background technique

In the Universal Mobile Telecommunications System (UMTS), the radio network controller (RadioNetworkController, RNC) and the user terminal (UserEquipment, UE) are required to perform encryption/decryption and integrity protection operations, that is, to provide confidentiality protection for UE data, The signaling between UE and RNC provides confidentiality and integrity protection. Since the encryption/decryption and integrity algorithms supported by different UEs are different, the encryption/decryption algorithm and the integrity algorithm need to be negotiated before encryption/decryption and integrity protection. Since the UMTS system only needs to provide protection at the access (Access Stratum, AS) layer, the UMTS system negotiates encryption/decryption and integrity algorithms between the UE and the RNC.

In the System Architecture Evolution (SAE)/Long Term Evolution (Long Term Evolution, LTE) system, as shown in Figure 1, the core network includes: Mobility Management Entity (MME), User Plane Entity (User Plane Entity, UPE) and interface InterAccessSystemAnchor (IASA), where the MME is responsible for the mobility management of the control plane, including user context and mobility state management, assigning user temporary identity, security information, etc.; UPE is responsible for downlink data in idle state Initiate paging, manage and save IP bearer parameters and network internal information, etc.; IASA serves as the anchor point between users of different systems, and the access network is composed of evolved base stations (EvolvedNodeBase, eNodeB); in this system, the access of the signaling plane The security of layer signaling is terminated on the eNodeB, the security of the non-access layer of the signaling plane, that is, the security of the signaling plane of the core network is terminated on the MME, and the security of the user plane is terminated on the UPE. Therefore, the security endpoints on the signaling plane include: eNodeB, MME, and before the security endpoint performs corresponding security protection on data or signaling, it needs to negotiate the security endpoints supported by both the security endpoint and the user equipment (UE). Algorithm, that is, the AS security algorithm of the access stratum needs to be negotiated between the eNodeB and the UE, and the security algorithm of the Non-Access Stratum (None Access Stratum, NAS) needs to be negotiated between the MME and the UE.

In the existing SAE/LTE system, no security algorithm can be negotiated, that is, the access layer AS security algorithm and the non-access layer NAS security algorithm.

Contents of the invention

The purpose of the embodiments of the present invention is to provide a security algorithm negotiation method, device and network system, which can negotiate a security algorithm in an SAE/LTE system.

In order to solve the above technical problems, the purpose of the embodiments of the present invention is achieved through the following technical solutions:

A method for security algorithm negotiation, used in a system evolution architecture/long-term evolution system, the method includes:

Receive the security algorithm information that the user terminal can support;

Selecting a security algorithm according to the security algorithm information;

Sending the identifier representing the security algorithm to the user terminal.

A device for negotiating a security algorithm, used in a system evolution architecture/long-term evolution system, the device includes:

An information receiving unit, configured to receive information about security algorithms supported by the user terminal;

A security algorithm selection unit, configured to select a security algorithm according to the security algorithm information;

A sending unit, configured to send the identifier representing the security algorithm to the user terminal.

A network system, the system includes: an evolved base station, a mobility management entity, wherein,

The evolved base station is configured to send the security algorithm information supported by the user terminal to the mobility management entity; send the first identifier from the mobility management entity to the user terminal;

The mobility management entity is configured to select a non-access stratum security algorithm according to the security algorithm information and the algorithm information that the network allows users to use, and output a first identifier representing the non-access stratum security algorithm.

It can be seen from the above technical solutions that the embodiment of the present invention can negotiate security in the SAE/LTE system by selecting a security algorithm according to the security algorithm information that the user terminal can support, and sending an identifier indicating the selected security algorithm to the user terminal. algorithm.

Description of drawings

Fig. 1 is a SAE/LTE system structural diagram in the prior art;

FIG. 2 is a flowchart of a method for negotiating a security algorithm provided by Embodiment 1 of the present invention;

FIG. 3 is a flowchart of a method for negotiating a security algorithm provided by Embodiment 2 of the present invention;

FIG. 4 is a flowchart of a method for negotiating a security algorithm provided by Embodiment 3 of the present invention;

FIG. 5 is a flowchart of a method for negotiating a security algorithm provided by Embodiment 4 of the present invention;

FIG. 6 is a flowchart of a method for negotiating a security algorithm provided in Embodiment 5 of the present invention;

FIG. 7 is a flowchart of a method for negotiating a security algorithm provided by Embodiment 6 of the present invention;

FIG. 8 is a flowchart of a method for negotiating a security algorithm provided by Embodiment 7 of the present invention;

FIG. 9 is a flowchart of a method for negotiating a security algorithm provided in Embodiment 8 of the present invention;

FIG. 10 is a structural diagram of a device for negotiating a security algorithm provided by Embodiment 9 of the present invention;

FIG. 11 is a structural diagram of a network system provided by Embodiment 10 of the present invention.

Detailed ways

Embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

Referring to Fig. 2, the method for security algorithm negotiation provided by Embodiment 1 of the present invention includes:

Implement a middle layer 3 message Take the initial layer 3 message as an example, the initial layer 3 message is carried in the radio resource connection (RadioResourceConnection, RRC) request message, the initial layer 3 response information is carried in the RRC establishment message, and the NAS security algorithm is selected by the MME , the eNodeB selects the AS security algorithm;

Step 201, the UE sends a radio resource connection RRC request message to the eNodeB, the request message includes: AS security capability and initial layer 3 message, the initial layer 3 message carries NAS security capability; wherein, the AS security capability is the AS that the UE can support Security algorithm information, that is, the AS security algorithm list, and NAS security capability is the NAS security algorithm information that the UE can support, that is, the NAS security algorithm list;

Step 202, the eNodeB saves the security capability of the AS;

Step 203, the eNodeB sends a RANAP message to the MME, the message carries an initial layer 3 message, and the initial layer 3 message carries the NAS security capability of the UE;

Step 204: The MME selects a NAS security algorithm according to the NAS security capability of the UE and the algorithm information that the network allows the user to use; or, selects the NAS security algorithm according to the NAS security capability, the algorithm information that the network allows the user to use, and the user's subscription information ; Wherein, the algorithm information that the network allows users to use includes at least AS security algorithm information and NAS security algorithm information that users are allowed to use, wherein the AS security algorithm information that the network allows users to use includes: algorithm information supported by the eNodeB itself;

Step 205: The MME creates a NAS security mode command and a first AS security mode command, and sends a RANAP message to the eNodeB, and the RANAP message carries an initial layer 3 response message, a NAS security mode command, and the first AS security mode command, wherein, the NAS security mode command The mode command carries the first identifier representing the selected NAS security algorithm, and the first AS security mode command carries the algorithm information that the network allows the user to use;

Step 206: The eNodeB selects the AS security algorithm according to the AS security capability and the self-supported algorithm information pre-stored by the eNodeB, or selects the AS according to the AS security capability and the algorithm information supported by the eNodeB itself in the algorithm information that the network allows users to use. security algorithm;

Step 207: The eNodeB creates a second AS security mode command, the second AS security mode command includes a second identifier indicating the selected AS security algorithm, and sends an RRC establishment message to the UE, the message carries the AS security mode command, NAS Safe Mode Command and Initial Layer 3 Response Message;

Step 208, the UE sends an RRC confirmation message to the eNodeB, the message carries a layer 3 confirmation message, a NAS security mode command response, and a second AS security mode command response;

Step 209, the eNodeB sends a RANAP message to the MME, and the message carries a layer 3 confirmation message and a NAS security mode command response.

Among them, the algorithm supported by the UE may not distinguish between the AS algorithm and the NAS algorithm, that is, the algorithm supported by the UE is both the AS algorithm and the NAS algorithm, then the NAS security capability and the AS security capability are the same, and are generally referred to as the UE security capability. When the algorithm supported by the UE does not distinguish between the AS algorithm and the NAS algorithm, the RRC request message in step 201 may include: the UE security capability and the initial layer 3 message, the initial layer 3 message carries the UE security capability, and the UE security capability may only include Carry an IE; step 202 can save the security capability of the UE for the eNodeB; or, the initial layer 3 message in step 201 does not carry the UE security capability, and the RANAP message sent by the eNodeB to the MME in step 203 includes: the initial layer 3 message and the UE's security capabilities.

Referring to Fig. 3, the method for security algorithm negotiation provided by Embodiment 2 of the present invention includes:

The initial layer 3 message in the second implementation is carried in the RRC request message, the MME selects the NAS security algorithm, and the eNodeB selects the AS security algorithm;

Wherein, step 301-step 303 is the same as step 201-step 203 in the first embodiment;

Step 304, the MME creates a first AS security mode command, and sends a RANAP message to the eNodeB, the message carries the first AS security mode command, and the first AS security mode command carries algorithm information that the network allows users to use;

Step 305: The eNodeB selects the AS security algorithm according to the AS security capability and the self-supported algorithm information pre-stored by the eNodeB, or selects the AS according to the AS security capability and the algorithm information supported by the eNodeB itself in the algorithm information that the network allows users to use. security algorithm;

Step 306, the eNodeB creates a second AS security mode command, and sends an RRC setup message to the UE, the message carries the second AS security mode command, and the second AS security mode command contains a second identifier representing the selected AS security algorithm ;

Step 307, the UE sends an RRC confirmation message to the eNodeB, and the message carries the second AS security mode command response;

Step 308: The MME selects a NAS security algorithm according to the NAS security capability of the UE and the algorithm information that the network allows the user to use; or, selects the NAS security algorithm according to the NAS security capability, the algorithm information that the network allows the user to use, and the user's subscription information ;

Step 309, the MME creates a NAS security mode command, and sends a RANAP message to the eNodeB, the RANAP message carries the NAS security mode command, and the NAS security mode command carries the first identifier indicating the selected NAS security algorithm;

Step 310, the eNodeB sends an RRC message to the UE, the message carries a NAS security mode command, and the NAS security mode command carries a first identifier representing the selected NAS security algorithm;

Step 311, the UE sends an RRC message to the eNodeB, and the message carries a NAS security mode command response;

Step 312, the eNodeB sends a RANAP message to the MME, and the message carries a NAS security mode command response;

Step 313, the MME sends a RANAP message to the eNodeB, and the message carries an initial layer 3 response message;

Step 314, the eNodeB sends an RRC message to the UE, and the message carries an initial layer 3 response message.

Wherein, the initial layer 3 response message in step 313 and step 314 may be sent together with the NAS security mode command in step 309 and step 310; or, be sent together with the AS security mode command in step 304 and step 306; or, The NAS security mode command in step 309 and step 310 can be sent together with the AS security mode command in step 304 and step 306, without affecting the implementation of the present invention.

Referring to Fig. 4, the method for security algorithm negotiation provided by Embodiment 3 of the present invention includes:

The initial layer 3 message of implementation 3 is carried in the RRC request message, the MME selects the NAS security algorithm, and the eNodeB selects the AS security algorithm;

Wherein, step 401-step 404 is the same as step 201-step 204 in the first embodiment;

Step 405, the MME sends a RANAP message to the eNodeB, the message carries an initial layer 3 response message, and the initial layer 3 response message carries a first identifier indicating the selected NAS security algorithm;

Step 406, the eNodeB sends an RRC establishment message to the UE, and the message includes: an initial layer 3 response message carrying the first identifier;

Step 407, the MME creates a first AS security mode command, and sends a RANAP message to the eNodeB, the message carries the first AS security mode command, and the first AS security mode command carries algorithm information that the network allows users to use;

Step 408: The eNodeB selects the AS security algorithm according to the AS security capability and the self-supported algorithm information pre-stored by the eNodeB, or selects the AS according to the AS security capability and the algorithm information supported by the eNodeB itself in the algorithm information that the network allows users to use. security algorithm;

Step 409, the eNodeB creates a second AS security mode command, and sends an RRC message to the UE, the message carries the second AS security mode command, and the second AS security mode command carries the first identifier representing the selected AS security algorithm;

Step 410, the UE sends an RRC message to the eNodeB, and the message carries the second AS security mode command response.

Referring to FIG. 5 , the security algorithm negotiation method provided by Embodiment 4 of the present invention includes:

The initial layer 3 message of implementation 4 is carried in the RRC request message, and the initial layer 3 response information is carried in the RRC setup message, and the MME selects the NAS security algorithm and the AS security algorithm;

Step 501, the UE sends an RRC request message to the eNodeB, the request message includes: the initial layer 3 message, the initial layer 3 message carries the NAS security capability and the AS security capability; that is, two IEs need to be defined in the initial layer 3 message, and are transmitted separately AS security capabilities and NAS security capabilities;

The algorithm supported by the UE may not distinguish between the AS algorithm and the NAS algorithm, then the NAS security capability and the AS security capability are the same, and are generally referred to as the UE security capability. When the algorithm supported by the UE does not distinguish between the AS algorithm and the NAS algorithm, the initial layer 3 message carries the UE security capability, and the UE security capability can only carry one IE;

Step 502. The eNodeB sends a RANAP message to the MME. The message carries an initial layer 3 message and may also carry algorithm information supported by itself. The initial layer 3 message carries NAS security capabilities and AS security capabilities, or UE security capabilities;

Step 503: The MME selects a NAS security algorithm according to the NAS security capability of the UE and the algorithm that the network allows the user to use, or selects a NAS security algorithm according to the NAS security capability, the algorithm that the network allows the user to use, and the subscription information of the user; The capability and the algorithm information supported by the eNodeB itself in the received RANAP message, select the AS security algorithm, or select the AS security algorithm according to the AS security capability and the algorithm information supported by the eNodeB itself in the algorithm information that the network allows users to use;

Step 504: The MME creates a NAS security mode command and a third AS security mode command, and sends a RANAP message to the eNodeB. The RANAP message carries an initial layer 3 response message, a NAS security mode command, and a third AS security mode command, wherein, the NAS security mode command The mode command carries the first identification representing the selected NAS security algorithm, and the third AS security mode command carries the second identification representing the selected AS security algorithm;

Step 505, the eNodeB acquires the selected AS security algorithm according to the second identifier carried in the third AS security mode command;

Step 506, eNodeB creates a fourth AS security mode command, and sends an RRC establishment message to the UE, the message includes: the fourth AS security mode command, NAS security mode command and initial layer 3 response message; wherein, the fourth AS security mode command carries Second logo;

Step 507, the UE sends an RRC confirmation message to the eNodeB, the message carries a layer 3 confirmation message, a NAS security mode command response, and a fourth AS security mode command response;

In step 508, the eNodeB sends a RANAP message to the MME, and the message carries a layer 3 confirmation message and a NAS security mode command response.

Wherein, in step 502, the RANAP message sent by the eNodeB to the MME may not carry the algorithm information supported by itself, and the algorithm information supported by the eNodeB itself may be directly configured on the MME;

Similarly, for Embodiment 2 and Embodiment 3, the MME may also use the NAS security algorithm and the AS security algorithm to implement security algorithm negotiation, which does not affect the realization of the present invention.

Referring to FIG. 6, the method for negotiating a security algorithm provided by Embodiment 5 of the present invention includes:

Implementation 5: Connect the wireless access network first, that is, the RRC connection, and then connect to the core network. The MME selects the NAS security algorithm, and the eNodeB selects the AS security algorithm;

Step 601, the UE sends an RRC request message to the eNodeB, and the RRC request message carries the security capability of the UE;

Step 602, the eNodeB saves the security capability of the UE;

Step 603, the eNodeB sends an RRC setup message to the UE;

Step 604, the UE sends an RRC completion message to the eNodeB;

Step 605, the UE sends an initial layer 3 message to the eNodeB;

Step 606. The eNodeB sends a RANAP message to the MME. The eNodeB needs to add the UE security capability to the RANAP message, so the message includes: initial layer 3 message, UE security capability;

Step 607: The MME selects a NAS security algorithm according to the security capability of the UE and the algorithm information that the network allows the user to use, or selects a NAS security algorithm according to the security capability of the UE, the algorithm information that the network allows the user to use, and the subscription information of the user;

Step 608, the MME sends a RANAP message to the eNodeB, and the message carries: an initial layer 3 response message, and the initial layer 3 response message carries a first identifier representing the selected NAS security algorithm;

Step 609, the eNodeB sends an initial layer 3 response message to the UE, and the initial layer 3 response message carries the first identifier;

Step 610-step 613 are the same as step 407-step 410 in the third embodiment;

Referring to FIG. 7 , the security algorithm negotiation method provided by Embodiment 6 of the present invention includes:

Implementation 6 First connect the wireless access network, that is, the RRC connection, and then connect to the core network. The MME selects the NAS security algorithm, and the eNodeB selects the AS security algorithm; The response message and the AS security mode command are combined into one message and sent, while in Embodiment 5 they are sent separately;

Step 701-step 707 is the same as step 601-step 607;

Step 708: The MME creates a security mode command, and sends a RANAP message to the eNodeB, which carries: an initial layer 3 response message, and a first security mode command message, where the first security mode command message carries the selected NAS security algorithm The first identification and the algorithm information that the network allows users to use;

Step 709: The eNodeB selects an AS security algorithm according to the security capability of the UE and the pre-stored algorithm information supported by the eNodeB itself, or selects an AS security algorithm according to the security capability of the UE and the algorithm information supported by the eNodeB itself in the algorithm information that the network allows users to use. AS security algorithm;

Step 710, the eNodeB sends an RRC message to the UE, and the message carries: an initial layer 3 response message and a second security mode command, wherein the second security mode command carries the first identifier and the second identifier representing the selected AS security algorithm ;

Step 711, the UE sends an RRC message to the eNodeB, and the message carries a second security mode command response;

Step 712, the eNodeB sends a RANAP message to the MME, and the message carries the first security mode command response.

Referring to FIG. 8 , the security algorithm negotiation method provided by Embodiment 7 of the present invention includes:

Implementation Seven: Connect the wireless access network first, that is, the RRC connection, and then connect to the core network. The MME selects the NAS security algorithm, and the eNodeB selects the AS security algorithm;

Step 801-step 806 is the same as step 601-step 606;

Step 807, the MME selects a NAS security algorithm according to the algorithm that the network allows the user to adopt and the security capability of the UE, and may also consider the user's subscription information;

Step 808, the MME sends a RANAP message to the eNodeB, which carries: initial layer 3 response information, algorithm information that the network allows users to adopt, wherein the initial layer 3 response information carries the first identifier indicating the selected NAS security algorithm;

Step 809: The eNodeB selects the AS security algorithm according to the security capability of the UE and the pre-stored algorithm information supported by the eNodeB itself, or selects the AS security algorithm according to the security capability of the UE and the algorithm information supported by the eNodeB itself in the algorithm information that the network allows users to use. AS security algorithm;

In step 810, the eNodeB sends an RRC message to the UE, the RRC message carrying: the second identifier representing the selected AS security algorithm and an initial layer 3 response message, the initial layer 3 response message carrying the first identifier.

Referring to FIG. 9, the method for negotiating a security algorithm provided by Embodiment 8 of the present invention includes:

Implementation Eight First connect the wireless access network, that is, RRC connection, and then connect to the core network, and the MME selects the NAS security algorithm and the AS security algorithm;

Step 901, the UE sends an RRC request message to the eNodeB;

Step 902, the eNodeB sends an RRC setup message to the UE;

Step 903, the UE sends an RRC completion message to the eNodeB;

Step 904, the UE sends an initial layer 3 message to the eNodeB; the message includes: the security capability of the UE;

Step 905, the eNodeB sends a RANAP message to the MME, the message includes: the initial layer 3 message and the algorithm information supported by the eNodeB itself, wherein the initial layer 3 message carries the security capability of the UE;

Step 906: The MME selects a NAS security algorithm according to the security capability of the UE and the algorithm that the network allows the user to use, or selects a NAS security algorithm according to the security capability of the UE, the algorithm that the network allows the user to use, and the subscription information of the user; Select the AS security algorithm based on the security capability and the algorithm information supported by the eNodeB itself in the RANAP message, or select the AS security algorithm based on the security capability of the UE and the algorithm information supported by the eNodeB itself in the algorithm information that the network allows users to use;

Step 907: The MME sends a RANAP message to the eNodeB, and the message carries: an initial layer 3 response message and a second identifier representing the selected AS security algorithm; the initial layer 3 response message carries the first identifier representing the selected NAS security algorithm; logo;

Step 908, the eNodeB learns the AS security algorithm according to the second identifier;

In step 909, the eNodeB sends an RRC message to the UE, and the RRC message includes: an initial layer 3 response message and a second identifier; the initial layer 3 response message carries the first identifier.

Wherein, in step 905, the RANAP message sent by the eNodeB to the MME may not carry the algorithm information supported by itself, and the algorithm information supported by the eNodeB itself may be directly configured on the MME;

Similarly, for Embodiment 6 and Embodiment 7, the MME may also use the NAS security algorithm and the AS security algorithm to implement security algorithm negotiation, which does not affect the implementation of the present invention.

Wherein, the security capability of the UE may not be carried in the RRC request message, but may be carried in the RRC completion message sent by the UE to the eNodeB; or, when the security capability of the UE is divided into AS security capability and NAS security capability, the AS security capability of the UE may be Carried in the RRC request message or RRC complete message, the NAS security capability of the UE can be carried in the initial layer 3 message sent by the UE to the eNodeB, without affecting the implementation of the present invention.

Referring to FIG. 10, Embodiment 9 of the present invention provides a device for negotiating a security algorithm, which is used in a system evolution architecture/long-term evolution system. The device includes:

An information receiving unit 1001, configured to receive information about security algorithms supported by the user terminal;

A security algorithm selection unit 1002, configured to select a security algorithm according to the security algorithm information in the information receiving unit 1001;

The sending unit 1003 is configured to send the identifier representing the security algorithm selected by the security algorithm selection unit 1002 to the user terminal.

Wherein, the information receiving unit 1001, the security algorithm selection unit 1002 and the sending unit 1003 are located in the mobility management entity, and are used to negotiate the non-access stratum security algorithm. At this time,

The information receiving unit 1001 is configured to receive security algorithm information supported by the user terminal, the security algorithm information may be non-access stratum security algorithm information, and the security algorithm information may be carried by an initial layer 3 message;

The security algorithm selection unit 1002 is used to select the non-access stratum security algorithm according to the security algorithm information and the algorithm information that the network allows the user to use, and may also consider the information signed by the user;

The sending unit 1003 is configured to send to the user terminal a first identifier representing the non-access stratum security algorithm selected by the security algorithm selection unit 1002, the first identifier may be carried in the initial layer 3 response message, or may be included in the NAS mode command carry in

Wherein, the information receiving unit 1001, the security algorithm selection unit 1002 and the sending unit 1003 are located in the mobility management entity, and are used for negotiating the security algorithm of the access layer. The device also includes: an evolved base station algorithm information receiving unit 1004, an evolved base station algorithm information configuration unit 1005, of which,

The information receiving unit 1001 is configured to receive security algorithm information supported by the user terminal, the security algorithm information may be access layer security algorithm information, and the security algorithm information may be carried in the initial layer 3 message;

A security algorithm selection unit 1002, configured to select an access layer security algorithm according to the security algorithm information and the algorithm information supported by the evolved base station;

The sending unit 1003 is configured to send a second identifier representing the access layer security algorithm selected by the security algorithm selection unit 1002, and the second identifier may be carried in the third NAS security mode command;

The evolved base station algorithm information receiving unit 1004 is configured to receive the algorithm information supported by the evolved base station and output it to the security algorithm selection unit 1002;

The evolved base station algorithm information configuration unit 1005 is configured to configure the algorithm information supported by the evolved base station and output it to the security algorithm selection unit 1002 .

Wherein, the information receiving unit 1001, the security algorithm selection unit 1002 and the sending unit 1003 are located in the evolved base station, and are used to negotiate the access layer security algorithm,

The information receiving unit 1001 is configured to receive security algorithm information supported by the user terminal, the security algorithm information may be access layer security algorithm information, and the security algorithm information may be carried in the RRC request message;

A security algorithm selection unit 1002, configured to select an access layer security algorithm according to the security algorithm information and the algorithm information supported by the evolved base station;

The sending unit 1003 is configured to send the second identifier representing the security algorithm of the access layer to the user terminal.

Referring to FIG. 11, Embodiment 10 of the present invention provides a network system, which includes:

The evolved base station 1101 is configured to send security algorithm information supported by the user terminal to the mobility management entity 1102; send the first identifier from the mobility management entity 1102 to the user terminal;

The mobility management entity 1102 is configured to select a non-access stratum security algorithm according to the security algorithm information and the algorithm information that the network allows users to use, and output a first identifier representing the non-access stratum security algorithm.

When the network system needs to negotiate the access layer security algorithm, the evolved base station 1101 is also used to send the second identification from the mobility management entity 1102 to the user terminal, and obtain the access layer algorithm according to the second identification; mobility The management entity 1102 is further configured to select an access layer security algorithm according to the security algorithm information and the algorithm information supported by the evolved base station 1101 itself, and output a second identifier representing the selected access layer security algorithm.

When the network system needs to negotiate the access layer security algorithm, and when the security algorithm information is non-access layer security algorithm information, the evolved base station 1101 is also used to receive the access layer security algorithm information and forward it to the mobility management entity 1102. Send the second identifier from the mobility management entity 1102 to the user terminal, and obtain an access layer algorithm according to the second identifier; the mobility management entity 1102 is further configured to use the access layer security algorithm information and the eNB 1101 itself Supported algorithm information, select an access layer security algorithm, and output a second identifier representing the access layer security algorithm.

When the network system needs to negotiate the security algorithm of the access layer, the evolved base station 1101 is also used to select the security algorithm of the access layer according to the security algorithm information and the algorithm information supported by itself, and will indicate the second identifier of the security algorithm of the access layer sent to the user terminal.

When the network system needs to negotiate the access layer security algorithm, and when the security algorithm information is non-access layer security algorithm information, the evolved base station 1101 is also used to receive the access layer security algorithm information, according to the access layer security algorithm information information and the algorithm information supported by itself, select the security algorithm of the access layer, and send the second identifier representing the security algorithm of the access layer to the user terminal.

From the above analysis, it can be seen that in the embodiment of the present invention, the MME selects a NAS security algorithm according to the NAS security capabilities supported by the UE and the algorithm information that the network allows users to use, and sends the selected NAS security algorithm to the user terminal. One identifier, which can negotiate the NAS security algorithm in the SAE/LTE system; in the embodiment of the present invention, the MME or eNodeB selects the AS security algorithm according to the AS security capabilities supported by the UE and the algorithm information supported by the eNodeB itself, and the UE and the eNodeB select an AS security algorithm. The eNodeB obtains the second identifier representing the selected AS security algorithm, so as to achieve the purpose of negotiating the AS security algorithm in the SAE/LTE system; the embodiment of the present invention adopts the method of carrying the initial layer 3 message in the RRC request message, and the initial layer 3 message in the initial layer 3 message The NAS security capability can be carried, and the initial layer 3 response message and the first identifier can be carried in the RRC setup message, which simplifies the process and saves the time spent in negotiating the security algorithm.

The method, device, and network system for security algorithm negotiation provided by the embodiment of the present invention have been introduced in detail above. In this paper, specific examples are used to illustrate the principle and implementation of the embodiment of the present invention. The description of the above embodiment is only used To help understand the method of the embodiment of the present invention; at the same time, for those of ordinary skill in the art, according to the idea of the embodiment of the present invention, there will be changes in the specific implementation and application scope. In summary, this specification The content should not be construed as limiting the embodiments of the present invention.

Claims (19)

1. a method for secure algorithm negotiation, in system evolved framework/long evolving system, it is characterized in that, the method comprises:

User terminal sends the security algorithm information that this user terminal can be supported;

Mobility Management Entity receives the security algorithm information that described user terminal can be supported;

The algorithm information that described Mobility Management Entity allows user to use according to described security algorithm information and network, selects Non-Access Stratum security algorithm; Or, according to the algorithm information that described security algorithm information and evolution base station are supported, select Access Layer security algorithm;

Described Mobility Management Entity sends the first mark representing described Non-Access Stratum security algorithm or the second mark representing described Access Layer security algorithm to described user terminal;

Described user terminal receives described first mark or described second mark.

2. method according to claim 1, is characterized in that: described Mobility Management Entity sends described first to described user terminal and is designated:

Send described first mark to described evolution base station, described evolution base station sends described first mark to described user terminal.

3. method according to claim 2, is characterized in that:

Described evolution base station sends described first mark to described user terminal and is specially:

Described evolution base station sends Radio Resource connection establishment message to described user terminal, carries Non-Access Stratum safe mode command in described Radio Resource connection establishment message, carries described first mark in described Non-Access Stratum safe mode command.

4. method according to claim 2, is characterized in that:

Described evolution base station sends described first mark to described user terminal and is specially:

Described evolution base station sends Radio Resource connection establishment message to described user terminal, carries initiation layer 3 response message in described Radio Resource connection establishment message, carries described first mark in described initiation layer 3 response message.

5. method according to claim 1, is characterized in that:

Described security algorithm information is Non-Access Stratum security algorithm information.

6. method according to claim 1, is characterized in that:

At the algorithm information that Mobility Management Entity is supported according to described security algorithm information and evolution base station self, before selecting Access Layer security algorithm, the method also comprises:

Described Mobility Management Entity receives the algorithm information that the described evolution base station self from described evolution base station is supported.

7. method according to claim 1, is characterized in that:

At the algorithm information that Mobility Management Entity is supported according to described security algorithm information and evolution base station self, before selecting Access Layer security algorithm, the method also comprises:

Described Mobility Management Entity configures the algorithm information that described evolution base station self is supported.

8. method according to claim 1, is characterized in that: described Mobility Management Entity sends described second to described user terminal and is designated:

Send described second mark to described evolution base station, described evolution base station knows described Access Layer security algorithm according to described second mark, and sends described second mark to described user terminal.

9. method according to claim 8, is characterized in that:

Described mark to described evolution base station transmission described second is specially: send the 3rd Access Layer safe mode command of carrying described second mark to described evolution base station;

Described evolution base station sends described second mark to described user terminal and is specially:

Described evolution base station sends the 4th Access Layer safe mode command of carrying described second mark to described user terminal.

10., according to the method one of claim 1-9 Suo Shu, it is characterized in that:

The security algorithm information that described reception user terminal can be supported is specially:

Receive initiation layer 3 message from described user terminal, described initiation layer 3 message carries the security algorithm information that described user terminal can be supported.

11. methods according to claim 10, is characterized in that:

Described reception is specially from initiation layer 3 message of described user terminal:

Described evolution base station receives the Radio Resource connection request message from described user terminal, carries described initiation layer 3 message in described Radio Resource connection request message;

Described Mobility Management Entity receives described initiation layer 3 message from described evolution base station.

The method of 12. 1 kinds of secure algorithm negotiations, in system evolved framework/long evolving system, it is characterized in that, the method comprises:

User terminal sends the security algorithm information that this user terminal can be supported;

Evolution base station receives the security algorithm information that described user terminal can be supported;

The algorithm information that described evolution base station is supported according to described security algorithm information and described evolution base station self, selects Access Layer security algorithm;

Described evolution base station sends the second mark representing described Access Layer security algorithm to described user terminal;

Described user terminal receives described second mark.

13. methods according to claim 12, is characterized in that:

Described transmission to described user terminal represents that the second mark of described Access Layer security algorithm is specially:

The second Access Layer safe mode command of carrying described second mark is sent to described user terminal.

14. methods according to claim 12, is characterized in that:

The security algorithm information that described reception user terminal can be supported is specially:

Receive the security capabilities of user terminal, described security capabilities carries described Access Layer security algorithm information and Non-Access Stratum security algorithm information, and distinguishes described Access Layer security algorithm information and described Non-Access Stratum security algorithm information by mark.

15. 1 kinds of network systems, is characterized in that, this system comprises: Mobility Management Entity, user terminal, wherein,

Described Mobility Management Entity comprises:

Information receiving unit, for receiving the security algorithm information that user terminal can be supported;

Security algorithm selected cell, for the algorithm information allowing user to use according to described security algorithm information and network, selects Non-Access Stratum security algorithm; Or, for the algorithm information supported according to described security algorithm information and evolution base station, select Access Layer security algorithm;

Transmitting element, for sending the first mark representing described Non-Access Stratum security algorithm or the second mark representing described Access Layer security algorithm to described user terminal; And

Described user terminal, for sending the security algorithm information that this user terminal can be supported; Also for receiving described first mark or the second mark.

16. systems according to claim 15, is characterized in that:

Described system also comprises evolution base station, for the second mark from described Mobility Management Entity is sent to described user terminal, and obtains described Access Layer algorithm according to described second mark.

17. systems according to claim 15, when described security algorithm information is Non-Access Stratum security algorithm information, is characterized in that:

Described system also comprises evolution base station, for receiving Access Layer security algorithm information and being forwarded to described Mobility Management Entity, the second mark from described Mobility Management Entity is sent to described user terminal, and obtains described Access Layer algorithm according to described second mark.

18. 1 kinds of network systems, is characterized in that, this system comprises: evolution base station, user terminal, wherein,

Described evolution base station, comprising:

Information receiving unit, for receiving the security algorithm information that user terminal can be supported;

Security algorithm selected cell, for the algorithm information supported according to described security algorithm information and described evolution base station self, selects Access Layer security algorithm;

Transmitting element, for sending the second mark representing described Access Layer security algorithm to described user terminal; And

Described user terminal, for sending the security algorithm information that this user terminal can be supported; Also for receiving the second mark of described Access Layer security algorithm.

19. systems according to claim 18, is characterized in that:

Second of described Access Layer security algorithm is designated: the second Access Layer safe mode command.