WO2010012148A1 - Method and apparatus for safely communicating based on broadcast or multicast - Google Patents

Abstract

A method and apparatus for safely communicating based on broadcast or multicast are disclosed. The method comprises the following steps: a broadcast or multicast server encrypts the content to be transmitted in order to generate the encrypted content, and then transmits the encrypted content to each of user equipments based on broadcast or multicast; each of the user equipments receives the encrypted content transmitted based on broadcast or multicast from the broadcast or multicast server, and decrypts the encrypted content which has been received in order to retrieve the original unencrypted content.

Description

 Method and device for secure communication based on broadcast or multicast

 The present invention relates to a method and apparatus for communicating in a communication network, and more particularly to a method and apparatus for secure communication based on broadcast or multicast in a communication network. Background technique

 In the current communication network, broadcast or multicast technology is more and more widely used, and network operators can communicate with multiple users based on broadcast or multicast, which can save a lot of communication resources. Cell Broadcast Services (CBS) in a wireless communication network is a typical example. Operators can use CBS to provide the same service content to a wide range of users, such as weather forecasts, business news, traffic information, and so on. The CBS can be implemented by a Cell Broadcast CHannel (CBCH) in the cell radio channel. Many of the information provided through the CBS is either paid or subscribed, that is, the operator must be able to ensure that only the subscribers can obtain the content provided by the CBS and ensure that the billing is correctly charged; and that the unpaid subscribers who have not paid are not able to obtain the content. In general, the CBS may be a short message service (hereinafter referred to as SMS) based on a Cell Broadcast CHannel (CBCH) in a cell radio channel. The existing short messages sent in the CBCH are transmitted in plaintext, that is, in an unencrypted form. Therefore, the CBS currently broadcasting based on the cell broadcast channel through the short message cannot distinguish between the subscribed user and the unsigned user. In other words, the secure communication with the subscribed user cannot be performed.

 In the prior art, the Generic Bootstrapping Architecture (GBA) Push function defined in 3GPP TS33.223 provides a downlink peer-to-peer secure communication method. However, due to its point-to-point nature, it is not suitable for providing secure communication for point-to-multipoint broadcast or multicast based on CBS. Summary of the invention

In order to solve the problem in the prior art that security communication cannot be performed based on broadcast or multicast, The invention provides that the broadcast or multicast server encrypts the content to be sent to generate the encrypted processed content, and then sends the encrypted processed content to one or more user devices based on broadcast or multicast; each user device The encrypted processed content based on the broadcast or multicast transmission from the broadcast or multicast server is received, and the received encrypted processed content is decrypted to restore the original unencrypted content.

 Specifically, according to a first aspect of the present invention, there is provided a broadcast or multicast server in a communication network for performing one or more corresponding user equipments for use with one or more users based on broadcast or multicast. A method for secure communication, comprising the steps of: a. encrypting content to be sent to generate encrypted processed content; b. transmitting the encrypted processed content to a broadcast or multicast based on broadcast or multicast Describe one or more user devices.

 According to a second aspect of the present invention, there is provided a method for secure communication based on a broadcast or multicast with a broadcast or multicast server in a user equipment used by a user of a communication network, wherein the method comprises the following steps: A. Receiving Encrypted processed content based on broadcast or multicast transmission from the broadcast or multicast server; B. Decrypting the received encrypted processed content to restore the original unencrypted processed content.

 According to a third aspect of the present invention, there is provided a broadcast or multicast server in a communication network for securely communicating with one or more respective user devices used by one or more users based on broadcast or multicast. The device, comprising: an encryption processing device, configured to perform encryption processing on the content to be sent to generate encrypted processed content; and an encrypted content transmitting device, configured to broadcast the encrypted content based on broadcast or more Broadcast to the one or more user devices.

 According to a fourth aspect of the present invention, there is provided an apparatus for secure communication based on a broadcast or multicast with a broadcast or multicast server in a user equipment used by a user of a communication network, comprising: an encrypted content receiving apparatus, And an encryption processing device for receiving the encrypted or processed content received from the broadcast or multicast server; and performing decryption processing on the received encrypted processed content to restore the original Unencrypted content.

The method or apparatus provided by the present invention makes up for the current communication network based on broadcast or The technical gap between multicast and contracted users for secure communication, which saves a large amount of communication resources in the communication network by adopting point-to-multipoint communication, and can ensure secure communication between the operator and the contracted user, and ensure correct billing. . Preferably, the method and apparatus provided by the present invention do not require major changes to existing secure communication standards, security modules, and secure communication devices, so that the present invention is low in cost, easy to deploy, and has good commercial prospects. DRAWINGS

 The features, objects, and advantages of the present invention will become more <RTIgt; Wherein, the same reference numerals denote the same or similar elements.

 1 is a schematic diagram of a network topology of a broadcast-based secure communication between a broadcast server 1 and a plurality of mobile terminals 2a and 2b, in accordance with an embodiment of the present invention;

 2 is a flow chart of a method for broadcast-based secure communication between a broadcast server 1 and a mobile terminal 2a, in accordance with an embodiment of the present invention;

 3 is a schematic diagram showing a network topology of a broadcast-based secure communication between a broadcast server 1 and a plurality of mobile terminals 2a and 2b according to another embodiment of the present invention;

 4 is a flow chart of a method for broadcast-based secure communication between a broadcast server 1 and a mobile terminal 2a, in accordance with another embodiment of the present invention;

 5 is a block diagram showing an apparatus for performing broadcast-based secure communication between a broadcast server 1 and a mobile terminal 2a, and a working process thereof, according to still another embodiment of the present invention;

 Fig. 6 is a block diagram showing an apparatus for performing broadcast-based secure communication between the broadcast server 1 and the mobile terminal 2a and a working process thereof according to still another embodiment of the present invention. detailed description

 First, a method for securely communicating with a plurality of corresponding user devices used by a plurality of users based on broadcasts according to the present invention will be described in detail below with reference to Figs. 1 through 4.

 First embodiment

1 is a schematic diagram of a network topology of a broadcast-based secure communication between a broadcast server 1 and a plurality of mobile terminals 2a and 2b, in accordance with an embodiment of the present invention. Which should The communication network is a wireless communication network, such as a 3G wireless communication network. The network includes a broadcast server 1 for secure communication using a short message service based on CBS, mobile terminals 2a and 2b, and a content providing server (Content Provider, CP for short) 3 connected to the broadcast server 1, and an unoperated operation The merchant signs a mobile terminal 2c for secure communication. The Short Message Gateway (SMG) or Short Message Service Center (SMSC), and the base station, relay station, etc., through which the broadcast server 1 and the mobile terminal communicate securely through short messages are omitted. And other communication devices. It should be understood by those skilled in the art that the present invention is not limited to the 3G wireless communication network shown in FIG. 1 and the network topology, such as other 2G 2.5G wireless communication networks and other network topologies, and other supporting broadcasts or The present invention is equally applicable to a multicast communication network, and the applicant will also present in the specification an embodiment in which the present invention is applied to other scenarios. 2 is a flow chart of a method for broadcast-based secure communication between the broadcast server 1 and the mobile terminal 2a, in accordance with an embodiment of the present invention. The broadcast server 1 may be composed of a Cell Broadcast Center and a Cell Broadcast Equipment, and is used to broadcast the encrypted content to each mobile terminal through a cell broadcast channel.

 1 and 2, according to the present invention, the broadcast server 1 broadcasts the content encrypted by the content key to the mobile terminal, and the mobile terminal has previously possessed content decryption information working in cooperation with the content key, which can be directly The process of decrypting the content encrypted by the content key is detailed.

 First, the content providing server 3 supplies the content that needs to be provided to the subscriber to the broadcast server 1, the content may be weather forecast, business news, traffic information, etc. as described above, and the content provided to each subscriber is the same. Next, the broadcast server 1 acquires the content to be sent to the subscriber.

 In step S10, the broadcast server 1 encrypts the content to be sent to the subscriber to generate the encrypted processed content.

Specifically, in step S101, the broadcast server 1 acquires a content key for encrypting the content, wherein the content key K _sms may be based on a symmetric key (ie, the encryption key is the same as the decryption key, or is encrypted by encryption) The key can be derived from the decryption key), or it can be based on an asymmetric key (ie, the encryption key is different from the decryption key, and cannot be pushed according to the encryption key) Export the decryption key). Among them, we cite the following two cases, in which case the broadcast server 1 does not currently need to provide the content key K _sms to the mobile terminal:

A. The symmetric content key K _sms is generated by the broadcast server 1 in advance and has been provided to the mobile terminal, for example, has been solidified in the SIM (Subscriber Identity Model) card or the mobile terminal of the user, and the key is pre- If there is a broadcast server 1, the broadcast server 1 acquires the pre-stored content key K _sms ;

B. The symmetric content key K _sms is supplied to the broadcast server 1 by the content providing server 3. And also the content providing server 3 K _sms key by the content provided to the mobile terminal. In this case, the broadcast server 1 has a weak management and control function for the key;

After the content key K is acquired, in step S102, the broadcast server 1 encrypts the content to be transmitted using the acquired content key K _sms to generate the content encrypted by the content key K _sms . A specific technique for encrypting a plaintext using a key to obtain a ciphertext is well known to those skilled in the art, and the present invention does not describe it.

Then, in step S11, the broadcast server 1 transmits the content encrypted by the content key K _sms to the mobile terminal 2a based on the broadcast.

 Next, in step S20, the mobile terminal 2a receives the encrypted processed content based on the broadcast transmission from the broadcast server 1.

Specifically, the broadcast server 1 puts the content encrypted by the content key K into a short message, and provides the cell base station to which the mobile terminal 2a belongs through the short message gateway or the short message service center, and the cell of the cell base station in the cell Broadcasting the short message on the broadcast channel (CBCH); the mobile terminal 2a receives a short message containing the content encrypted by the content key K on the cell broadcast channel, and proposes to encrypt the content key K _sms content. It is to be noted that the mobile terminal 2b of the subscriber of the same cell subscribed to the same content, and the mobile terminal 2c of the non-subscriber may also receive a short message containing the content encrypted by the content key K _sms on the cell broadcast channel. It should be noted that the broadcast mode of the broadcast server 1 to broadcast the encrypted content to the mobile terminal is not limited to the embodiment, and those skilled in the art can make appropriate adjustments according to the actual wireless network under the teaching of the present invention. These modifications are intended to be within the scope of the appended claims.

Next, in step S22, the mobile terminal 2a performs the encrypted processing on the received The content is decrypted to restore the original unencrypted content

Specifically, before step S22, in step S21, the mobile terminal 2a acquires content decryption information corresponding to the content key _Ksms . Wherein, when the content key K _sms is a symmetric key, the content key K _sms is equivalent to its corresponding content decryption information; and when the content key K _{sms is an} asymmetric key, the key corresponding to the work should be obtained. Therefore, corresponding to the two cases A and B listed above:

A. The previously generated symmetric content key K _sms has been provided by the broadcast server 1 to the mobile terminal 2a before the secure communication, for example, in the user's SIM card or mobile terminal, and the mobile terminal 2a obtains the pre-stored content secret. Key K _sms ;

B, the symmetric content key K _sms has been provided to the mobile terminal 2a by the corresponding content providing server 3 before this secure communication;

Then, in step S22, the mobile terminal 2a receives the content encrypted by the content key K _sms based on the broadcast transmission from the broadcast server 1 based on the content decryption information corresponding to the content key K _sms acquired in step S21. Decrypt to restore the original unencrypted content.

Similarly, the mobile terminal 2b of the subscriber who subscribes to the same content also obtains the content decryption information corresponding to the content key K _sms in the step similar to step S21, which performs the above similar step S22, so that it can also obtain the original The content processed by the encryption; further, the user of the mobile terminal 2c cannot decrypt the received K _sms- encrypted content because it is not the subscriber of the content, and does not obtain the content decryption information corresponding to the content key K _sms The security of communication between the broadcast server 1 and the mobile terminals 2a and 2b is ensured.

 It can be understood that the mobile terminals 2a and 2b may belong to the same base station cell or may belong to different cells.

The above first embodiment broadcasts the content encrypted by the content key to the mobile terminal by the broadcast server 1, and the mobile terminal has previously possessed content decryption information working in cooperation with the content key, and can directly encrypt the content encrypted by the content key. The case of decryption is described in detail. In the following, according to the present invention, preferably, the broadcast server further adopts an encryption technology for the content key, which acquires the encrypted auxiliary information corresponding to each user, and encrypts the content key according to the encrypted auxiliary information, and then Encrypted auxiliary information encrypted content The technical solution of the key provided to the mobile terminal is described in detail.

 Second embodiment

 3 is a schematic diagram showing a network topology of a broadcast-based secure communication between a broadcast server 1 and a plurality of mobile terminals 2a and 2b according to another embodiment of the present invention. The communication network further includes a Bootstrapping Server Function-Push (BSF Push) 4 connected to the broadcast server 1 and the bootstrapping service, based on the topology shown in FIG. The Home Location Register (HLR/Home Subscriber Server, referred to as HSS) 5 is connected to the push function 4. The broadcast server 1 may include two parts, and a part is a cell broadcast service system (CBS System) composed of a cell broadcast center and a cell broadcast equipment, which is used to encrypt the content key. The content is broadcast to each mobile terminal through a cell broadcast channel; and a part is a cell broadcast service subscriber manager (CBS Subscriber Management), which encrypts the content key according to the encrypted auxiliary information, and encrypts the encrypted content key. Subscribed users who provide SMS broadcast services via SMS or other means via the Upa interface.

 4 is a flow chart of a method for broadcast-based secure communication between the broadcast server 1 and the mobile terminal 2a, in accordance with another embodiment of the present invention.

As shown in the figure, in step sior, the broadcast server 1 acquires a content key for encrypting the content. Specifically, the broadcast server 1 can be based on a random number generated at the time and the identification information of the content providing server 3, based on the symmetry. A key algorithm such as DES (Data Encryption Standard), AES (Advanced Encryption), etc. generates a content key K _sms based on symmetric encryption.

Then, the broadcast server 1 performs a similar procedure to the first embodiment described above, in S 102 ', encrypts the content provided by the content providing server 3 according to K _sms , and then in step sir, passes the content key K _sms The encrypted content is sent to the mobile terminal 2a based on the broadcast. Preferably, the broadcast server 1 puts the content encrypted by the content key K _sms into the short message and provides it to the short message gateway or the short message service center. a cell base station to which the mobile terminal 2a belongs, the cell base station broadcasts the short message on a cell broadcast channel (CBCH) in the cell; the mobile terminal 2a receives the content-containing key on the cell broadcast channel K _sms , a short message of the encrypted content, and from which the content is encrypted by the content key K _sms . It should be noted that the mobile terminal 2b of the subscriber of the same cell subscribed to the same content, and the mobile terminal 2c of the non-subscriber may also receive the short message containing the content encrypted by the content key K _sms on the cell broadcast channel. .

Next, in step S20, the mobile terminal 2a receives the encrypted content based on the broadcast transmission based on the content key K _sms from the broadcast server 1. In a similar step S20" (not shown), the mobile terminal 2b receives the encrypted content transmitted by the broadcast server based on the content key K _sms . Meanwhile, the non-subscriber mobile terminal 2c can also The encrypted content is received.

Regarding the above steps, in step S12, the broadcast server 1 acquires the encrypted auxiliary information corresponding to the user a to which the mobile terminal 2a belongs and the user b to which the mobile terminal 2b belongs, and the encrypted auxiliary information is used to encrypt the content. The key K _sms is encrypted.

 A. Specifically, in one case, the encryption assistance information is based on an asymmetric key technology. For example, the encryption assistance information corresponding to the user a is the public key of the user a, and at the same time, the user a owns the mobile terminal 2a. Working with the public key, that is, the decrypted private key, and the user b is also the same, the broadcast server 1 acquires the respective public keys of the users a and b. In a case where the broadcast server 1 locally stores the public key, it directly reads the public key; in another case, the public key is provided to the broadcast by the content providing server 3 or by another security management server. Server 1.

B. In another preferred case, the encrypted auxiliary information is a symmetric encryption key associated with the identity of users a and b, and users a and b can generate the same encryption secret based on their user identity on their mobile terminal. Key or corresponding decryption assistance information. In this case, in step S121, the broadcast server 1 requests the push information of the universal bootstrapping architecture of the user a and the user b through the _Zpn interface to the bootstrap service push function (BSF) 4 based on the GBA push technology. The push information includes identity related information for generating an encryption key Ks NAF/Ks ext NAF, Ks int NAF, AUTN and RAND in the user's quintuple authentication vector, and is used to identify U/M which is GBA_U or GBA_ME. , the life cycle of the key, the ID of the broadcast server, the private identity ID of the user, the MAC, and so on. Wherein, if the bootstrap service push function 4 does not have the identity information of the user a and/or b locally, then it is also Pentad authentication vector over Z _h interfaces to the home location register users a and / or b belongs / home subscriber server 5 requests and obtains user CK (Cipher Key), IK ( Integrity Key), RAND, RES, AUTN information And generating push information of the general bootstrapping architecture of the user a and/or b according to the CK and IK information, and then providing the push information of the users a and b to the broadcast server 1.

Then, in step S122', the broadcast server 1 generates the respective encryption keys K _cbs of the users a and b based on the acquired Ks_NAF/Ks_ext_NAF and Ks int NAF information of the users a and b.

The process in which the above broadcast server 1 interacts with the bootstrap service push function 4 to acquire the push information of the general bootstrap architecture, and generates an encryption key K _cbs related to the identity information of the user, which is used in the prior art. The process in the general bootstrap architecture of one-to-one secure communication is similar. For detailed procedures, refer to the standard 3GPP TS33.223V800, which is not described in this specification.

Next, in step S13, the broadcast server 1 encrypts the content key K _sms according to the acquired encryption auxiliary information of the users a and b, for example, its public key or its encryption key K _ebs , respectively. The content key K _sms ' encrypted with the corresponding encrypted auxiliary information of each of the users a and b is generated.

Then, in step S14, the broadcast server 1 transmits the content key K _sms encrypted with the corresponding encrypted auxiliary information of the users a and b to the mobile terminals 2a and 2b of the users a and b, respectively.

Preferably, the broadcast server 1 transmits the content key K _sms ' encrypted by the encrypted auxiliary information corresponding to the users a and b to the user & b respectively by the short message gateway or the short message service center.

Then, in step S21, and in step S21" (not shown), the mobile terminals 2a and 2b each acquire content decryption information that works in cooperation with the content key _Ksms . Hereinafter, from the perspective of the mobile terminal 2a, The mobile terminal 2b performs similar steps.

Specifically, in step S211, the mobile terminal 2a receives the content key K _sms encrypted by the encrypted auxiliary information corresponding to the user a from the broadcast server 1, and acquires the decryption auxiliary information working in cooperation with the encrypted auxiliary information. . A. In one case, corresponding to the case A above, the encrypted auxiliary information is based on an asymmetric key technology, for example, is the public key of the user a, and the mobile terminal 2a obtains the private key corresponding to the public key. as a decryption auxiliary information to a public key encryption of content key by K _sms, decrypt. It can be understood that the implementation of the asymmetric encryption technology such as the public and private keys is well known to those skilled in the art, and the present invention is not described herein. A person skilled in the art can appropriately modify the embodiment according to actual needs, and these modifications are all within the scope of the present invention.

B. In another case, corresponding to case B above, the encrypted auxiliary information is a symmetric encryption key K _cbs related to the identity of the user a, and the user a can generate the same on the mobile terminal 2a thereof. Encryption key or corresponding decryption assistance information. Specifically, in step S2111, the mobile terminal 2a generates the quintuple authentication vector CK in the same manner as the HLR/HSS according to the GBA Push information obtained from the bootstrap service push function (BSF) 4 based on the GBA psuh technology. (Cipher Key), IK (Integrity Key), RAND, RES, AUTN information, and then generate Ks NAF/Ks ext NAF, Ks int NAF information in the same way as BSF Push.

Then, in step S2112', the mobile terminal 2a generates a symmetric encryption key K _ebs or a decryption key working therewith based on the identity related information Ks NAF/Ks ext NAF . Ks int NAF . It is worth noting that the method of generating the encryption key K _ebs should correspond to the method in which the broadcast server 1 generates the encryption key K _ebs ; or it generates a decryption key method that cooperates with K _cbs , Corresponding to the method in which the broadcast server 1 generates the encryption key K _cbs , to ensure that the generated encryption key K _ebs , or the decryption key working _therewith , coincides with the encryption key K _ebs used by the broadcast server 1. In general, the consistency can be determined in advance by the user and its operator and the broadcast server, for example, being solidified in the user's SIM card or negotiated before each communication.

 The process of the above mobile terminal 2a performing authentication and interaction with the bootstrap service push function 4 to obtain the push information of the general bootstrap architecture is similar to the process in the general bootstrap architecture for one-to-one secure communication in the prior art. See 3GPP TS 33.223 V800.

It should be noted that, in the above case BB, the present invention utilizes the existing universal use by the above-mentioned interaction between the broadcast server 1 and the mobile terminal and the bootstrap service push function 4. Bootstrap architecture (GBA) push technology, which does not make major modifications to existing standards, methods and devices, can save a lot of cost. Then, the solution can be accepted by the market and has good business prospects.

Then, in step S212', the mobile terminal 2a decrypts the content key K _sms encrypted by the encrypted auxiliary information corresponding to the user a according to the acquired decryption auxiliary information, and acquires the content key K _sms ' as a corresponding Content decryption information.

Finally, in step S22 ', the mobile terminal 2a based on the content key K _sms', based on the content of the key K _sms, encrypted content is decrypted to restore the original unencrypted content processing.

Similarly, the mobile terminal 2b of the subscriber b of the content performs a similar procedure. Since the broadcast server 1 also transmits the content key K _sms encrypted by the encrypted auxiliary information corresponding to the user b to the mobile terminal 2b, The mobile terminal 2b can acquire the decryption auxiliary information that works in conjunction with the encrypted auxiliary information corresponding to the user b, and solve the content key K _sms , and then decrypt the encrypted content according to the content key K _sms to restore the original Encrypted content.

The mobile terminal 2c of the user c who does not subscribe to the content cannot receive the content key K _sms encrypted by the encryption auxiliary information corresponding _thereto , so that the content key K encrypted by the encrypted auxiliary information corresponding to other users cannot be obtained. _Sms , if decrypted, it cannot obtain the content key K _sms , and then the content encrypted according to the content key K _sms cannot be decrypted, and the original unencrypted content cannot be obtained. In this way, the security of the content communication between the broadcast server 1 and the mobile terminals 2a and 2b of the content subscription users a and b is ensured.

It should be noted that the key (Key) used for encryption, such as the content key and the encryption auxiliary information, in the present invention includes all algorithms for encrypting plaintext into ciphertext, or algorithms and their parameters, etc.; The key (Key) used for decryption, such as the content decryption information and the decryption auxiliary information, also includes all algorithms for decrypting the ciphertext encrypted by the corresponding encryption key into plaintext, or an algorithm and its parameters, etc. Wait. The specific encryption principles and methods are well known to those skilled in the art, and should fall within the scope of protection of the present invention. In the first and second embodiments mentioned above, the content to be transmitted by the broadcast server 1 is completely encrypted. It is worth noting that the present invention can also be applied to a secure communication process based on digital signatures and certificates. Specifically, the broadcast server 1 hashes the content to be sent based on a predetermined hash algorithm (heap algorithm), obtains a content digest of the content to be sent, and encrypts the content digest according to the content key K _sms ; and then, the broadcast server 1 Broadcasting the content to be transmitted to each mobile terminal in clear text, and broadcasting the content summary encrypted by the content key K _sms to each mobile terminal. The mobile terminal receives the content information broadcasted in clear text, and generates a digest of the received content information according to the same hash algorithm; the mobile terminal further receives the content digest encrypted by the content key K _sms , and according to the above A similar process in one or the second embodiment acquires content decryption information that works in conjunction with the content key K _{sms of the} broadcast server 1 to decrypt the content digest; finally, the mobile terminal compares the decrypted content digest with the self-foundation Whether the content digest generated by the received content information is the same, to determine that the content information it receives is transmitted by the broadcast server 1, and is not changed during the transmission.

 The above two embodiments have been described in detail in accordance with the present invention, a method for performing secure communication based on broadcasts of a wireless communication network. Those skilled in the art will appreciate that the present invention is equally applicable to secure communication based on multicast (multicast) of a wireless communication network. Specifically, before the multicast server sends the encrypted content to multiple user equipments based on multicast, it should first establish a multicast channel with the multiple user equipments, and then the encrypted processing will be performed in the multicast channel. The content is sent to the plurality of user equipments; correspondingly, the user equipment should also first establish a multicast channel with the multicast server, and then receive the encrypted processed content from the multicast server in the multicast channel. Other encryption/decryption processes are similar to those described in the previous section and will not be described here.

 The above is a detailed description of a method for a broadcast server to securely communicate with a plurality of corresponding user devices used by a plurality of users based on the broadcast according to the present invention. 4 and FIG. 5, a device for performing secure communication between a broadcast server and a plurality of corresponding user devices used by a plurality of users according to the present invention and a working process thereof will be described in detail based on the present invention.

 Third embodiment

1 is a broadcast server 1 and a plurality of mobile terminals in accordance with an embodiment of the present invention. A schematic diagram of a network topology structure in which the terminals 2a and 2b perform broadcast-based secure communication. 4 is a block diagram of an apparatus for performing broadcast-based secure communication between a broadcast server 1 and a mobile terminal 2a, and a working process thereof, according to still another embodiment of the present invention. The broadcast server 1 includes means 10 for securely communicating with a plurality of users or a plurality of corresponding mobile terminals based on the broadcast, the device 10 comprising an encryption processing device 101 and an encrypted content transmitting device 102, the encryption processing device 101 further comprising Content key acquisition means 1011. The mobile terminal 2a includes means 20 for secure communication with the broadcast server 1 based on the broadcast, the device 20 comprising an encrypted content receiving device 201, a second obtaining device 202 and a decryption processing device 203. The broadcast server 1 may be composed of a Cell Broadcast Center and a Cell Broadcast Equipment, which are used to broadcast the encrypted content to each mobile terminal through a cell broadcast channel.

 1 and 4, according to the present invention, the broadcast server 1 broadcasts the content encrypted by the content key to the mobile terminal, and the mobile terminal has previously possessed content decryption information working in cooperation with the content key, which can be directly The apparatus for decrypting the content encrypted by the content key and its working process are described in detail.

 First, the content providing server 3 supplies the content that needs to be provided to the subscriber to the broadcast server 1, the content may be a weather forecast or the like as described above, and the contents provided to the respective subscribers are the same. Next, the broadcast server 1 acquires the content to be sent to the subscriber.

 The encryption processing means 101 performs encryption processing on the content to be transmitted to the subscriber to generate the encrypted processed content.

The content key acquisition means 1011 acquires the content key K _sms for encrypting the content. The content key K _sms may be based on a symmetric key (ie, the encryption key is the same as the decryption key, or the decryption key may be derived by using the encryption key), or may be based on an asymmetric key (ie, encryption key and decryption) The key is different, and the decryption key cannot be derived based on the encryption key). Among them, we cite the following two cases. In both cases, the broadcast server 1 does not currently need to provide the content key K _sms to the mobile terminal:

A. The symmetric content key K _sms is generated by the broadcast server 1 in advance and has been provided to the mobile terminal, for example, has been solidified in the SIM (Subscriber Identity Model) card or the mobile terminal of the user, and the key is pre- On the broadcast server 1, The content key obtaining means 1011 obtains the pre-stored content key K _sms ;

B. The symmetric content key K _sms is supplied from the content providing server 3 to the content key obtaining means 1011. And, the content key K _{sms is also} supplied to the mobile terminal by the content providing server 3. In this case, the broadcast server 1 has a weak management and control function for the key;

After acquiring the content key K _sms , the encryption processing device 101 encrypts the content to be transmitted with the acquired content key to generate the content after the content key encryption K _sms . A specific technique for encrypting a plaintext using a key to obtain a ciphertext is well known to those skilled in the art, and the present invention does not describe it.

Then, the encrypted content transmitting device 102 transmits the content encrypted by the content key K _sms to the mobile terminal 2a based on the broadcast.

 Next, the encrypted content receiving device 201 of the device 20 of the mobile terminal 2a receives the encrypted processed content based on the broadcast transmission from the broadcast server 1.

Specifically, the encrypted content transmitting apparatus 102 puts the content encrypted by the content key K _sms into the short message, and provides the cell base station to which the mobile terminal 2 a belongs through the short message gateway or the short message service center, where the cell base station is located in the cell. The short message is broadcasted on the cell broadcast channel (CBCH); the encrypted content receiving device 201 receives the short message containing the content encrypted by the content key K _sms on the cell broadcast channel, and proposes the content key therefrom K _sms encrypted content. It is to be noted that the mobile terminal 2b of the subscriber of the same cell subscribed to the same content, and the mobile terminal 2c of the non-subscriber may also receive a short message containing the content encrypted by the content key K _sms on the cell broadcast channel. It should be noted that the manner in which the encrypted content transmitting apparatus 102 broadcasts the encrypted content to the mobile terminal is not limited to the embodiment, and those skilled in the art can make appropriate according to the actual wireless network under the teaching of the present invention. The adjustments should be within the scope of the claims of the present invention.

 Next, the decryption processing means 203 decrypts the received encrypted processed content to restore the original unencrypted content.

Specifically, the second obtaining means 202 acquires content decryption information corresponding to the content key K _sms . Wherein, when the content key K _sms is a symmetric key, the content key K _sms is equivalent to the same Corresponding content decryption information; and when the content key K _{sms is an} asymmetric key, the key to work with it should be obtained, and thus, corresponding to the three cases A, B and C listed above:

A. The previously generated symmetric content key K _sms has been provided by the broadcast server 1 to the mobile terminal 2a before the secure communication, for example, in the user's SIM card or mobile terminal, and the second obtaining means 202 obtains the pre-stored content key K _sms;

B. The symmetric content key K _sms has been provided to the second obtaining means 202 by the corresponding content providing server 3 before this secure communication.

Then, the decryption processing means 203 decrypts the content of the content key K _sms encrypted by the broadcast transmission received from the broadcast server 1 based on the content decryption information corresponding to the content key K _sms acquired by the second acquisition means 202, To restore the original unencrypted content.

Similarly, the similar encrypted content receiving device of the mobile terminal 2b of the subscriber who subscribes to the same content acquires the content decryption information corresponding to the content key K _sms , which can also be obtained by the similar second acquiring device and the decryption processing device. The encrypted processing content; further, if the user of the mobile terminal 2c does not obtain the content decryption information corresponding to the content key K _sms because the user of the content is not the subscriber of the content, the similar decryption processing device cannot The received K _sms encrypted content is decrypted to ensure the security of communication between the broadcast server 1 and the mobile terminals 2a and 2b.

 It can be understood that the mobile terminals 2a and 2b may belong to the same base station cell or may belong to different cells.

 The above third embodiment broadcasts the content encrypted by the content key to the mobile terminal by the broadcast server 1, and the mobile terminal has previously possessed the content decryption information working in cooperation with the content key, and can directly encrypt the content encrypted by the content key. The case of decryption is described in detail. In the following, according to the present invention, preferably, the broadcast server further adopts an encryption technology for the content key, which acquires the encrypted auxiliary information corresponding to each user, and encrypts the content key according to the encrypted auxiliary information, and then The technical scheme of encrypting the content key encrypted by the auxiliary information is provided to the mobile terminal for detailed description.

Fourth embodiment FIG. 3 is a schematic diagram of a network topology structure in which a broadcast server 1 and a plurality of mobile terminals 2a and 2b perform broadcast-based secure communication according to another embodiment of the present invention. Figure 6 is a block diagram showing the operation of the apparatus for performing broadcast-based secure communication between the broadcast server 1 and the mobile terminal 2a in accordance with another embodiment of the present invention. The broadcast server 1 includes means 10 for securely communicating with a plurality of respective mobile terminals used by a plurality of users, including the encryption processing means 101, the encrypted content transmitting means 102, and the first obtaining means 103. The content key encryption device 104 and the content key transmission device 105'; the encryption processing device 101 further includes a content key acquisition device 1011, and the first acquisition device 103 may further include a first push information acquisition device 1031,. The encryption processing device 101 and the encrypted content transmitting device 102 may constitute a cell broadcast service system (CBS System) composed of a cell broadcast device (Cell Broadcast Equipment) and a cell broadcast center (CBS System), which is used to The content key encrypted content is broadcast to each mobile terminal through the cell broadcast channel; and the first obtaining means 103, the content key encrypting means 104, and the content key transmitting means 105 may constitute a cell broadcast service subscriber manager (CBS Subscriber) Management), which encrypts the content key according to the encryption auxiliary information, and provides the encrypted content key to the subscribing user of the cell broadcast service via the Upa interface by SMS or other means. The mobile terminal 2a includes means 20' for secure communication with the broadcast server 1 based on the broadcast, the device 20' comprising an encrypted content receiving device 201, a second obtaining device 202, and a decryption processing device 203, the second obtaining device 202, further comprising a processing device 2021, the processing device 2021, further comprising a second push information obtaining device 20211.

As shown in the figure, the content key obtaining means 1011 obtains a content key for encrypting the content. Specifically, the content key obtaining means 1011 can be based on a random number generated at the time and the identification information of the content providing server 3. A symmetric key-based content key K _{sms is} generated based on a symmetric key algorithm such as DES (Data Encryption Standard), AES (Advanced Encryption), or the like.

Then, the broadcast server 1 performs an operation similar to that of the foregoing third embodiment, the encryption processing device 101 encrypts the content provided by the content providing server 3 according to K _sms , and then encrypts the content transmitting device 102 to pass the content key K _sms , the encrypted content is based on broadcast Sending to the mobile terminal 2a, preferably, the encrypted content transmitting device 102 puts the content encrypted by the content key K _sms into a short message and provides it to the cell to which the mobile terminal 2a belongs through the short message gateway or the short message service center. a base station, the cell base station broadcasts the short message on a cell broadcast channel (CBCH) in the cell; the mobile terminal 2a receives a short message containing the content encrypted by the content key K _sms on the cell broadcast channel, and The content encrypted by the content key K _{sms is} proposed. It should be noted that the mobile terminal 2b of the subscriber of the same cell subscribed to the same content, and the mobile terminal 2c of the non-subscriber may also receive the short message containing the content encrypted by the content key K _sms on the cell broadcast channel. .

Next, the encrypted content receiving device 201 of the device 20 of the mobile terminal 2a receives the encrypted content from the broadcast server 1 via the content key K _sms transmitted by the broadcast. Similar mobile terminal 2b encrypted content receiving apparatus receives the broadcast server based on the content of a broadcast transmission key K _sms, encrypted content. At the same time, the non-subscriber mobile terminal 2c can also receive the encrypted processed content.

The first obtaining means 103 of the device 10 of the broadcast server 1 acquires the encrypted auxiliary information corresponding to the user a to which the mobile terminal 2a belongs and the user b to which the mobile terminal 2b belongs, which is used for the encrypted auxiliary information. The content key K _sms is encrypted.

 A. Specifically, in one case, the encryption assistance information is based on an asymmetric key technology. For example, the encryption assistance information corresponding to the user a is the public key of the user a, and at the same time, the user a owns the mobile terminal 2a. Working with the public key, that is, the decrypted private key, and the user b is also the same, the broadcast server 1 acquires the respective public keys of the users a and b. In a case where the broadcast server 1 locally stores the public key, the first obtaining means 103 directly reads the public key; in another case, the public key is provided by the content providing server 3, or by other security The management server is provided to the first obtaining means 103.

B. In another preferred case, the encrypted auxiliary information is a symmetric encryption key associated with the identity of users a and b, and users a and b can generate the same encryption secret based on their user identity on their mobile terminal. Key or corresponding decryption assistance information. In this case, the first push information obtaining means 1031 of the first obtaining means 103 requests the user a and the user b from the bootstrap service push function (BSF) 4 via the _Zpn interface based on the GBA push technique. Push information of the universal bootstrapping architecture, the push information includes identity related information Ks_NAF/Ks_ext_NAF, Ks int NAF for generating an encryption key, and AUTN and RAND in the user's quintuple authentication vector for identifying GBA_U Or U/M of GBA_ME, the lifetime of the key, the ID of the broadcast server, the private ID of the user, the MAC, and so on. Wherein, if the bootstrap service no users push a local function 4 and / or identity information b, and Z _h it through an interface to a user and / or the home location register belongs b / home subscriber server requests and obtains 5 User's quintuple authentication vector CK (Cipher Key), IK (Integrity Key), RAND, RES, AUTN information, and generate push information of the general bootstrap architecture of user a and/or b according to the CK, IK information, and then The push information of the users a and b is supplied to the first push information acquiring means 1031'.

Then, the first obtaining means 103 generates the respective encryption keys K _cbs of the users a and b based on the acquired Ks NAF/Ks ext NAF . Ks_int_NAF information of the users a and b respectively.

The first push information obtaining means 1031 of the above broadcast server 1 interacts with the bootstrap service push function 4 to acquire the push information of the general bootstrapping architecture, and the first obtaining means 103 generates an encryption key related to the identity information of the user. The process of K _ebs , is similar to the process in the general bootstrap architecture for one-to-one secure communication in the prior art, and the detailed process can be referred to the standard 3GPP TS 33.223 V800, which is not described in this specification.

Next, the content key encryption device 104 encrypts the content key K _sms based on the acquired encryption auxiliary information of the users a and b, for example, its public key or its encryption key K _ebs , respectively, to generate and The content key K sms ° of each of the users a and b encrypted by the corresponding encrypted auxiliary information

Then, the content key transmitting device 105 transmits the content key K _sms encrypted by the respective encrypted auxiliary information of the users a and b to the mobile terminals 2a and 2b of the users a and b, respectively.

Preferably, the content key transmission unit 105, or the short message gateway by the short message service center by way of the short message to the user via the key K _sms a and b auxiliary information corresponding to the encrypted content encryption 'are transmitted to the user & With b.

Then, the processing device of the second acquisition device 202 of the device 20 of the mobile terminal 2a 202Γ, and similar processing devices of the mobile terminal 2b each acquire content decryption information that works in conjunction with the content key K _sms . The following description will be made from the perspective of the mobile terminal 2a.

Specifically, the processing device 2021 receives the content key K _sms encrypted by the encrypted auxiliary information corresponding to the user a from the broadcast server 1, and acquires the decryption auxiliary information that works in cooperation with the encrypted auxiliary information.

A. In one case, corresponding to the case A above, the encryption auxiliary information is based on an asymmetric key technology, for example, is the public key of the user a, and the processing device 202 obtains the private key corresponding to the public key. As the decryption auxiliary information, the content key K _sms encrypted by the public key is decrypted. It can be understood that the implementation of the asymmetric encryption technology such as the public and private keys is well known to those skilled in the art, and the present invention is not described herein. A person skilled in the art can appropriately modify the embodiment according to actual needs, and these modifications are all within the scope of the present invention.

B. In another case, corresponding to case B above, the encrypted auxiliary information is a symmetric encryption key K _cbs related to the identity of the user a, and the user a can generate the same on the mobile terminal 2a thereof. Encryption key or corresponding decryption assistance information. Specifically, the second push information obtaining means 20211 of the processing device 2021 generates a five-element in the same manner as the HLR/HSS according to the GBA Push information obtained from the bootstrap service push function (BSF) 4 based on the GBA psuh technology. The group authentication vector CK (Cipher Key), IK (Integrity Key), RAND. RES, and AUTN information are then generated in the same manner as the BSF Push function to generate Ks_NAF/Ks_ext_NAF and Ks int NAF information.

Then, the processing device 2021 generates a symmetric encryption key K _ebs according to the identity related information Ks_NAF/Ks_ext_NAF, Ks int NAF , or a decryption key working in conjunction therewith. Notably, the method that generates an encryption key K _EBS, should first acquire a broadcast server apparatus 103 generates an encryption key K _EBS, the method corresponds to; or that generates K _cbs, complex The decryption key method of the work should correspond to the method of generating the encryption key K _ebs by the first obtaining means 103 of the broadcast server 1 to ensure the generated encryption key K _cbs or the decryption key working with it. The encryption key K _ebs used by the broadcast server 1 is identical. In general, the consistency can be determined in advance by the user and its operator and the broadcast server, for example, being solidified in the user's SIM card or negotiated before each communication. The second push information obtaining means 20211, the process of authenticating and interacting with the bootstrap service push function 4 to obtain the push information of the general bootstrapping architecture, and the general bootstrapping architecture for one-to-one secure communication in the prior art The process in the process is similar, see 3GPP

 It should be noted that, in the above case BB, the present invention utilizes the existing universal bootstrapping architecture (GBA) push technology by using the above-mentioned broadcast server 1 and the interaction between the mobile terminal and the bootstrap service push function 4, which is incorrect. The existing standards, methods and devices have been greatly modified, which can save a lot of costs. Then, the solution can be accepted by the market and has good commercial prospects.

Then, the second obtaining means 202 decrypts the content key K _sms encrypted by the encrypted auxiliary information corresponding to the user a according to the acquired decryption auxiliary information, and obtains the content key K _sms ' as the corresponding content decryption information. .

Finally, the decryption processing apparatus 203, based on the content key K _sms ,, K _sms based on the content of the key, decrypts the encrypted content, in order to restore the original unencrypted content processing.

Similarly, the similar device of the mobile terminal 2b of the subscriber b of the content performs a similar operation, since the broadcast server 1 also transmits the content key K _sms encrypted by the encrypted auxiliary information corresponding to the user b to the mobile terminal 2b. The processing device of the mobile terminal 2b can acquire the decryption auxiliary information that works in conjunction with the encrypted auxiliary information corresponding to the user b, and the second obtaining device can solve the content key K _sms , and then the decryption processing device can The key K _sms , the encrypted content is decrypted to restore the original unencrypted content.

The processing device of the mobile terminal 2c of the user c who does not subscribe to the content cannot receive the content key K _sms encrypted by the encryption auxiliary information corresponding _thereto , so that the second obtaining device cannot encrypt the encryption corresponding to other users. If the content key K _sms encrypted by the information is decrypted, the content key K _sms cannot be obtained, and then the decryption processing apparatus cannot decrypt the content encrypted according to the content key K _sms , and the original original cannot be obtained. Encrypted content. In this way, the security of the content communication between the broadcast server 1 and the mobile terminals 2a and 2b of the content subscription users a and b is ensured.

Those skilled in the art will appreciate that the present invention is equally applicable to wireless communication networks. Multicast (multicast) for secure communication. Specifically, the apparatus for performing, by the multicast server, for performing secure communication with multiple corresponding user equipments used by multiple users based on the multicast, further includes a first multicast channel establishing apparatus, where a multicast channel of the user equipment, the encrypted content sending device is further configured to send the encrypted processed content to the plurality of user equipments in the multicast channel; correspondingly, the user equipment is used for the multicast-based and multicast server The apparatus for performing secure communication further includes a second multicast channel establishing apparatus for establishing a multicast channel with the multicast server, and the encrypted content receiving apparatus is configured to receive the multicast from the multicast channel. Encrypted content of the server. Other encryption/decryption processes are similar to those described in the previous section and will not be described here.

 Those skilled in the art will appreciate that the present invention is not limited to the field of wireless communications, and that the present invention is equally applicable in communication networks such as IPTV that support broadcast and/or multicast.

 The specific embodiments of the present invention have been described above. It should be noted that the present invention is not limited to the specific embodiments described above, and various modifications or changes can be made by those skilled in the art within the scope of the appended claims.

Claims

Claim A method for securely communicating with one or more respective user devices used by one or more users based on broadcast or multicast in a broadcast or multicast server in a communication network, characterized in that it comprises the following Steps:  a. The content to be sent is encrypted to generate encrypted processed content; b. The encrypted processed content is transmitted to the one or more user devices based on broadcast or multicast.  The method according to claim 1, wherein the step a comprises: - acquiring a content key for encrypting the content to be sent;  - encrypting the content to be sent with the acquired content key to generate content encrypted by the content key;  The b step includes:  - transmitting the content encrypted content key to the one or more user devices based on broadcast or multicast.  3. The method according to claim 2, wherein the method further comprises the following steps:  Obtaining one or more encrypted auxiliary information corresponding to the one or more users; ii. encrypting the content key according to the acquired one or more encrypted auxiliary information to generate a context Depicting one or more content keys encrypted by the corresponding encrypted auxiliary information corresponding to one or more users;  Iii. Send the content key encrypted by the one or more encrypted auxiliary information to the corresponding one or more user devices.  The method according to claim 3, wherein the step i further comprises: il. acquiring, by the one or more users, the encrypted auxiliary information related to the identity information of the user. The method according to any one of claims 1 to 4, wherein the communication network comprises a wireless communication network, and the broadcast or multicast service comprises a cell broadcast service based on a cell broadcast channel, the broadcast Or multicast server including cell broadcast service The user equipment includes a mobile terminal, and the step b further includes:  - transmitting the encrypted processed content to the one or more mobile terminals over a cell broadcast channel.  The method according to claim 5, wherein the step il further comprises:  - obtaining, by the bootstrap service function, push information of respective universal bootstrapping architectures associated with identity information of said one or more users;  - obtaining, according to the push information of the universal bootstrapping architecture, the respective encrypted auxiliary information of the one or more users.  The method according to claim 3, wherein the step i further comprises: il, acquiring the public key information of the one or more users as their corresponding encryption assistance information.  8. The method according to claim 7, wherein the communication network comprises a wireless communication network, the broadcast or multicast service comprises a cell broadcast service based on a cell broadcast channel, and the broadcast or multicast server comprises a cell. a broadcast server, the user equipment includes a mobile terminal, and the step b further includes:  - transmitting the encrypted processed content to the one or more mobile terminals over a cell broadcast channel.  The method according to any one of claims 5 to 8, wherein the step iii further comprises:  - transmitting the content key encrypted by the one or more encrypted auxiliary information to a corresponding one or more mobile terminals by means of a short message.  The method according to any one of claims 1 to 4, wherein the broadcast or multicast service comprises a multicast service, the broadcast or multicast server comprises a multicast server, and the step Before b, it also includes:  Establishing a multicast channel with the one or more user equipments;  The step b further includes: Transmitting the encrypted processed content to the one or more user devices over the multicast channel. 11. A method for secure communication based on broadcast or multicast with a broadcast or multicast server in a user equipment used by a user of a communication network, comprising the steps of: A. receiving encrypted processed content based on broadcast or multicast transmission from the broadcast or multicast server;  B. Decrypting the received encrypted processed content to restore the originally unencrypted content.  The method according to claim 11, wherein the encrypted processed content comprises content encrypted according to a content key, and the step B includes: I. acquiring content decryption information that works in conjunction with the content key;  The step B further includes:  - decrypting the content encrypted according to the content key based on the content decryption information to restore the original unencrypted content.  13. The method according to claim 12, wherein the step I comprises the following steps:  Receiving a content key encrypted by the encrypted auxiliary information corresponding to the user from the broadcast or multicast server, and acquiring decryption auxiliary information working in cooperation with the encrypted auxiliary information;  12. Decrypting the content key encrypted by the encryption auxiliary information corresponding to the user according to the decryption auxiliary information, and acquiring the content key as a corresponding content decryption letter The method according to claim 13, wherein the encrypted auxiliary information comprises encrypted auxiliary information related to the identity information of the user, and the step II further comprises:  - obtaining decryption assistance information associated with the identity information of the user that cooperates with the encrypted assistance information. The method according to any one of claims 11 to 14, wherein the communication network comprises a wireless communication network, and the broadcast or multicast service comprises a cell broadcast service based on a cell broadcast channel, the broadcast Or the multicast server includes a cell broadcast server, and the user equipment includes a mobile terminal, and the step further includes: Receiving the encrypted processed content over a cell broadcast channel.  The method according to claim 15, wherein the step II further comprises:  - obtaining push information of the general bootstrapping architecture related to the identity information of the user through the bootstrap service function;  - obtaining decryption assistance information related to the identity information of the user based on the push information of the universal bootstrap architecture.  The method according to claim 13, wherein the encryption assistance information includes the public key information of the user, and the step II further includes:  - Obtaining the private key information of the user working in cooperation with the public key information as the corresponding decryption assistance information.  18. The method according to claim 17, wherein the communication network comprises a wireless communication network, the broadcast or multicast service comprises a cell broadcast service based on a cell broadcast channel, and the broadcast or multicast server comprises a cell The broadcast server, the user equipment includes a mobile terminal, and the step A further includes:  Receiving the encrypted processed content over a cell broadcast channel.  The method according to any one of claims 15 to 18, wherein the step II further comprises:  Receiving a content key encrypted by the broadcast or multicast server by the short message, encrypted by the encrypted auxiliary information corresponding to the user.  The method according to any one of claims 11 to 14 and 17, wherein the broadcast or multicast service comprises a multicast service, the broadcast or multicast server comprises a multicast server, and the step Before A, it also includes:  Establishing a multicast channel with the multicast server;  The step A further includes:  Receiving the encrypted processed content over the multicast channel. An apparatus for secure communication with one or more corresponding user equipments used by one or more users based on a broadcast or multicast in a broadcast or multicast server in a communication network, comprising: An encryption processing device for performing encryption processing on the content to be transmitted to generate the encrypted processed content;  An encrypted content transmitting means for transmitting the encrypted processed content to the one or more user devices based on broadcast or multicast.  22. The device according to claim 21, wherein the encryption processing device:  a content key obtaining means, configured to acquire a content key for encrypting the content to be transmitted;  The encryption processing device is further configured to:  Encrypting the content to be sent with the obtained content key to generate content encrypted by the content key;  The encrypted content transmitting apparatus is further configured to:  The content encrypted by the content key is transmitted to the one or more user devices based on broadcast or multicast.  23. The device of claim 22, wherein the device further comprises:  a first obtaining means for acquiring one or more encrypted auxiliary information corresponding to the one or more users;  a content key encryption means for encrypting the content key based on the one or more encrypted auxiliary information that has been acquired to generate one or more corresponding ones of the one or more users Encrypting the content key encrypted by the auxiliary information;  a content key transmitting means for transmitting the content key encrypted by the one or more encrypted auxiliary information to a corresponding one or more user equipments.  The device according to claim 23, wherein the first acquiring device is further configured to:  Acquiring, for each of the one or more users, the encryption assistance information associated with the identity information of the user. The apparatus according to any one of claims 21 to 24, wherein the communication network comprises a wireless communication network, and the broadcast or multicast service comprises a cell based a cell broadcast service of the broadcast channel, the broadcast or multicast server includes a cell broadcast server, the user equipment includes a mobile terminal, and the encrypted content sending apparatus is further configured to: send the encrypted processed content through a cell broadcast channel To the one or more mobile terminals.  The device according to claim 25, wherein the first obtaining device further comprises:  a first push information obtaining means, configured to obtain, by the bootstrap service function, the push information of the respective universal bootstrapping architecture related to the identity information of the one or more users; the first obtaining means is further configured to:  And obtaining, according to the push information of the universal bootstrap architecture, the encrypted auxiliary information of the one or more users.  The device according to claim 23, wherein the first acquiring device is further configured to:  The respective public key information of the one or more users is obtained as its corresponding encryption auxiliary information.  28. The apparatus according to claim 27, wherein the communication network comprises a wireless communication network, the broadcast or multicast service comprises a cell broadcast service based on a cell broadcast channel, and the broadcast or multicast server comprises a cell a broadcast server, the user equipment includes a mobile terminal, and the encrypted content sending apparatus is further configured to:  The encrypted processed content is transmitted to the one or more mobile terminals over a cell broadcast channel.  The device according to any one of claims 25 to 28, wherein the content key transmitting device is further configured to:  The content key encrypted by the one or more encrypted auxiliary information is transmitted to the corresponding one or more mobile terminals by means of a short message.  The apparatus according to any one of claims 21 to 24, wherein the broadcast or multicast service comprises a multicast service, the broadcast or multicast server comprises a multicast server, the device Also includes: a first multicast channel establishing means for establishing with said one or more user equipment Multicast channel between;  The encrypted content transmitting apparatus is further configured to:  The encrypted processed content is transmitted to the one or more user devices over the multicast channel.  31. An apparatus for secure communication based on a broadcast or multicast with a broadcast or multicast server in a user equipment used by a user of a communication network, comprising:  An encrypted content receiving device for receiving encrypted processed content based on broadcast or multicast transmission from said broadcast or multicast server;  a decryption processing means for performing decryption processing on the received encrypted processed content to restore the original unencrypted processed content.  The device according to claim 31, wherein the encrypted processed content comprises content encrypted according to a content key, the device further comprising:  a second obtaining means, configured to acquire content decryption information that works in conjunction with the content key;  The decryption processing device is further configured to:  The content encrypted according to the content key is decrypted according to the content decryption information to restore the original unencrypted content.  33. The apparatus according to claim 32, wherein the second obtaining means comprises:  a processing device, configured to receive a content key encrypted by the encrypted auxiliary information corresponding to the user from the broadcast or multicast server, and acquire decryption auxiliary information working in cooperation with the encrypted auxiliary information;  The second obtaining device is further configured to:  Decrypting the content key encrypted by the encryption auxiliary information corresponding to the user according to the decryption assistance information, and acquiring the content key as the corresponding content decryption information.  The device according to claim 33, wherein the encryption assistance information includes encryption assistance information related to the identity information of the user, and the processing device is further configured to: Obtaining, related to the identity information of the user, matching with the encrypted auxiliary information Decryption assistance information for work.  The apparatus according to any one of claims 31 to 34, wherein the communication network comprises a wireless communication network, and the broadcast or multicast service comprises a cell broadcast service based on a cell broadcast channel, the broadcast Or the multicast server includes a cell broadcast server, the user equipment includes a mobile terminal, and the encrypted content receiving apparatus is further configured to: receive the encrypted processed content by using a cell broadcast channel.  36. The device according to claim 35, wherein the processing device further comprises:  a second push information obtaining means for obtaining push information of the general bootstrapping architecture related to the identity information of the user through the bootstrap service function;  The processing device is further configured to:  Decryption assistance information related to the identity information of the user is obtained according to the push information of the universal bootstrap architecture.  The device according to claim 33, wherein the encryption assistance information includes public key information of the user, and the processing device is further configured to:  The private key information of the user working with the public key information is obtained as the corresponding decryption auxiliary information.  38. The apparatus according to claim 37, wherein the communication network comprises a wireless communication network, the broadcast or multicast service comprises a cell broadcast service based on a cell broadcast channel, and the broadcast or multicast server comprises a cell a broadcast server, the user equipment includes a mobile terminal, and the encrypted content receiving apparatus is further configured to:  The encrypted processed content is received over a cell broadcast channel.  The device according to any one of claims 35 to 38, wherein the processing device is further configured to:  Receiving a content key encrypted by the broadcast or multicast server by the short message, encrypted by the encrypted auxiliary information corresponding to the user. 40. The apparatus according to any one of claims 31 to 34 and 37, wherein the broadcast or multicast service comprises a multicast service, the broadcast or multicast server comprises a multicast server, the device Also includes: a second multicast channel establishing means for establishing a multicast channel with said multicast server;  The encrypted content receiving device is further configured to:  The encrypted processed content is received over the multicast channel.  A network server, comprising the apparatus according to claims 21 to 30.  42. A user equipment, characterized in that it comprises a device according to claims 31 to 40.