WO2011098048A1 - Radio node accessing network method, system and relay node - Google Patents

Abstract

The embodiments in the present invention provide a radio node accessing a network method, a system and a relay node. In the radio node accessing a network method, the system and the relay node of the embodiments in the present invention, the authentication between the relay node and a donor evolved NodeB, a home subscriber server, or a mobility management entity is performed by carrying a certificate in messages exchanged between the relay node and the donor evolved NodeB, the home subscriber server, or the mobility management entity; a shared key similar to the one used when a user equipment accesses a network is calculated according to a Diffie Hell-man (DH) parameter exchanged between the relay node and the donor evolved NodeB, the home subscriber server, or the mobility management entity; and finally a radio bearer is established between the relay node and the donor evolved NodeB. Accordingly, the authentication method based on a certificate when a relay node accesses a network is implemented, and it is safer for a relay node at a network side to access a network.

Description

 Wireless node access method, system and relay node The present application claims to be filed on February 12, 2010 in the Chinese Patent Office, the application number is 201010111422.8, and the invention is entitled "Wireless Node Access Method, System and Relay Node" Priority is hereby incorporated by reference in its entirety. Technical field

 The present invention relates to the field of communications technologies, and in particular, to a wireless node access method, system, and relay node. Background of the invention

 A relay node (Relay Node, RN for short) is introduced in the Long Term Evolution - Advanced (LTE-A). The RN is used to improve the throughput of the communication cell edge and facilitate the temporary network of operators or users. The requirements for deployment, as well as support for group mobility. The RN can be deployed in hotspots or blind spots in rural areas, cities, indoors, and the like.

 In the existing Radio Access Network (RAN), when the RN accesses the network, the RN is similar to an additional User Equipment (UE). Therefore, when the RN enters the network, the certificate-based authentication method cannot be implemented. Summary of the invention

 The purpose of the embodiments of the present invention is to provide a wireless node access method, system, and relay node, so as to implement a certificate-based authentication method when the RN enters the network.

 The embodiment of the invention provides a wireless node network access method, including:

Transmitting the certificate of the relay node and the Diffie-Herman of the relay node to the donor base station during a radio resource control connection establishment process between the relay node and the donor base station integrated with the home subscriber server a parameter, such that the donor base station pairs the relay section according to a certificate of the relay node Point for authentication;

 Receiving, by the donor base station, a certificate of the donor base station and a Diffie-Hellman parameter of the donor base station, and authenticating the donor base station according to the certificate of the donor base station;

 If the relay node and the donor base station are successfully authenticated, calculating a base key K according to a Diffie-Hellman parameter of the relay node and a Diffie-Hellman parameter of the donor base station;

 Performing authentication and key negotiation with the mobility management entity based on the basic key K; performing non-access stratum security mode control with the mobility management entity, and performing access layer security mode control with the donor base station, establishing and A radio bearer between the donor base stations.

 The embodiment of the invention further provides a relay node, including:

 a sending module, configured to send, in the process of establishing a radio resource control connection between the relay node and the donor base station integrated with the home subscriber server, the certificate of the relay node and the relay node of the relay node a Philippine-Hellman parameter, such that the donor base station authenticates the relay node according to a certificate of the relay node;

 Receiving an authentication module, configured to receive a certificate of the donor base station sent by the donor base station and a Diffie-Hellman parameter of the donor base station, and perform authentication on the donor base station according to the certificate of the donor base station;

 a calculation module, configured to: according to the Diffie-Hellman parameter of the relay node and the Diffie-Hier of the donor base station received by the receiving module, if the relay node and the donor base station are successfully authenticated The base parameter calculation base key K;

 a bearer establishing module, configured to perform authentication and key negotiation with the mobility management entity based on the basic key K calculated by the computing module, and configured to perform non-access stratum security mode control with the mobility management entity, and The access layer security mode control between the donor base stations establishes a wireless bearer with the donor base station.

 The embodiment of the invention further provides a wireless node network access system, comprising: a mobility management entity, a donor base station integrated with a home subscriber server, and a relay node as described above,

The donor base station integrated with the home subscriber server is configured to receive the sending by the relay node a certificate of the relay node and a Diffie-Hellman parameter of the relay node, and transmitting a certificate of the donor base station and a Diffie-Hellman parameter of the donor base station to the relay node; Calculating the base key K according to a Diffie-Hellman parameter of the relay node and a Diffie-Hellman parameter of the donor base station; an access layer key calculated according to the base key K, Performing access layer security mode control with the relay node;

 The mobility management entity is configured to obtain an authentication vector calculated by the donor base station integrated with the home subscriber server based on the basic key K, and perform authentication and key negotiation with the relay node according to the authentication vector; And used for non-access stratum security mode control with the relay node according to the non-access stratum key calculated by the basic key K.

 The embodiment of the invention further provides a wireless node network access method, including:

 Transmitting, by the donor base station, a certificate of the relay node and a Diffie-Hellman parameter of the relay node by the donor base station during a radio resource control connection establishment process between the relay node and the donor base station, So that the home subscriber server authenticates the relay node according to the certificate of the relay node;

 Receiving, by the donor base station, a certificate of the home subscriber server sent by the home subscriber server and a Diffie-Hellman parameter of the home subscriber server, and using the certificate of the home subscriber server to the home subscriber server Authenticate;

 If the relay node and the home subscriber server are successfully authenticated, calculating a base key according to the Diffie-Hellman parameter of the relay node and the Diffie-Hellman parameter of the home subscriber server

K;

 Performing authentication and key negotiation with the mobility management entity based on the basic key K; performing non-access stratum security mode control with the mobility management entity, and performing access layer security mode control with the donor base station, establishing and A radio bearer between the donor base stations.

 The embodiment of the invention further provides a relay node, including:

a sending module, configured to send, by the donor base station, a certificate of the relay node to the home subscriber server and the foregoing, in a process of establishing a radio resource control connection between the relay node and the donor base station a Diffie-Hellman parameter of the relay node, so that the home subscriber server authenticates the relay node according to the certificate of the relay node;

 Receiving an authentication module, configured to receive, by the donor base station, a certificate of the home subscriber server sent by the home subscriber server and a Diffie-Hellman parameter of the home subscriber server, and according to the certificate of the home subscriber server Authenticating the home subscriber server;

 a calculation module, configured to: according to the Diffie-Hellman parameter of the relay node and the Diffy of the home subscriber server received by the receiving module, if the relay node and the home subscriber server are successfully authenticated - Herman parameter calculation base key K;

 a bearer establishing module, configured to perform authentication and key negotiation with the mobility management entity based on the basic key K calculated by the computing module, and configured to perform non-access stratum security mode control with the mobility management entity, and The donor base station performs access layer security mode control to establish a radio bearer with the donor base station.

 The embodiment of the invention further provides a wireless node network access system, comprising: a mobility management entity, a home subscriber server, a donor base station, and a relay node as described above,

 The home subscriber server is configured to receive a certificate of the relay node sent by the relay node and a Diffie-Hellman parameter of the relay node, and send the certificate of the home subscriber server and the Calculating the basis of the Diffie-Hellman parameter of the home server to the relay node; calculating the basis according to the Diffie-Hellman parameter of the relay node and the Diffie-Hellman parameter of the home subscriber server Key K;

 The mobility management entity is configured to acquire an authentication vector calculated by the home subscriber server based on the basic key K, perform authentication and key negotiation with the relay node according to the authentication vector, and use the a non-access stratum key calculated by the base key K, and performing non-access stratum security mode control with the relay node;

The donor base station is configured to acquire an access layer key calculated by the home subscriber server based on the basic key K, and perform access layer security mode control with the relay node according to the access layer key. . The embodiment of the invention further provides a wireless node network access method, including:

 Complete establishment of a radio resource control connection between the relay node and the donor base station;

 Sending an attach request message carrying the certificate of the relay node and the Diffie-Hellman parameter of the relay node to a mobility management entity integrated with a home subscriber server, so that the mobility management entity is according to the middle Passing the certificate of the node to authenticate the relay node;

 Receiving, by the mobility management entity, a non-access stratum message carrying a certificate of the mobility management entity and a Diffie-Hellman parameter of the mobility management entity, and managing the mobility according to the certificate of the mobility management entity Entity for authentication;

 And if the relay node and the mobility management entity are successfully authenticated, calculating a shared key according to a Diffie-Hellman parameter of the relay node and a Diffie-Hellman parameter of the mobility management entity;

 And performing non-access stratum security mode control with the mobility management entity based on the shared key, and performing access layer security mode control with the donor base station to establish a radio bearer with the donor base station.

 The embodiment of the invention further provides a relay node, including:

 a connection establishing module, configured to complete establishment of a radio resource control connection between the relay node and the donor base station;

 a sending module, configured to send an attach request message carrying a certificate of the relay node and a Diffie-Hellman parameter of the relay node to a mobility management entity integrated with a home subscriber server, to enable the mobility management Entity authenticating the relay node according to the certificate of the relay node;

 Receiving an authentication module, configured to receive, by the mobility management entity, a non-access stratum message carrying a certificate of a mobility management entity and a Diffie-Hellman parameter of the mobility management entity, and according to the mobility management entity The certificate authenticates the mobile management entity;

 a calculation module, configured to: according to the Diffie-Hellman parameter of the relay node and the Diffy of the mobile management entity received by the receiving module, if the relay node and the mobility management entity are successfully authenticated - Herman parameters calculate the shared key;

a bearer establishing module, configured to calculate the shared key based on the computing module, and The mobility management entity performs non-access stratum security mode control, and performs access layer security mode control with the donor base station to establish a radio bearer with the donor base station.

 The embodiment of the invention further provides a wireless node network access system, comprising: a mobility management entity integrated with a home subscriber server, a donor base station, and a relay node as described above,

 The mobility management entity integrated with the home subscriber server is configured to receive a certificate of the relay node sent by the relay node and a Diffie-Hellman parameter of the relay node, and send the mobility management entity a certificate and a Diffie-Hellman parameter of the mobility management entity to the relay node; a Diffie-Hellman parameter of the relay node and a Diffie-Hellman parameter of the mobility management entity Calculating the shared key; performing the non-access stratum security mode control with the relay node according to the non-access stratum key calculated by the shared key;

 The donor base station is configured to acquire an access layer key calculated by the mobility management entity integrated with the home subscriber server based on the shared key, and connect to the relay node according to the access layer key Intrusion security mode control.

 The embodiment of the invention further provides a wireless node network access method, including:

 Transmitting the certificate of the relay node and the Diffie-Hell of the relay node to the donor base station in a process of establishing a radio resource control connection and/or establishing a radio bearer between the relay node and the donor base station a Manchester parameter, such that the donor base station authenticates the relay node according to a certificate of the relay node;

 Receiving, by the donor base station, a certificate of the donor base station and a Diffie-Hellman parameter of the donor base station, and authenticating the donor base station according to the certificate of the donor base station;

 If the relay node and the donor base station are successfully authenticated, calculate an authentication key AK according to the Diffie-Hellman parameter of the relay node and the Diffie-Hellman parameter of the donor base station;

 The authentication key AK is used as a temporary key KeNB shared by the relay node and the donor base station, and based on the temporary key KeNB, performs access layer security mode control with the donor base station.

The embodiment of the invention further provides a relay node, including: a sending module, configured to send, by the donor base station, a certificate of the relay node and the relay node in a process of establishing a radio resource control connection and/or establishing a radio bearer between the relay node and the donor base station a Diffie-Hellman parameter, such that the donor base station authenticates the relay node according to the certificate of the relay node;

 Receiving an authentication module, configured to receive a certificate of the donor base station sent by the donor base station and a Diffie-Hellman parameter of the donor base station, and perform authentication on the donor base station according to the certificate of the donor base station;

 a calculation module, configured to: according to the Diffie-Hellman parameter of the relay node and the Diffie-Hier of the donor base station received by the receiving module, if the relay node and the donor base station are successfully authenticated The Manchester parameter calculation authentication key AK;

 a bearer establishing module, configured to use the authentication key AK calculated by the calculating module as a temporary key KeNB shared by the relay node and the donor base station, and based on the temporary key KeNB, The donor base station performs access layer security mode control.

 The embodiment of the invention further provides a wireless node network access system, comprising: a donor base station and a relay node as described above,

 The donor base station is configured to receive a certificate of the relay node sent by the relay node and a Diffie-Hellman parameter of the relay node, and send the certificate of the donor base station and the donor base station a Diffie-Hellman parameter to the relay node; calculating the authentication key AK according to the Diffie-Hellman parameter of the relay node and the Diffie-Hellman parameter of the donor base station; The authentication key AK is used as the temporary key KeNB shared by the relay node and the donor base station, and performs access layer security mode control with the relay node according to the temporary key KeNB.

 The embodiment of the invention further provides a wireless node network access method, including:

After completing the process of establishing a radio resource control connection and establishing a radio bearer between the relay node and the donor base station, transmitting an Internet Key Exchange Security Association Initial Negotiation Request message to the donor base station, and receiving the Internet replied by the donor base station The key exchange security association initial negotiation response message to exchange the Diffie-Hellman parameter of the relay node and the Diffie-Hellman parameter of the donor base station, The Diffie-Hellman parameter is used to negotiate a security protection alliance between the relay node and the donor base station;

 Sending an Internet Key Exchange Authentication Request message to the donor base station, where the Internet Key Exchange Authentication Request message carries information requesting a certificate of the donor base station;

 Receiving an Internet Key Exchange Authentication Response message carrying the certificate of the donor base station returned by the donor base station, and authenticating the donor base station according to the certificate of the donor base station, where the Internet Key Exchange Authentication Response message is further Carrying information requesting a certificate of the relay node;

 And transmitting, by the donor base station, an Internet Key Exchange Authentication Response message carrying a certificate of the relay node, so that the donor base station authenticates the relay node according to a certificate of the relay node.

 The embodiment of the invention further provides a relay node, including:

 a parameter exchange module, configured to send an Internet Key Exchange Security Association Initial Negotiation Request message to the donor base station after completing the process of establishing a radio resource control connection and establishing a radio bearer between the relay node and the donor base station, and receiving the Determining an Internet Key Exchange Security Association Initial Negotiation Response message replied by the donor base station to exchange a Diffie-Hellman parameter of the relay node and a Diffie-Hellman parameter of the donor base station, the Diffie- The Herman parameter is used to negotiate a security protection alliance between the relay node and the donor base station;

 a first sending module, configured to send an Internet Key Exchange Authentication Request message to the donor base station, where the Internet Key Exchange Authentication Request message carries information requesting a certificate of the donor base station; and receiving an authentication module, configured to receive Determining, by the donor base station, an Internet Key Exchange Authentication Response message carrying the certificate of the donor base station, and authenticating the donor base station according to the certificate of the donor base station, where the Internet Key Exchange Authentication Response message further carries a request Information of the certificate of the relay node;

a second sending module, configured to send, to the donor base station, an Internet Key Exchange Authentication Response message carrying a certificate of the relay node, so that the donor base station sends the relay node according to a certificate of the relay node Certify. An embodiment of the present invention further provides a wireless node network access system, including: a donor base station and a relay node as described above,

 The donor base station is configured to receive the Internet Key Exchange Security Association Initial Negotiation Request message sent by the relay node, and return the Internet Key Exchange Security Association Initial Negotiation Response message to the relay node, to Exchanging a Diffie-Hellman parameter of the relay node and a Diffie-Hellman parameter of the donor base station, the Diffie-Hellman parameter being used to negotiate the relay node and the donor base station a security protection alliance between the two; receiving the Internet Key Exchange Authentication Request message sent by the relay node, where the Internet Key Exchange Authentication Request message carries information requesting a certificate of the donor base station; The relay node returns the Internet Key Exchange Authentication Response message carrying the certificate of the donor base station, where the Internet Key Exchange Authentication Response message further carries information requesting the certificate of the relay node; receiving the relay The Internet key exchange authentication response message sent by the node carrying the certificate of the relay node, and according to the certificate of the relay node Said relay node authentication.

 According to the above technical solution, the wireless node network access method, system, and relay node according to the embodiment of the present invention carry a relay by carrying a certificate in a message exchanged between the relay node and the donor base station or the home subscriber server or the mobility management entity. Authentication between the node and the donor base station or the home subscriber server or the mobility management entity, and calculating the shared secret similar to the user equipment when accessing the network through the DH parameters exchanged between the relay node and the donor base station or the home subscriber server or the mobility management entity The key is used to establish a radio bearer between the relay node and the donor base station, thereby implementing a certificate-based authentication method for the relay node to access the network, and making the network-side relay node more secure. BRIEF DESCRIPTION OF THE DRAWINGS

 FIG. 1 is a schematic flowchart diagram of a first embodiment of a wireless node network access method according to the present invention;

 2 is a signaling flowchart of a second embodiment of a wireless node network access method according to the present invention;

 FIG. 3 is a signaling flowchart of a third embodiment of a wireless node network access method according to the present invention;

4 is a schematic structural diagram of a first embodiment of a relay node according to the present invention; 5 is a schematic structural diagram of a first embodiment of a wireless node network access system according to the present invention; FIG. 6 is a schematic flowchart of a fourth embodiment of a wireless node network access method according to the present invention;

 7 is a signaling flowchart of a fifth embodiment of a wireless node network access method according to the present invention;

 8 is a schematic structural diagram of a second embodiment of a relay node according to the present invention;

 9 is a schematic structural diagram of a second embodiment of a wireless node network access system according to the present invention;

 FIG. 10 is a schematic flowchart diagram of a sixth embodiment of a wireless node network access method according to the present invention; FIG.

 11 is a signaling flowchart of a seventh embodiment of a wireless node network access method according to the present invention;

 12 is a schematic structural diagram of a third embodiment of a relay node according to the present invention;

 13 is a schematic structural diagram of a third embodiment of a wireless node network access system according to the present invention;

 14 is a schematic flowchart of an eighth embodiment of a wireless node network access method according to the present invention;

 15 is a signaling flowchart of a ninth embodiment of a wireless node network access method according to the present invention;

 16 is a signaling flowchart of a tenth embodiment of a wireless node network access method according to the present invention;

 17 is a signaling flowchart of an eleventh embodiment of a wireless node network access method according to the present invention;

 18 is a schematic structural diagram of a fourth embodiment of a relay node according to the present invention;

 19 is a schematic structural diagram of a fourth embodiment of a wireless node network access system according to the present invention;

 20 is a schematic flowchart diagram of a twelfth embodiment of a wireless node network access method according to the present invention;

 21 is a schematic structural diagram of a fifth embodiment of a relay node according to the present invention;

 FIG. 22 is a schematic structural diagram of a fifth embodiment of a wireless node network access system according to the present invention. Mode for carrying out the invention

 The technical solutions in the embodiments of the present invention are clearly and completely described in the following with reference to the accompanying drawings in the embodiments of the present invention. It is obvious that the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention.

FIG. 1 is a schematic flowchart diagram of a first embodiment of a wireless node network access method according to the present invention. As shown in Figure 1, the following steps are included: Step 101: A radio resource between a relay node (RN) and a donor base station (Doner Node B, DeNB for short) integrated with a Home Subscriber Server (HSS) In the process of establishing a Radio Resource Control (RRC) connection, the RN's certificate and the RN's Diffie Hell-man (DH) parameter are sent to the DeNB, so that the DeNB performs the RN according to the RN's certificate. Certification.

 Step 102: The RN receives the DeNB certificate sent by the DeNB and the DH parameter of the DeNB, and performs authentication on the DeNB according to the certificate of the DeNB.

 In the foregoing steps 101 and 102, the RN and the DeNB respectively send their own certificates to the peer to implement certificate-based authentication between the RN and the DeNB.

 Step 103: If the RN and the DeNB are successfully authenticated, calculate the basic key K according to the DH parameter of the RN and the DH parameter of the DeNB.

The basic key Κ is similar to the basic key carried in the Universal Subscriber Identity Module (USIM) of the UE when the UE enters the traditional LTE. In this step 103, K=KDF(K _DH ); In addition, the DeNB also calculates the base key K according to the DH parameter of the RN and the DH parameter of the DeNB, that is, the same algorithm is used to generate the base on the DeNB side. Key K.

 Step 104: Perform authentication and key agreement (AKA) with the Mobile Management Entity (MME) based on the basic key, and perform non-access stratum with the MME (Non-Access Stratum) The NAS is referred to as the Security Mode Control (SMC), and performs an Access Stratum (AS) SMC with the DeNB to establish a radio bearer between the RN and the DeNB.

In this step 104, since the base key K is generated by both the RN side and the DeNB side integrated with the HSS, and the authentication vector calculated according to the basic key K is subsequently performed, the AKA process between the RN and the MME is performed, according to the basic key. K calculates the obtained non-access stratum key, performs the NAS SMC process, and calculates the obtained access stratum key based on the basic key K, and performs AS SMC between the RN and the DeNB. The process is similar to the process in which the UE enters the network in the legacy LTE. The RN is similar to the process in the LTE in the LTE, and the process of establishing the RN and the security mode is not described herein.

 The wireless node network access method provided in this embodiment carries the certificate between the RN and the DeNB integrated with the HSS function in the RRC connection establishment process, and performs authentication between the RN and the DeNB, and passes the RN and the DeNB. The DH parameter exchanged between the two is similar to the basic key K carried in the USIM card when the UE enters the network, and finally completes the establishment of the radio bearer between the RN and the DeNB, thereby implementing the certificate-based authentication method when the RN enters the network, and making the network Side RN access to the network is more secure.

 FIG. 2 is a signaling flowchart of a second embodiment of a wireless node network access method according to the present invention. In this embodiment, the DeNB and the HSS are integrated on the same entity. In the process of establishing an RRC connection, the RN uses the air interface message to carry the certificate and the key negotiation parameter, and negotiates the basic key K between the RN and the DeNB/HSS, and then the RN. Based on the basic key K, the AKA is mutually authenticated with the MME, and the subsequent SMC process is completely consistent with the existing SMC process of the legacy UE entering the network. As shown in FIG. 2, the method for accessing the wireless node includes the following steps:

 Step 201: The RN sends an RRC connection setup request message to the DeNB integrated with the HSS function, where the RRC connection setup request message carries information such as the certificate of the RN and the DH parameter of the RN, so that the DeNB authenticates the RN according to the certificate of the RN.

 The RRC Connection Setup Request message may also carry an Authentication (AUTH) parameter, which is used to prove that the secret associated with the entity's own ID is known, while protecting the previous and current data packets.

 Step 202: After receiving the RRC connection setup request message, the DeNB sends an RRC connection setup message to the RN that sends the message, where the RRC connection setup message carries information such as the DeNB certificate and the DH parameter of the DeNB, according to the DeNB certificate pair. The DeNB performs authentication.

The RRC connection setup message may also carry an AUTH parameter, which is used to prove that the secret associated with the entity's own ID is known, while protecting the previous and current data packets. In this step 202, the HSS integrated on the DeNB can also allocate an international RN to the RN. An International Subscriber Identity (IMSI), if assigned, the IMSI is also sent to the RN along with the foregoing RRC Connection Setup message to uniquely identify the RN.

 Step 203: The RN and the DeNB respectively calculate and generate the basic key K locally according to the DH parameter of the RN and the DH parameter of the DeNB in the two messages in the foregoing steps 201 and 202.

The basic key Κ is similar to the basic key K carried in the USIM card of the UE when the UE enters the legacy LTE.

 Step 204: The RN sends an RRC connection setup complete message to the DeNB, where the RRC connection setup complete message carries a NAS attach request message.

 Step 205: The DeNB forwards the NAS attach request message of the RN to the MME.

 Step 206: The MME finds that the RN is attached, initiates the AKA authentication process, and first sends an authentication data request message to the HSS.

 Step 207: The HSS sends the authentication vector calculated according to the basic key K to the MME, and the authentication vector may include {RAND, XRES, KASME, AUTN}.

 Step 208: After obtaining the authentication vector, the MME sends an authentication request to the RN, and carries the AUTN and XRES for authentication and the RAND required to calculate the key.

 Step 209: The MME receives the authentication response carrying the RES returned by the RN, and verifies the RES in the authentication response, so as to complete the AKA authentication between the RN and the MME.

 Step 210: The SMC process is performed by using the SMC to perform the negotiation of the NAS encryption algorithm between the RN and the MME. The SMC process is the same as the SMC process when the UE enters the traditional LTE network.

 Step 211: The MME sends an initial context setup message of the RN to the DeNB, where the initial context setup message carries the AS key calculated in the AKA authentication process between the RN and the MME.

 Step 212: The SMC process is performed by using the SMC to perform the AS-Secure algorithm between the DeNB and the RN. The SMC process is the same as the SMC process in the traditional LTE when the UE enters the network.

Step 213: Perform a radio bearer setup process between the RN and the DeNB, and complete the RN network access authentication. The length of the RRC connection setup request message or the RRC connection setup message is limited. Therefore, in step 201 and step 202, the certificate of the RN and/or the certificate of the DeNB may also be replaced by a certificate identifier with a shorter bit length. Not the certificate itself. When the RRC connection setup request message or the RRC connection setup message carries the certificate identifier instead of the certificate itself, the entity receiving the message needs to complete the registration association (RA) / certificate center (Certificate). The association, referred to as CA, interacts to obtain the content of the certificate indicated by the certificate identifier, and then authenticates the certificate-based content of the peer.

 The method for the network access of the wireless node provided in this embodiment describes the signaling procedure of the certificate authentication between the RN and the DeNB integrated with the HSS. The RRC connection setup request message carries the certificate of the RN, and is carried in the RRC connection setup message. The certificate of the DeNB performs certificate-based authentication between the RN and the DeNB, and exchanges DH parameters through an RRC connection setup request message and an RRC connection setup message between the RN and the DeNB, and calculates a basic value similar to that carried by the USIM card when the UE enters the network. The key K is used to complete the establishment of the radio bearer between the RN and the DeNB, thereby implementing a certificate-based authentication method for the RN to access the network, and making the network-side RN more secure.

 FIG. 3 is a signaling flowchart of a third embodiment of a wireless node network access method according to the present invention. In this embodiment, the DeNB and the HSS are integrated on the same entity, and the RN carries the information required for the key negotiation in the RRC connection setup request message, and the RN carries the AUTH parameter of the DeNB in the RRC connection setup complete message to verify The transmitted RRC Connection Setup Request message. As shown in Figure 3, the following steps are included:

 Step 301: The RN carries information such as a certificate of the RN and a DH parameter of the RN in an RRC connection setup request message sent by the DeNB integrated with the HSS function.

 Step 302: The DeNB calculates and obtains the basic key K according to the received DH parameter of the RN and the DH parameter of the local DeNB, and calculates an AUTH parameter according to the K, and sends an RRC connection setup message to the RN, where the RRC connection setup message is carried. The certificate of the DeNB, the DH parameter of the DeNB, and the AUTH parameter are used to authenticate the DeNB according to the certificate of the DeNB.

In this step 302, the HSS integrated on the DeNB may also allocate an IMSI to the RN. If assigned, the IMSI is also sent to the RN along with the aforementioned RRC Connection Setup message to uniquely identify the RN. The basic key K is similar to the basic key K, K=KDF(K _DH ) carried in the USIM card of the UE when the UE enters the traditional LTE.

 Step 303: The RN sends an RRC connection setup complete message to the DeNB, where the RRC connection setup complete message carries the AUTH parameter of the RN to the DeNB, so that the DeNB completes the authentication of the RRC connection setup request message sent before the RN according to the value, and After the authentication succeeds, the RN is authenticated according to the RN's certificate. The RRC connection setup complete message also carries the NAS attach request message of the RN.

 Step 304: The RN calculates and generates the base key K locally according to the DH parameter of the RN and the DH parameter of the DeNB in the message in the foregoing steps 301 to 303.

The basic key Κ is similar to the basic key K carried in the USIM card of the UE when the UE enters the traditional LTE network.

 Step 305: The DeNB forwards the NAS attach request message of the RN to the MME.

 Step 306: The MME finds that the RN is attached, initiates the AKA authentication process, and first sends an authentication data request message to the HSS.

 Step 307: The HSS sends the authentication vector calculated according to the basic key K to the MME, and the authentication vector may include {RAND, XRES, KASME, AUTN}.

 Step 308: After obtaining the authentication vector, the MME sends an authentication request to the RN, and carries the AUTN and XRES for authentication and the RAND required to calculate the key.

 Step 309: The MME receives the authentication response carrying the RES returned by the RN, and verifies the RES in the authentication response to complete the AKA authentication between the RN and the MME.

 Step 310: Perform a negotiation of the NAS encryption algorithm between the RN and the MME by using the SMC. The SMC process is the same as the SMC process when the UE enters the traditional LTE network in the prior art.

 Step 311: The MME sends an initial context setup message of the RN to the DeNB, where the initial context setup message carries the AS key calculated in the AKA authentication process between the RN and the MME.

Step 312: Perform, by using the SMC, negotiation of an AS secret algorithm between the DeNB and the RN, where The SMC process is the same as the SMC process in the prior art when the UE enters the traditional LTE network.

 Step 313: Perform a radio bearer setup process between the RN and the DeNB, and complete the RN network access authentication.

 Since the length of the RRC connection setup request message or the RRC connection setup message is limited, in step 301, step 302, the RN certificate and/or the DeNB certificate may also be replaced by a certificate identifier with a shorter bit length instead of The certificate itself. When the RRC connection establishment request message or the RRC link setup message carries the certificate identifier instead of the certificate itself, the entity receiving the message needs to complete the interaction with the RA/CA to obtain the certificate indicated by the certificate identifier. And then perform peer-based certificate-based authentication.

 The wireless node network access method provided in this embodiment describes the signaling process of the certificate authentication between the RN and the DSS integrated with the HSS. The embodiment obtains the same beneficial effects as the second embodiment of the wireless node network access method. The certificate-based authentication method is implemented when the RN enters the network, so that the network-side RN is more secure.

FIG. 4 is a schematic structural diagram of a first embodiment of a relay node according to the present invention. As shown in FIG. 4, the relay node includes: a sending module 41, a receiving authentication module 42, a calculating module 43, and a bearer establishing module 44. The sending module 41 is configured to send, in the process of establishing a radio resource control connection of the relay node and the donor base station integrated with the home subscriber server, the certificate of the relay node and the relay node to the donor base station. a Diffie-Hellman parameter, so that the donor base station authenticates the relay node according to the certificate of the relay node; and the receiving authentication module 42 is configured to receive the donor base station sent by the donor base station a certificate and a Diffie-Hellman parameter of the donor base station, and authenticating the donor base station according to the certificate of the donor base station; and a calculating module 43, configured to: if the relay node and the donor base station are successfully authenticated And calculating a base key K according to the Diffie-Hellman parameter of the relay node and the Diffie-Hellman parameter of the donor base station received by the receiving module 42; the bearer establishing module 44 is configured to The basic key K calculated by the calculating module 43 is used for authentication and key negotiation with the mobility management entity, and is used for performing non-access stratum security mode control with the mobility management entity, and The donor base station performs access layer security mode control, and establishes with the donor base station Wireless bearer.

 For the relay node provided in this embodiment, the specific method for implementing the wireless node network access is described in the foregoing method embodiment. In the RRC connection establishment process, the message exchanged between the RN and the DeNB integrated with the HSS function carries the certificate, and the RN is performed. Authenticating with the DeNB, and calculating the basic key K carried in the USIM card when the UE enters the network, by using the DH parameters exchanged between the RN and the DeNB, and finally completing the establishment of the radio bearer between the RN and the DeNB, thereby implementing the RN. The certificate-based authentication method is adopted when accessing the network, and the network-side RN is more secure.

 FIG. 5 is a schematic structural diagram of a first embodiment of a wireless node network access system according to the present invention. As shown in FIG. 5, the method includes: a mobility management entity 51, a donor base station 52 integrated with a home subscriber server, and a relay node 53. The relay node 53 is as described in the first embodiment of the foregoing relay node, and details are not described herein again. The donor base station 52 integrated with the home subscriber server is configured to receive the certificate of the relay node sent by the relay node 53 and the Diffie-Hellman parameter of the relay node, and send the donor a certificate of the base station and a Diffie-Hellman parameter of the donor base station to the relay node 53; a Diffie-Hellman parameter according to the relay node and a Diffie-Hermann of the donor base station The parameter calculates the base key K; and performs an access layer security mode control with the relay node 53 according to the access layer key calculated by the base key K. The mobility management entity 51 is configured to acquire an authentication vector calculated by the donor base station 52 integrated with the home subscriber server based on the basic key K, and perform authentication and confidentiality with the relay node 53 according to the authentication vector. Key negotiation; and for the non-access stratum key calculated according to the basic key K, and performing non-access stratum security mode control with the relay node 53.

 The wireless node network access system provided in this embodiment, and the specific method for implementing the wireless node network access, refer to the foregoing method embodiment, where the certificate is carried in the message exchanged between the RN and the DeNB integrated with the HSS function in the RRC connection establishment process. The authentication between the RN and the DeNB, and the DH parameter exchanged between the RN and the DeNB, is similar to the basic key K carried in the USIM card when the UE enters the network, and finally completes the establishment of the radio bearer between the RN and the DeNB. The certificate-based authentication method is adopted when the RN accesses the network, and the network-side RN is more secure.

FIG. 6 is a schematic flowchart diagram of a fourth embodiment of a wireless node network access method according to the present invention. As shown in Figure 6, Including the following steps:

 Step 601: In the RRC connection establishment process between the RN and the DeNB, the DeNB sends the RN certificate and the DH parameter of the RN to the HSS, so that the HSS authenticates the RN according to the RN certificate.

 Step 602: The RN receives the HSS certificate sent by the HSS and the DH parameter of the HSS through the DeNB, and authenticates the HSS according to the HSS certificate.

 In the above steps 601 and 602, the RN and the HSS respectively send their own certificates to the peer to implement certificate-based authentication between the RN and the HSS.

 Step 603: If the RN and the HSS are successfully authenticated, the basic key K is calculated according to the DH parameter of the RN and the DH parameter of the HSS.

The basic key Κ is similar to the basic key carried in the Universal Subscriber Identity Module (USIM) of the UE when the UE enters the traditional LTE. In this step 603, K=KDF(K _DH ); in addition, the HSS also calculates the base key K according to the DH parameter of the RN and the DH parameter of the HSS, that is, the same algorithm is used to generate the base key on the DeNB side. K.

 Step 604: Perform a MME based on the base key ΑΚΑ, perform a NAS SMC with the MME, and perform an AS SMC with the DeNB to establish a radio bearer between the RN and the DeNB.

 In this step 604, the RN side generates the basic key K, and the subsequent authentication vector calculated according to the basic key K performs an AKA process between the RN and the MME, and the non-access stratum calculated according to the basic key K. The key, performs the NAS SMC process, and performs the AS SMC process between the RN and the DeNB according to the access layer key calculated by the basic key K. The process is similar to the process of the UE entering the traditional LTE network, and the RN is similar to the traditional LTE. The UE in the process of completing the RN network access authentication and security mode establishment is not described here.

The wireless node network access method provided in this embodiment carries the certificate between the RN and the HSS in the RRC connection establishment process, performs authentication between the RN and the HSS, and performs DH exchange between the RN and the HSS. The calculation is similar to the USIM card carried when the UE enters the network. The basic key K, which finally completes the establishment of the radio bearer between the RN and the DeNB, thereby implementing the certificate-based authentication method when the RN enters the network, and making the network-side RN more secure.

 FIG. 7 is a signaling flowchart of a fifth embodiment of a wireless node network access method according to the present invention. In this embodiment, the HSS is an independent physical entity, rather than being located on the DeNB. The RN and the HSS still pass the certificate authentication, and negotiate the basic key K. The DeNB forwards the corresponding message between the RN and the HSS. As shown in FIG. 7, the method for accessing the wireless node includes the following steps:

 Step 701: The RN sends an RRC connection setup request message to the DeNB, where the RRC connection setup request message carries information such as a certificate of the RN, a DH parameter of the RN, and an AUTH parameter.

 Step 702: The DeNB forwards the information of the RN, the DH parameter, and the AUTH parameter of the RN in the received RRC connection setup request message to the HSS, so that the HSS authenticates the RN according to the certificate of the RN.

 Step 703: The HSS sends a message carrying the certificate of the HSS, the DH parameter of the HSS, and the AUTH parameter to the DeNB.

 Step 704: After receiving the certificate of the HSS, the DH parameter of the HSS, and the AUTH parameter, the DeNB sends an RRC connection setup message to the RN, where the RRC connection setup message carries the HSS certificate, the DH parameter of the HSS, and the AUTH parameter, according to the HSS. The certificate certifies the HSS.

 In this step, the HSS may allocate an IMSI to the RN. If allocated, the DeNB also sends the IMSI to the RN in an RRC Connection Setup message to uniquely identify the RN.

 Step 705: The RN and the HSS calculate the generated base key K locally according to the DH parameter of the RN and the DH parameter of the HSS in the message in the above steps 501 to 504, respectively.

The basic key Κ is similar to the basic key K carried in the USIM card of the UE when the UE enters the legacy LTE.

 Step 706: The RN sends an RRC connection setup complete message to the DeNB, where the RRC connection setup complete message carries a NAS attach request message.

 Step 707: The DeNB forwards the NAS attach request message of the RN to the MME.

Step 708: The MME finds that the RN is attached, and starts the AKA authentication process, first to the HSS. Issue an authentication data request message.

 Step 709: The HSS sends the authentication vector calculated according to the basic key K to the MME, and the authentication vector may include {RAND, XRES, KASME, AUTN}.

 Step 710: After obtaining the authentication vector, the MME sends an authentication request to the RN, and carries the AUTN and XRES for authentication and the RAND required to calculate the key.

 Step 711: The MME receives the authentication response carrying the RES returned by the RN, and verifies the RES in the authentication response to complete the AKA authentication between the RN and the MME.

 Step 712: Perform a negotiation of the NAS encryption algorithm between the RN and the MME by using the SMC. The SMC process is the same as the SMC process when the UE enters the traditional LTE network in the prior art.

 Step 713: The MME sends an initial context setup message of the RN to the DeNB, where the initial context setup message carries the AS key calculated in the AKA authentication process between the RN and the MME.

 Step 714: The SMC process is performed by using the SMC to perform the AS confidentiality algorithm between the DeNB and the RN. The SMC process is the same as the SMC process when the UE enters the traditional LTE network in the prior art.

 Step 715: Perform a radio bearer setup process between the RN and the DeNB, and complete the RN network access authentication.

 Since the length of the RRC connection setup request message or the RRC connection setup message is limited, in steps 701-704, the certificate of the RN and/or the certificate of the HSS may also be replaced by a certificate identifier having a shorter bit length. Not the certificate itself. When the RRC connection establishment request message or the RRC link setup message carries the certificate identifier instead of the certificate itself, the entity receiving the message needs to complete the interaction with the RA/CA to obtain the certificate indicated by the certificate identifier. And then perform peer-based certificate-based authentication.

In the wireless node network access method provided by this embodiment, the DeNB and the HSS are two separate entities. This embodiment describes the signaling process of the certificate authentication between the RN and the HSS in detail, and carries the RN in the RRC connection setup request message. The certificate carries the certificate of the HSS in the RRC connection setup message, performs certificate-based authentication between the RN and the HSS, and exchanges DH parameters between the RRC connection establishment request message and the RRC connection setup message between the RN and the HSS, and the calculation is similar. Enter in UE The basic key K carried in the network-time USIM card finally completes the establishment of the radio bearer between the RN and the DeNB, thereby implementing a certificate-based authentication method for the RN to access the network, and making the network-side RN more secure.

 FIG. 8 is a schematic structural diagram of a second embodiment of a relay node according to the present invention. As shown in FIG. 8, the relay node includes: a sending module 81, a receiving authentication module 82, a calculating module 83, and a bearer establishing module 84. The sending module 81 is configured to send, by the donor base station, the certificate of the relay node and the relay node to the home subscriber server during a radio resource control connection establishment process between the relay node and the donor base station. a Diffie-Hellman parameter, such that the home subscriber server authenticates the relay node according to the certificate of the relay node; and a receiving authentication module 82, configured to receive the home subscriber server by using the donor base station Transmitting the certificate of the home subscriber server and the Diffie-Hellman parameter of the home subscriber server, and authenticating the home subscriber server according to the certificate of the home subscriber server; The relay node and the home subscriber server are successfully authenticated, and then calculated according to the Diffie-Hellman parameter of the relay node and the Diffie-Hellman parameter of the home subscriber server received by the receiving module 82. a base key K; a bearer establishing module 84, configured to calculate the base key K based on the calculation module 83, and mobility management Body authentication and key agreement; and a non-access stratum security mode control and the mobility management entity, a security mode control access layer and the donor base station, and establish a radio bearer between the donor base station.

 For the relay node provided in this embodiment, the specific method for implementing the wireless node accessing network is as shown in the foregoing method embodiment. In the RRC connection establishment process, the message exchanged between the RN and the HSS carries the certificate, and the RN and the HSS are performed. Authentication, and through the DH parameters exchanged between the RN and the HSS, the calculation is similar to the basic key K carried in the USIM card when the UE enters the network, and finally completes the establishment of the radio bearer between the RN and the DeNB, thereby implementing the certificate based on the RN entering the network. The authentication method makes the network side RN more secure.

FIG. 9 is a schematic structural diagram of a second embodiment of a wireless node network access system according to the present invention. As shown in FIG. 9, the method includes: a mobility management entity 91, a home subscriber server 92, a donor base station 93, and a relay node 94. The relay node 94 is as described in the second embodiment of the foregoing relay node, and details are not described herein again. The home subscriber server 92 is configured to receive a certificate of the relay node sent by the relay node 94 and a Diffie-Hellman parameter of the relay node, and send a certificate of the home subscriber server and Defi-Herman parameter of the home subscriber server to the relay node 94; calculating according to the Diffie-Hellman parameter of the relay node and the Diffie-Hellman parameter of the home subscriber server The base management key 91 is configured to acquire an authentication vector calculated by the home subscriber server 92 based on the basic key K, and perform authentication with the relay node 94 according to the authentication vector. Negotiating with the key; and for non-access stratum key calculation according to the basic key K, performing non-access stratum security mode control with the relay node 94; the donor base station 93, configured to acquire the The home subscriber server 92 performs access layer security mode control with the relay node 94 based on the access layer key calculated based on the base key K.

 For the wireless node network access system provided in this embodiment, the specific method for implementing the wireless node network access is described in the foregoing method embodiment. In the RRC connection establishment process, the message exchanged between the RN and the HSS carries a certificate between the RN and the HSS. The authentication, and the DH parameter exchanged between the RN and the HSS, is similar to the basic key K carried in the USIM card when the UE enters the network, and finally completes the establishment of the radio bearer between the RN and the DeNB, thereby implementing the certificate based on the certificate when the RN enters the network. The authentication method of the network side makes the network side RN more secure.

 FIG. 10 is a schematic flowchart diagram of a sixth embodiment of a wireless node network access method according to the present invention. In this embodiment, the HSS and the MME are integrated on the same entity. As shown in Figure 10, the following steps are included:

 Step 1001: Complete an RRC connection establishment between the RN and the DeNB.

 Step 1002: The RN sends an attach request message carrying the certificate of the RN and the DH parameter of the RN to the MME integrated with the HSS, so that the MME authenticates the RN according to the certificate of the RN.

 Step 1003: The RN receives the non-access stratum message that is sent by the MME and carries the certificate of the MME and the DH parameter of the MME, and authenticates the MME according to the certificate of the MME.

Step 1004: If the RN and the MME are successfully authenticated, the shared key is calculated according to the DH parameter of the RN and the DH of the MME. The MME calculates the shared key according to the DH parameter of the RN and the DH parameter of the MME. Step 1005: Based on the shared key, the RN performs NAS SMC with the MME, and performs AS SMC with the DeNB to establish a radio bearer between the RN and the DeNB.

 The process of performing the AS SMC between the RN and the DeNB according to the non-access stratum key calculated by the shared key, performing the NAS SMC process, and calculating the obtained access layer key according to the shared key, the process is similar to the UE In the process of the traditional LTE network access, the RN completes the process of establishing the RN network access authentication and the security mode, similar to the UE in the traditional LTE, and is not described here.

 The wireless node network access method provided in this embodiment performs the authentication between the RN and the MME by carrying the certificate in the message exchanged between the RN and the MME integrated with the HSS, and calculates the DH parameter exchanged between the RN and the MME. Similar to the shared key carried in the USIM card when the UE enters the network, the radio bearer between the RN and the DeNB is finally established, thereby implementing the certificate-based authentication method when the RN enters the network, and making the network-side RN more secure.

 FIG. 11 is a signaling flowchart of a seventh embodiment of a wireless node network access method according to the present invention. This embodiment is a specific signaling procedure of the foregoing sixth embodiment, and the HSS and the MME are integrated on the same entity. As shown in Figure 11, the following steps are included:

 Step 1101: The RN initiates an RRC connection setup request message to the DeNB.

 Step 1102: The DeNB sends an RRC connection setup message to the RN.

 Step 1103: The RN returns an RRC connection setup complete message to the DeNB.

 Step 1104: The RN sends a NAS attach request message to the MME integrated with the HSS, where the NAS attach request message carries the certificate of the RN and the DH parameter of the RN.

 Step 1105: The MME sends an IMSI request message to the RN, where the IMSI request message carries the certificate of the MME, the DH parameter of the MME, and the AUTH parameter used for the authentication.

 In this step 1105, the HSS integrated on the MME may also allocate an IMSI to the RN. If allocated, the IMSI is also carried in the foregoing IMSI request message and sent to the RN to uniquely identify the RN.

Step 1106: After receiving the certificate of the MME, the RN completes the authentication of the MME, and then the IMSI. The AUTN parameter carried in the response message is sent to the MME, so that the MME performs certificate authentication on the RN according to the certificate of the RN sent in step 1104.

Step 1107: The authentication RN and the MME respectively calculate the shared key K1, K1=KDF(K _DH ) according to the DH parameter of the RN and the DH parameter of the MME.

 The subsequent security process is completed between the RN and the MME based on the shared key K1, and specifically includes two scenarios:

 A) Use the shared key K1 as the base key for AKA authentication K:

 Step 1108a: The MME integrated with the HSS function calculates an authentication vector according to the basic key K, and the authentication vector may include {RAND, XRES, KASME, AUTN}.

 B) Use the shared key Kl as the root key KASME:

 Step 1108b: The MME integrated with the HSS function obtains an authentication vector including the root key KASME from the HSS, and the authentication vector may include {RAND, XRES, KASME, AUTN}.

 Step 1109: After obtaining the authentication vector, the MME sends an authentication request to the RN, and carries the AUTN and XRES for authentication and the RAND required to calculate the key.

 Step 1110: The MME receives the authentication response carrying the RES returned by the RN, and verifies the RES in the authentication response to complete the AKA authentication between the RN and the MME.

 Step 1111: Perform a negotiation of the NAS encryption algorithm between the RN and the MME by using the SMC. The SMC process is the same as the SMC process when the UE enters the traditional LTE network in the prior art.

 Step 1112: The MME sends an initial context setup message of the RN to the DeNB, where the initial context setup message carries the AS key calculated in the AKA authentication process between the RN and the MME.

 Step 1113: The SMC process is performed by using the SMC to perform the AS confidentiality algorithm between the DeNB and the RN. The SMC process is the same as the SMC process in the traditional LTE when the UE enters the network.

 Step 1114: Perform a radio bearer setup process between the RN and the DeNB, and complete the RN network access authentication.

Since the length of the attach request message or the IMSI request message is limited, in step 1104 to step 1105, the certificate of the RN and/or the certificate of the MME may also consider a certificate with a shorter bit length. Instead of the certificate itself, the entity receiving the message needs to first complete the interaction with the RA/CA to obtain the content of the certificate indicated by the certificate identifier, and then authenticate the certificate-based content of the peer.

 The method for the network access of the wireless node provided in this embodiment describes the signaling procedure of the certificate authentication between the RN and the MME integrated with the HSS, which is similar to the sixth embodiment of the method for accessing the wireless node, and can also implement the certificate based on the RN when accessing the network. The authentication method and make the network side RN more secure.

 FIG. 12 is a schematic structural diagram of a third embodiment of a relay node according to the present invention. As shown in FIG. 12, the relay node includes: a connection establishing module 121, a sending module 122, a receiving authentication module 123, a computing module 124, and a bearer establishing module 125. The connection establishing module 121 is configured to complete the establishment of the radio resource control connection between the relay node and the donor base station, and the sending module 122 is configured to send the certificate carrying the relay node and the Diffie-He of the relay node. The attach request message of the Manchester parameter to the mobility management entity integrated with the home subscriber server, so that the mobility management entity authenticates the relay node according to the certificate of the relay node; and receives the authentication module 123 for receiving a non-access stratum message carried by the mobility management entity carrying a certificate of a mobility management entity and a Diffie-Hellman parameter of the mobility management entity, and the mobile management entity according to a certificate of the mobility management entity Performing an authentication; the calculating module 124, configured to: according to the Diffie-Hellman parameter of the relay node and the mobile terminal received by the receiving module 123, if the relay node and the mobility management entity are successfully authenticated The Diffie-Hellman parameter of the management entity calculates a shared key; a bearer establishment module 125 is configured to calculate based on the calculation module 124 Said shared key, non-secure mode access control layer and the mobility management entity, and the access layer security mode control and the donor base station, establishing a radio bearer between the donor and the base station.

For the relay node provided in this embodiment, the specific method for implementing the wireless node network access is described in the foregoing method embodiment, and the certificate is carried in the message exchanged between the RN and the MME integrated with the HSS, and the authentication between the RN and the MME is performed, and The DH parameter exchanged between the RN and the MME is similar to the shared key carried in the USIM card when the UE enters the network, and finally the radio bearer between the RN and the DeNB is established, thereby implementing a certificate-based authentication method when the RN accesses the network, and Make the network side RN into The network is more secure.

 FIG. 13 is a schematic structural diagram of a third embodiment of a wireless node network access system according to the present invention. As shown in FIG. 13, the method includes: a mobility management entity 131 integrated with a home subscriber server, a donor base station 132, and a relay node 133. The relay node 133 is as described in the foregoing third embodiment of the relay node, and details are not described herein again. The mobility management entity 131 integrated with the home subscriber server is configured to receive the certificate of the relay node sent by the relay node 133 and the Diffie-Hellman parameter of the relay node, and send the mobility management a certificate of the entity and a Diffie-Hellman parameter of the mobility management entity to the relay node 133; a Diffie-Hellman parameter of the relay node and a Diffie-Hier of the mobility management entity a shared key; the non-access stratum key calculated according to the shared key, and the non-access stratum security mode control with the relay node 133; the donor base station 132, configured to Obtaining an access layer key calculated by the mobility management entity integrated with the home subscriber server based on the shared key, and performing an access layer security mode control with the relay node 133 according to the access layer key.

 The wireless node network access system provided in this embodiment, and the specific method for implementing the wireless node network access, as described in the foregoing method embodiment, carries the authentication between the RN and the MME by carrying the certificate in the message exchanged between the RN and the MME integrated with the HSS. And the DH parameter exchanged between the RN and the MME is used to calculate a shared key that is carried in the USIM card when the UE enters the network, and finally completes the establishment of the radio bearer between the RN and the DeNB, thereby implementing a certificate-based authentication method when the RN enters the network. Moreover, the network side RN is more secure.

 FIG. 14 is a schematic flowchart diagram of an eighth embodiment of a wireless node network access method according to the present invention. As shown in Figure 14, the following steps are included:

 Step 1401: In the process of establishing an RRC connection and/or establishing a radio bearer between the RN and the DeNB, send the certificate of the RN and the DH parameter of the RN to the DeNB, so that the DeNB authenticates the RN according to the certificate of the RN.

Step 1402: Receive a DeNB certificate sent by the DeNB and a DH parameter of the DeNB, and perform authentication on the DeNB according to the certificate of the DeNB. In step 1401 - step 1402, the RN and the DeNB respectively send their own certificates to the peer to implement certificate authentication between the RN and the DeNB.

 Step 1403: If the RN and the DeNB are successfully authenticated, calculate the authentication key AK according to the DH parameter of the RN and the DH parameter of the DeNB.

 The DeNB calculates the authentication key according to the DH parameter of the RN and the DH parameter of the DeNB.

AK.

 Step 1404: The authentication key AK is used as a temporary key KeNB shared by the RN and the DeNB, and based on the temporary key KeNB, performs AS SMC with the DeNB.

 In the wireless node network access method provided by this embodiment, in the process of establishing an RRC connection and/or establishing a radio bearer between the RN and the DeNB, the message exchanged between the RN and the DeNB carries a certificate between the RN and the DeNB. Authentication, and through the DH parameters exchanged between the RN and the DeNB, calculate the temporary key KeNB calculated when the UE enters the network, and finally complete the establishment of the radio bearer between the RN and the DeNB, thereby implementing certificate-based authentication when the RN enters the network. The method makes the network side RN more secure.

 FIG. 15 is a signaling flowchart of a ninth embodiment of a wireless node network access method according to the present invention. In this embodiment, the RN and the DeNB do not need to perform signaling interaction with the HSS to perform calculation of the basic key K, only need to pass certificate authentication between the RN and the DeNB, and perform calculation of the temporary key KeNB between the RN and the DeNB. And using the generated temporary key KeNB to protect the AS message between the RN and the DeNB. As shown in Figure 15, the following steps are included:

 Step 1501: The RN initiates an RRC connection setup request message to the DeNB to which the RN belongs, and the RRC connection setup request message carries information such as a certificate of the RN, a random number (nonce) 1, a DH parameter of the RN, and an AUTH parameter, so that the DeNB according to the RN The certificate authenticates the RN. The random number is to make the shared key obtained in the subsequent calculation different every time.

The RN's certificate can also be considered instead of a certificate with a shorter bit length than the certificate itself. When the RRC connection setup request message carries the certificate identifier instead of the certificate itself, the method further includes: Step 1501: The RN needs to complete the message interaction with the RA/CA. To get the content of the certificate indicated by the certificate identifier. Then, the authentication of the peer-based certificate-based content is performed.

 Step 1502: The DeNB returns an RRC connection setup message to the RN, where the RRC connection setup message carries information such as a certificate of the DeNB, a random number (nonce) 2, a DH parameter of the DeNB, and an AUTH parameter, so that the RN performs the DeNB according to the certificate of the DeNB. Certification.

 The DeNB's certificate can also be considered instead of a certificate with a shorter bit length than the certificate itself. When the RRC connection setup message in the above step 1502 carries the certificate identifier instead of the certificate itself, the method further includes: Step 1502: The DeNB needs to complete the message interaction with the RA/CA to obtain the content of the certificate indicated by the certificate identifier. . Then, the authentication of the peer-based certificate-based content is performed.

 Step 1503: The RN and the DeNB respectively calculate and generate the authentication key AK according to the DH parameter of the RN and the DH parameter of the DeNB in the two messages in the step 1501 and the step 1502, and use the authentication key AK as the temporary key. The KeNB calculates an encryption key and an integrity protection key of the AS signaling.

Where AK=KDF(K _DH ).

 Step 1504: The RN initiates an RRC connection setup complete message to the DeNB to which the RN belongs, and carries a NAS attach request message.

 Step 1505: The DeNB to which the RN belongs forwards the NAS attach request message to the MME.

 Step 1506: The MME sends an initial context setup message of the RN to the DeNB.

 Step 1507: The AS SMC process is performed between the DeNB and the RN to which the RN belongs, and the AS algorithm negotiation between the DeNB and the RN is completed, and the AS protection is activated.

 Step 1508: Perform a radio bearer setup process between the RN and the DeNB, and complete the RN network access authentication.

 In this embodiment, only the certificate authentication and the AS security protection between the RN and the DeNB to which it belongs are implemented, and the NAS protection method is not concerned.

The wireless node network access method provided in this embodiment describes the certificate between the RN and the DeNB in detail. The signaling process of the book authentication is similar to the eighth embodiment of the wireless network access method, and the certificate-based authentication method for the RN to access the network is also implemented, and the network-side RN is more secure.

 FIG. 16 is a signaling flowchart of a tenth embodiment of a wireless node network access method according to the present invention. As shown in Figure 16, the following steps are included:

 Step 1601: The RN sends an RRC Connection Setup Request message to the DeNB to which it belongs.

 Step 1602: The DeNB to which the RN belongs restores an RRC connection setup message to the RN, and completes a connection establishment process of the random access channel.

 Step 1603: The RN sends an RRC connection setup complete message to the DeNB to which the RN belongs, where the NAS attach request message is carried.

 Step 1604: The DeNB to which the RN belongs encapsulates the NAS attach request message in an S1-AP message and transmits the message to the MME.

 Step 1605: The MME sends a message such as a Serving Gateway (S-GW) address, an S1-TEID, a Bearer QoS, a security context, and the like to the DeNB to which the RN belongs, and activates for all the eNBs. The radio bearer and SI bearer of the activated Evolved Packet System (EPS).

 Step 1606: The DeNB to which the RN belongs sends the RRC radio bearer setup message to the RN, and the RN authenticates the DeNB. The RRC radio bearer setup message may also carry a random number (nonce). DH parameters and AUTH parameters.

 The DeNB's certificate can also be considered instead of a certificate with a shorter bit length than the certificate itself. When the RRC radio bearer setup message in the above step 1606 carries the certificate identifier instead of the certificate itself, the method further includes: Step 1606', the DeNB needs to complete the message interaction with the RA/CA to obtain the certificate indicated by the certificate identifier. content. Then, the authentication of the peer-based certificate-based content is performed.

Step 1607: The DeNB to which the RN belongs receives the RRC radio bearer setup complete message sent by the RN, where the RRC radio bearer setup complete message includes the RN certificate, the random number (nonce) 2, the DH parameter of the RN, and the AUTH parameter, so that the DeNB Authenticate the RN according to the certificate of the RN. Complete the establishment of the wireless 7-load.

 The RN's certificate can also be considered instead of a certificate with a shorter bit length than the certificate itself. When the RRC radio bearer setup complete message carries the certificate identifier instead of the certificate itself in step 1607, the method further includes: Step 1607: The RN needs to complete the message interaction with the RA/CA to obtain the certificate indicated by the certificate identifier. Content. Then, the authentication of the certificate-based content of the peer is performed.

 Step 1608: The RN and the DeNB respectively calculate and generate the authentication key AK according to the DH parameter of the RN and the DH parameter of the DeNB in the two messages in the step 1606 and the step 1607, and use the authentication key AK as the temporary key. The KeNB calculates an encryption key and an integrity protection key of the AS signaling.

 Step 1609: Perform an AS SMC process between the DeNB and the RN to which the RN belongs, complete the negotiation of the AS algorithm between the DeNB and the RN, and activate the AS protection.

 The wireless node access method in this embodiment is a certificate-based authentication completed when the radio bearer is established, and the air interface protocol needs to be modified. In addition, the process of certificate authentication may be that the certificate of the DeNB is not sent in step 1606, and the certificate of the DeNB is carried in the downlink message of the DeNB to the RN in the interaction message of step 1609, thereby implementing authentication of the DeNB.

 In this embodiment, if the RN and the DeNB fail to be authenticated, the DeNB is triggered to initiate an RRC connection release procedure, or the DeNB is triggered to instruct the MME to initiate a process of de-attaching the RN, thereby disconnecting the radio bearer connection between the RN and the DeNB.

 The method for the network access of the wireless node provided in this embodiment describes the signaling procedure of the certificate authentication between the RN and the DeNB in detail. Similar to the eighth embodiment of the method for accessing the wireless node, the method for authenticating the certificate when the RN enters the network is also implemented. Moreover, the network side RN is more secure.

 FIG. 17 is a signaling flowchart of an eleventh embodiment of a method for accessing a wireless node according to the present invention. As shown in Figure 17, the following steps are included:

 Step 1701: The RN sends an RRC Connection Setup Request message to the DeNB to which it belongs.

Step 1702: The DeNB to which the RN belongs restores an RRC connection setup message to the RN, and completes randomization. The connection establishment process of the access channel.

 Step 1703: The RN sends an RRC connection setup complete message to the DeNB to which the RN belongs. The RRC connection setup complete message carries the certificate of the RN, and is used by the DeNB to which the RN belongs to authenticate the RN. The RRC connection setup complete message also carries a random number (nonce) 1, a DH parameter of the RN, and an AUTH parameter, which also carries a NAS attach request message.

 The RN's certificate can also be considered instead of a certificate with a shorter bit length than the certificate itself. When the RRC connection setup complete message in the above step 1703 is carried in the certificate identifier instead of the certificate itself, the method further includes: Step 1703: The RN needs to complete the message interaction with the RA/CA to obtain the certificate indicated by the certificate identifier. content. Then, the authentication of the peer-based certificate-based content is performed.

 Step 1704: The DeNB to which the RN belongs encapsulates the NAS attach request message in an S1-AP message and transmits the message to the MME.

 Step 1705: The MME sends a message such as a serving gateway (S-GW) address, an S1-TEID, a bearer QoS, a security context, and the like to the DeNB to which the RN belongs, by using an S1-AP message, and is activated for all The radio bearer and SI bearer of the activated Evolved Packet System (EPS).

 Step 1706: The DeNB to which the RN belongs sends the RRC radio bearer setup message to the RN, and the RN authenticates the DeNB. The RRC radio bearer setup message may also carry a random number (nonce). DH parameters and AUTH parameters.

 The DeNB's certificate can also be considered instead of a certificate with a shorter bit length than the certificate itself. When the RRC radio bearer setup message carries the certificate identifier instead of the certificate itself, the method further includes: Step 1706: The DeNB needs to complete the message interaction with the RA/CA to obtain the certificate indicated by the certificate identifier. content. Then, the authentication of the peer-based certificate-based content is performed.

Step 1707: The RN and the DeNB respectively calculate and generate an authentication key AK according to the DH parameter of the RN and the DH parameter of the DeNB in the two messages in step 1703 and step 1706, and The authentication key AK is used as the temporary key KeNB, and the encryption key and integrity protection key of the AS signaling are calculated.

 Through the interaction of the two messages in step 1703 and step 1706, the authentication based on the certificate when the RN enters the network is completed.

 Step 1708: The DeNB to which the RN belongs receives the RRC radio bearer setup complete message sent by the RN, and completes the establishment of the radio bearer between the RN and the DeNB.

 Step 1709: The AS SMC process is performed between the DeNB and the RN to which the RN belongs, and the AS algorithm negotiation between the DeNB and the RN is completed, and the AS protection is activated.

 The method for the network access of the wireless node provided in this embodiment describes the signaling procedure of the certificate authentication between the RN and the DeNB in detail. Similar to the eighth embodiment of the method for accessing the wireless node, the method for authenticating the certificate when the RN enters the network is also implemented. Moreover, the network side RN is more secure.

 FIG. 18 is a schematic structural diagram of a fourth embodiment of a relay node according to the present invention. As shown in FIG. 18, the relay node includes: a sending module 181, a receiving authentication module 182, a calculating module 183, and a bearer establishing module 184. The sending module 181 is configured to send, in the process of establishing a radio resource control connection and/or establishing a radio bearer between the relay node and the donor base station, the certificate of the relay node and the middle to the donor base station. Following the Diffie-Hellman parameter of the node, so that the donor base station authenticates the relay node according to the certificate of the relay node; and the receiving authentication module 182 is configured to receive the a certificate of the donor base station and a Diffie-Hellman parameter of the donor base station, and authenticating the donor base station according to the certificate of the donor base station; a calculation module 183, configured to: if the relay node and the donor After the base station authentication succeeds, the authentication key AK is calculated according to the Diffie-Hellman parameter of the relay node and the Diffie-Hellman parameter of the donor base station received by the receiving module 182; the bearer establishing module 184, The authentication key AK calculated by the calculation module 183 is used as a temporary key KeNB shared by the relay node and the donor base station, and based on the temporary key KeNB, The donor base station performs access layer security mode control. In addition, the mobility management entity also interacts with the relay node through the donor base station.

For the relay node provided in this embodiment, the method for implementing the wireless node access network is as described in the above method. For example, in the process of establishing an RRC connection and/or establishing a radio bearer between the RN and the DeNB, the message exchanged between the RN and the DeNB carries a certificate, performs authentication between the RN and the DeNB, and passes the RN and the RN. The DH parameters exchanged between the DeNBs are calculated similarly to the temporary key KeNB calculated when the UE enters the network, and finally the radio bearer establishment between the RN and the DeNB is completed, thereby implementing a certificate-based authentication method when the RN accesses the network, and the network side RN is implemented. Access to the network is more secure.

 FIG. 19 is a schematic structural diagram of a fourth embodiment of a wireless node network access system according to the present invention. As shown in FIG. 19, the method includes: a mobility management entity 191, a donor base station 192, and a relay node 193. The relay node 193 is as described in the fourth embodiment of the foregoing relay node, and details are not described herein again. The mobility management entity 191 interacts with the relay node 193 via the donor base station 192. The donor base station 192 is configured to receive a certificate of the relay node sent by the relay node 193 and a Diffie-Hellman parameter of the relay node, and send the certificate of the donor base station and the a Diffie-Hellman parameter of the donor base station to the relay node 193; calculating the authentication secret according to the Diffie-Hellman parameter of the relay node and the Diffie-Hellman parameter of the donor base station Key AK; using the authentication key AK as a temporary key KeNB shared by the relay node and the donor base station, and performing an access layer security mode with the relay node 193 according to the temporary key KeNB control.

 For the wireless node network access system provided by this embodiment, the specific method for implementing the wireless node network access is described in the foregoing method embodiment. In the process of establishing an RRC connection and/or establishing a radio bearer between the RN and the DeNB, between the RN and the DeNB. The interactive message carries the certificate, performs authentication between the RN and the DeNB, and calculates a temporary key KeNB calculated by the UE when the UE enters the network through the DH parameter exchanged between the RN and the DeNB, and finally completes the relationship between the RN and the DeNB. The radio bearer is set up to implement the certificate-based authentication method when the RN accesses the network, and the network-side RN is more secure.

FIG. 20 is a schematic flowchart diagram of a twelfth embodiment of a wireless node network access method according to the present invention. The authentication process in this embodiment is based on the authentication with the USIM card in the RN, and the RN is similar to the secondary UE. The RN first completes the process of establishing a radio bearer according to the USIM card therein, establishes an IP connection of the user plane/signaling plane, and then starts the second version (Internet Key Exchange version 2, referred to as IKEv2) of the IP layer based Internet Key Exchange Protocol 2 Certificate-based authentication process, establishing RN and its affiliated DeNB The IPSec connection completes the RN access process. As shown in Figure 20, after the RN access process is completed, the following steps are also included:

 Step 2001: The RN sends an IKE Security Association Initial Negotiation (IKE_SA_INIT) request message to the DeNB, where the parameter {HDR, SAil, Kei, Ni} is included in the IKE SA INIT request message.

 The message header HDR includes a Security Parameter Index (SPIs), a version number, and a required flag. The SAil includes an encryption algorithm supported by the initiator to establish an IKE security association, Kei is the DH parameter of the initiator, and Ni is initiated. Square random number load.

 Step 2002: The DeNB replies to the IKE-SA-INIT response message to the RN, and the parameters {HDR, SArl, KEr, Nr, [CERTREQ]} are included in the IKE-SA_INIT response message.

 The DeNB places the selected algorithm in the SArl. By interacting with the IKE-SA-INIT request/response message, the initiator and the responder negotiate the required encryption algorithm and authentication algorithm. By exchanging Ni/Nr and Kei/Ker, The DH exchange is completed, so that both parties can calculate the shared key, which is used to protect the subsequent data and the key required to generate the IPsec security association; [CERTREQ] is the certificate request identifier.

 Step 2003: The RN sends an IKE-AUTH request message to the DeNB to which it belongs, and the IKE AUTH request message includes parameters {HDR, SK, AUTH, SAi2, TSi, TSr, CFG_REQUEST}.

 The specific meanings of the parameters carried are: HDR contains SPIs, version number and required flags, SAi includes the encryption algorithm supported by the initiator to establish an IKE security association; SK indicates that the message is protected, AUTH is used to prove that ID-related secrets, integrity protection of both previous and current data packets; SAi2 carries a list of cryptographic algorithms for IPsec security associations, TSi/TSr represents data flows protected by IPsec security associations, CFG-REQUEST is used to The DeNB attached to the RN requests a certificate for authentication.

Step 2004: The DeNB to which the RN belongs sends an IKE-AUTH response message to the RN, where the IKE AUTH response message includes parameters {HDR, SK, AUTH, SAr2, TSi, TSr, [CERT], Config Payload, CFG_REQUEST} . Sending the certificate of the DeNB to which the RN belongs to the RN, so that the RN completes the authentication of the DeNB to which it belongs, and requests the certificate from the RN for authentication.

 Step 050: The RN sends an IKE-AUTH response message to the DeNB to which the RN belongs, and the IKE AUTH response message includes parameters {HDR, SK, AUTH, SAr2, Tsi, TSr, [CERT], Config Payload}, and the RN The certificate is sent to the DeNB to which the RN belongs, so that the DeNB to which the RN belongs completes the authentication of the RN.

 Similarly, due to the limitation of the message length, in step 2004 and step 2005, the certificate of the RN and the certificate of the DeNB may also be replaced by a certificate identifier with a shorter bit length instead of the certificate itself, then the entity receiving the message needs to first The interaction with the RA/CA is completed to obtain the content of the certificate indicated by the certificate identifier, and then the authentication of the certificate-based content of the peer is performed.

 It should be noted that, in order to overcome the problem of low security of the removable USIM card, when the RN completes the network authentication by using the USIM card, and establishes an IPSec connection between the RN and its attached DeNB, the certificate authentication process is also required. As described in the above steps. On the network side node DeNB/MME of the certificate authentication, if the certificate authentication of the RN fails, the wireless connection/IPSec connection that triggers the Un interface between the RN and the DeNB/MME should be released or the MME initiates the process of registering the RN Detach. . Only after the RN's certificate is successfully authenticated, the RN can act as a network node to activate the bearer function of the Un interface. Otherwise, any UE cannot access the network through the RN.

FIG. 21 is a schematic structural diagram of a fifth embodiment of a relay node according to the present invention. As shown in FIG. 21, the relay node includes: a parameter switching module 2101, a first sending module 2102, a receiving authentication module 2103, and a second sending module 2104. The parameter exchange module 2101 is configured to send an Internet Key Exchange Security Association Initial Negotiation Request message to the donor base station after completing the process of establishing a radio resource control connection and establishing a radio bearer between the relay node and the donor base station, And receiving an Internet Key Exchange Security Association Initial Negotiation Response message replied by the donor base station to exchange a Diffie-Hellman parameter of the relay node and a Diffie-Hellman parameter of the donor base station, The Diffie-Hellman parameter is used to negotiate a security protection alliance between the relay node and the donor base station; the first sending module 2102 is configured to send an Internet Key Exchange Authentication Request message to the donor base station, where Internet The key exchange authentication request message carries information for requesting the certificate of the donor base station; the receiving authentication module 2103 is configured to receive an Internet key exchange authentication response message that is returned by the donor base station and that carries the certificate of the donor base station, and according to The certificate of the donor base station authenticates the donor base station, the Internet key exchange authentication response message further carries information requesting the certificate of the relay node, and the second sending module 2104 is configured to send to the donor base station And transmitting an Internet Key Exchange Authentication Response message carrying the certificate of the relay node, so that the donor base station authenticates the relay node according to the certificate of the relay node.

 The relay node provided in this embodiment, which specifically implements the wireless node network access method, is described in the foregoing method. The twelfth embodiment can implement the certificate-based authentication method when the RN accesses the network, and makes the network-side RN more secure.

 FIG. 22 is a schematic structural diagram of a fifth embodiment of a wireless node network access system according to the present invention. As shown in FIG. 22, the wireless node network access system includes: a donor base station 2201 and a relay node 2202 as described in the fifth embodiment of the relay node described above. The donor base station 2201 is configured to receive the Internet Key Exchange Security Association Initial Negotiation Request message sent by the relay node 2202, and return the Internet Key Exchange Security Association Initiality to the relay node 2202. Negotiating a response message to exchange a Diffie-Hellman parameter of the relay node 2202 and a Diffie-Hellman parameter of the donor base station 2201, the Diffie-Hellman parameter being used to negotiate the middle Following the security protection alliance between the node 2202 and the donor base station 2201; receiving the Internet Key Exchange Authentication Request message sent by the relay node 2202, where the Internet Key Exchange Authentication Request message carries the request for the donor Information of the certificate of the base station 2201; and returning, to the relay node 2202, the Internet Key Exchange Authentication Response message carrying the certificate of the donor base station 2201, where the Internet Key Exchange Authentication Response message further carries the request Information of the certificate of the relay node 2202; receiving the cause of the certificate carrying the relay node 2202 sent by the relay node 2202 The special network key exchanges the authentication response message, and authenticates the relay node 2202 according to the certificate of the relay node 2202.

The wireless node network access system provided in this embodiment, and the wireless node network access method are specifically implemented in the twelfth embodiment of the foregoing method, which can implement the certificate-based authentication method when the RN accesses the network, and makes the network The network side RN is more secure.

 A person skilled in the art can understand that all or part of the process of implementing the above embodiment method can be completed by a computer program to instruct related hardware, and the program can be stored in a computer-accessible storage medium. When executed, the flow of an embodiment of the methods as described above may be included. The storage medium may be a magnetic disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM).

 It should be noted that the above embodiments are only for explaining the technical solutions of the present invention, and are not intended to be limiting; although the present invention has been described in detail with reference to the foregoing embodiments, it will be understood by those skilled in the art that: The technical solutions described in the foregoing embodiments are modified, or some of the technical features are equivalently replaced. The modifications and substitutions do not depart from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

Rights request  A wireless node network access method, comprising:  In the process of establishing a radio resource control connection between the relay node and the donor base station integrated with the home subscriber server, the relay node sends the certificate of the relay node and the parameters of the relay node to the donor base station. So that the donor base station authenticates the relay node according to the certificate of the relay node;  The relay node receives the certificate of the donor base station and the parameters of the donor base station sent by the donor base station, and authenticates the donor base station according to the certificate of the donor base station.  2. The method of claim 1 wherein  And if the certificate of the donor base station sent by the donor base station is the identifier information of the certificate, before the authenticating the donor base station according to the certificate of the donor base station, the method further includes: according to the identifier information of the certificate The certificate center obtains the content of the certificate;  The authenticating the donor base station according to the certificate of the donor base station includes: authenticating the donor base station according to the content of the certificate obtained from the certificate center.  3. Method according to claim 1 or 2, characterized in that the parameter is a Diffie-Hellman parameter.  The method according to claim 1 or 2, wherein the method further comprises: if the relay node and the donor base station are successfully authenticated, according to parameters of the relay node and the donor Calculating the base key K of the parameters of the base station;  Performing authentication and key negotiation with the mobility management entity based on the basic key K; performing non-access stratum security mode control with the mobility management entity, and performing access layer security mode control with the donor base station, establishing and A radio bearer between the donor base stations.  5. A relay node, comprising: a sending module, configured to send, by the donor base station, a certificate of the relay node and a parameter of the relay node in a radio resource control connection establishment process between a relay node and a donor base station integrated with a home subscriber server So that the donor base station performs the middle according to the certificate of the relay node. Follow the node for authentication;  Receiving an authentication module, configured to receive a certificate of the donor base station and a parameter of the donor base station sent by the donor base station, and perform authentication on the donor base station according to the certificate of the donor base station; After the relay node and the donor base station are successfully authenticated, the base key K is calculated according to the parameters of the relay node and the parameters of the donor base station received by the receiving module; a bearer establishing module, configured to calculate based on the The basic key K calculated by the module, performing authentication and key negotiation with the mobility management entity; and performing non-access stratum security mode control with the mobility management entity, and an access layer between the donor base station and the donor base station Security mode control establishes a wireless 7-load with the donor base station.  6. The node of claim 5, wherein the parameter is a Diffie-Hellman parameter.  A wireless node network access system, comprising: a mobility management entity, a donor base station integrated with a home subscriber server, and a relay node according to claim 3.  The donor base station integrated with the home subscriber server is configured to receive a certificate of the relay node and a parameter of the relay node sent by the relay node, and send the certificate of the donor base station and the donor base station a parameter to the relay node; calculating the base key K according to a parameter of the relay node and a parameter of the donor base station; an access layer key calculated according to the base key K, and the The relay node performs access layer security mode control;  The mobility management entity is configured to obtain an authentication vector calculated by the donor base station integrated with the home subscriber server based on the basic key K, and perform authentication and key negotiation with the relay node according to the authentication vector; And used for non-access stratum security mode control with the relay node according to the non-access stratum key calculated by the basic key K.  8. The system of claim 7 wherein the parameter is a Diffie-Hellman parameter. 9. A wireless node network access method, characterized in that: The relay node completes establishment of a radio resource control connection between the relay node and the donor base station; the relay node sends an attach request message carrying the certificate of the relay node and parameters of the relay node to the integration a mobility management entity having a home subscriber server, to enable the mobility management entity to authenticate the relay node according to the certificate of the relay node;  Receiving, by the mobility management entity, a non-access stratum message that carries a certificate of a mobility management entity and a parameter of the mobility management entity, and sends the mobility management entity to the mobility management entity according to the certificate of the mobility management entity. Authenticate;  If the relay node and the mobility management entity are successfully authenticated, calculate a shared key according to parameters of the relay node and parameters of the mobility management entity;  And performing non-access stratum security mode control with the mobility management entity based on the shared key, and performing access layer security mode control with the donor base station to establish a radio bearer with the donor base station.  The method according to claim 9, wherein the shared key is a base key K or a key KASME;  Before the shared key is the basic key K, before the non-access stratum security mode control with the mobility management entity, the method further includes: performing authentication with the mobility management entity based on the basic key K Key negotiation.  11. The method of claim 9 wherein:  If the certificate of the mobility management entity sent by the mobility management entity is the identifier information of the certificate, before the authenticating the mobility management entity according to the certificate of the mobility management entity, the method further includes: determining, according to the identifier information of the certificate Obtaining the contents of the certificate from the certificate center;  The authenticating the mobility management entity according to the certificate of the mobility management entity includes: authenticating the mobility management entity according to the content of the certificate obtained from the certificate center.  12. Method according to claim 9, 10 or 11, characterized in that the parameter is a Defi-Hellman parameter. 13. A relay node, comprising: a connection establishing module, configured to complete establishment of a radio resource control connection between the relay node and the donor base station;  a sending module, configured to send an attach request message carrying a certificate of the relay node and a parameter of the relay node to a mobility management entity integrated with a home subscriber server, so that the mobility management entity according to the relay The certificate of the node authenticates the relay node;  Receiving an authentication module, configured to receive a non-access stratum message that is sent by the mobility management entity and that carries a certificate of a mobility management entity and a parameter of the mobility management entity, and performs the mobility management according to the certificate of the mobility management entity. Entity for authentication;  a calculation module, configured to calculate a sharing key according to a parameter of the relay node and a parameter of the mobility management entity received by the receiving module, if the relay node and the mobility management entity are successfully authenticated;  a bearer establishing module, configured to perform non-access stratum security mode control with the mobility management entity based on the shared key calculated by the computing module, and perform access layer security mode control with the donor base station to establish A radio bearer with the donor base station.  14. The node of claim 13 wherein the parameter is a Diffie-Hermann parameter.  A wireless node network access system, comprising: a mobility management entity integrated with a home subscriber server, a donor base station, and a relay node according to claim 8.  The mobility management entity integrated with the home subscriber server is configured to receive a certificate of the relay node and a parameter of the relay node sent by the relay node, and send a certificate of the mobility management entity and the mobility management a parameter of the entity to the relay node; calculating the shared key according to a parameter of the relay node and a parameter of the mobility management entity; a non-access stratum key calculated according to the shared key, and The relay node performs non-access stratum security mode control; The donor base station is configured to acquire an access layer key calculated by the mobility management entity integrated with the home subscriber server based on the shared key, and connect to the relay node according to the access layer key Intrusion security mode control. 16. The system of claim 15 wherein the parameter is a Diffie-Hermann parameter.