WO2012116599A1 - Security tunnel establishing method and enb - Google Patents

Abstract

Provided are a security tunnel establishing method and an eNB. The security tunnel establishing method includes: a first eNB obtains a root certificate for authenticating the certificate of a second eNB or a shared key between the same and the first eNB; when the first eNB is an H(e)NB, the second eNB is an H(e)NB or macro eNB; or, when the first eNB is a macro eNB, the second eNB is an H(e)NB; the first eNB establishes an Internet protocol security tunnel with the second eNB using the shared key or the root certificate for authenticating the certificate of the second eNB, so as to guarantee the security of an interface between the first eNB and the second eNB. In the embodiments of the present invention, the first eNB can establish an IPsec tunnel with the second eNB using the obtained root certificate for authenticating the certificate of the second eNB or the shared key between the second eNB and the first eNB, thus the security of the interface between the first eNB and the second eNB can be guaranteed.

Description

 The present invention claims the priority of the Chinese patent application filed on March 1, 2011 by the Chinese Patent Office, the application number is 201110049584.8, and the invention is entitled "Safe Tunnel Establishment Method and Base Station", the entire contents of which are incorporated by reference. Combined in this application. The present invention relates to the field of wireless communication technologies, and in particular, to a secure tunnel establishment method and a base station. BACKGROUND OF THE INVENTION For a scenario where a multi-home base station (Home NodeB/Home evolved NodeB; the following is called H(e)NB) deployed in an enterprise network and a campus network, switching between H(e)NBs will occur frequently. In order to ensure the continuity of services, improve the success rate of handover between H(e)NBs, and reduce handover delay, the prior art establishes a direct interface between H(e)NBs to support mobility between H(e)NBs. Sexual enhancement, not through the security gateway (Security Gateway; the following cartridge: SeGW).

 In the existing macro network, for the direct interface between the base station (evolved NodeB; hereinafter referred to as: eNB), the eNB can establish an IPSec tunnel by means of certificate authentication to ensure the security of the direct interface between the eNBs.

 However, for the direct interface between the H(e)NBs or the interface between the eNB and the H(e)NB, the security of the interface cannot be ensured in the above manner.

SUMMARY OF THE INVENTION Embodiments of the present invention provide a method for establishing a secure tunnel and a base station, so as to establish an Internet protocol security between a home base station and a home base station, or between a home base station and a macro base station by using a shared key or a certificate. The following cylinders are called: IPsec) tunnels to ensure the security of the interface between the home base station and the home base station, or between the home base station and the macro base station. An embodiment of the present invention provides a method for establishing a secure tunnel, including:

 The first base station obtains a root certificate for verifying the second base station certificate or a shared key between the second base station and the first base station; when the first base station is a home base station, the second base station is a home base station or Or a macro base station; or, when the first base station is a macro base station, the second base station is a home base station;

 The first base station establishes an Internet Protocol security tunnel with the second base station by using the shared key or the root certificate for verifying the second base station certificate, to ensure that the first base station and the second base station The security of the interface.

 The embodiment of the invention further provides a first base station, including:

 And an obtaining module, configured to obtain a root certificate for verifying the second base station certificate or a shared key between the second base station and the first base station;

 And a establishing module, configured to establish an Internet Protocol security tunnel with the second base station by using the shared key or the root certificate for verifying the second base station certificate, to ensure that the first base station and the second base station are The security of the interface.

 According to the embodiment of the present invention, the first base station may obtain a root certificate for verifying the second base station certificate or a shared key between the second base station and the first base station, so that the first base station may pass the shared key or the foregoing The root certificate for verifying the second base station certificate establishes an IPsec tunnel with the second base station, so that the security of the interface between the first base station and the second base station can be ensured.

DRAWINGS

The drawings used in the embodiments or the description of the prior art are described in a single manner. It is obvious that the drawings in the following description are some embodiments of the present invention, and those of ordinary skill in the art do not pay Other drawings can also be obtained from these drawings on the premise of creative labor.

1 is a flowchart of an embodiment of a method for establishing a secure tunnel according to the present invention; 2 is a flowchart of another embodiment of a method for establishing a secure tunnel according to the present invention; FIG. 3 is a flowchart of another embodiment of a method for establishing a secure tunnel according to the present invention;

 4 is a flowchart of another embodiment of a method for establishing a secure tunnel according to the present invention;

 FIG. 5 is a flowchart of an embodiment of a shared key update method according to the present invention; FIG.

 6 is a flowchart of another embodiment of a shared key update method according to the present invention;

 7 is a flowchart of another embodiment of a method for establishing a secure tunnel according to the present invention;

 8 is a flowchart of another embodiment of a method for establishing a secure tunnel according to the present invention;

 9 is a schematic structural diagram of an embodiment of a first base station according to the present invention;

 10 is a schematic structural diagram of another embodiment of a first base station according to the present invention;

 11 is a schematic structural diagram of another embodiment of a first base station according to the present invention;

 FIG. 12 is a schematic structural diagram of another embodiment of a first base station according to the present invention.

The technical solutions in the embodiments of the present invention are clearly and completely described in the following with reference to the accompanying drawings in the embodiments of the present invention. The embodiments are a part of the embodiments of the invention, and not all of the embodiments. All other embodiments obtained by a person of ordinary skill in the art based on the embodiments of the present invention without departing from the inventive work are all within the scope of the present invention.

 FIG. 1 is a flowchart of an embodiment of a method for establishing a secure tunnel according to the present invention. As shown in FIG. 1 , the method for establishing a secure tunnel may include:

 Step 101: The first base station obtains a root certificate (Root Certificate) for verifying the second base station certificate or a shared key (Shared Key) between the second base station and the first base station.

In this embodiment, when the first base station is a home base station, the second base station may be a home base station or a macro base station; or, when the first base station is a macro base station, the second base station may be a home base station; that is, the first At least one of the base station and the second base station may be a home base station. Among them, the macro base station The eNB or other type of macro base station may be used; the home base station may be a HeNB or an HNB, which is not limited in this embodiment.

Step 102: The first base station establishes an IP _sec tunnel with the second base station by using the shared key or the root certificate for verifying the second base station certificate to ensure the security of the interface between the first base station and the second base station.

 In an implementation manner of this embodiment, the first base station obtains a root certificate for verifying the second base station certificate or the shared key between the second base station and the first base station may be: the first base station receives the core network device to send The root certificate or core network device used to verify the second base station certificate is a shared key generated by the second base station and the first base station.

 In this implementation manner, after the shared key period set by the core network device expires, the first base station may receive, by the core network device, the updated shared key generated by the core network device as the second base station and the first base station; Alternatively, after the shared key period set by the first base station expires, the first base station may request the core network device to update the shared key, and then receive the update generated by the core network device according to the request of the first base station. Or a shared key; or, when the first base station initiates an Internet Key Exchange (hereinafter referred to as: IKE) negotiation to the second base station, if the first base station or the second base station is found to have no shared key available, The first base station may request the core network device to update the shared key, and then receive the updated shared key generated by the core network device according to the request of the first base station.

 In this implementation manner, when the core network device is a Mobility Management Entity (hereinafter referred to as: MME) or a Home Evolved Base Station Gateway (HeNB Gateway; hereinafter referred to as HeNB GW), the first base station may receive the MME or The MME or HeNB GW sent by the HeNB GW is a shared key generated by the second base station and the first base station; or

The first base station may further send the MME or the HeNB GW before the first base station receives the root certificate sent by the core network device for verifying the second base station certificate or the core network device is the shared key generated by the second base station and the first base station. The base station configures the forwarding message; in this way, the first base station receives the root certificate sent by the core network device for verifying the second base station certificate or the core network device is the second base station. The shared key generated by the first base station may be: the first base station receives the mobility management entity configuration forwarding message sent by the MME or the HeNB GW, and the mobility management entity configures the forwarding message to carry the root for verifying the second base station certificate. a certificate, or a shared key generated by the MME or the HeNB GW for the first base station and the second base station; the mobility management entity configuring the forwarding message is that after the MME or the HeNB GW receives the foregoing base station configuration forwarding message, the forwarding message is configured according to the base station configuration. The source node identifier and the destination node identifier determine the root certificate that the base station configures the forwarding message source node and/or the target node to be the home evolved base station, and the MME or HeNB GW is the first base station and The shared key generated by the second base station is sent to the second base station, and is sent to the first base station after receiving the base station configuration forwarding message sent by the second base station.

 In this implementation manner, when the core network device is a home base station gateway (HNB Gateway; hereinafter referred to as HNB GW), the first base station may receive the HNB GW sent by the HNB GW as a shared secret generated by the second base station and the first base station. Key; or,

After the first base station receives the shared key generated by the core network device and is the shared key generated by the second base station and the first base station, after the first base station registers with the HNB GW, if the second base station detects that the second base station is registered to the HNB GW, The first base station may request the HNB GW to request the Internet Protocol (Internet Protocol; IP address) of the second base station; at this time, the first base station receives the core network device sent by the core network device as the second base station and the first base station The generated shared key may be: The first base station receives the response message sent by the HNB GW, where the response message carries the IP address of the second base station and the shared key generated by the HNB GW in advance for the first base station and the second base station. In addition, before the first base station receives the shared key generated by the core network device and is the shared key generated by the second base station and the first base station, the first base station may register with the HNB GW, and send the first base station to the HNB GW to detect The information of the neighboring cell home base station, the neighboring cell home base station of the first base station includes the second base station; thus, the first base station receives the shared key generated by the core network device sent by the core network device as the shared key generated by the second base station and the first base station. The first base station receives the information of the neighboring home base station available on the HNB GW sent by the HNB GW, and the HNB GW is a shared key generated by the first base station and the neighboring home base station of the first base station. In this implementation manner, after the HNB GW finds that the information of the neighboring cell home base station controlled by the HNB GW is not updated to the first base station, and the HNB GW does not have the shared key of the first base station and the updated neighboring home base station, The first base station may receive information of the updated neighboring home base station sent by the HNB GW through the home base station configuration forwarding process, and the HNB GW is a shared key generated by the first base station and the updated neighboring home base station.

 In this implementation manner, when the core network device is the HNB GW, the first base station may send the home base station registration request message to the HNB GW before receiving the root certificate sent by the core network device for verifying the second base station certificate, The first base station receives the root certificate that is sent by the core network device and is used to verify the second base station certificate. The first base station receives the home base station registration accept message sent by the HNB GW, and the home base station registration accept message carries the foregoing for verifying the second The root certificate of the base station certificate.

 In this implementation manner, when the core network device is a home base station management system (H(e)NB Management System; the following is called: H(e)MS), the first base station receives the second base station sent by the core network device for verifying Before the root certificate of the certificate or the core network device is the shared key generated by the second base station and the first base station, the first base station may first establish an IPsec tunnel with the security gateway; thus, the first base station receives the information sent by the core network device. The root certificate for verifying the second base station certificate or the shared key generated by the core network device for the second base station and the first base station may be: after the location verification of the first base station by the H(e)MS is successful, the first base station receives H ( e) the root certificate or the H(e)MS used by the MS to verify the second base station certificate sent by the MS through the home base station provisioning process, and the shared key generated by the first base station and the neighboring home base station of the first base station; The neighboring home base station of a base station includes a second base station.

In another implementation manner of this embodiment, before the first base station obtains the shared key between the second base station and the first base station, the first base station may send a base station configuration forwarding message to the MME or the HeNB GW, where the base station configures the forwarding message. Carrying the Diffie-Hellman (DH) group number and the DH value of the first base station, so that the MME or the HeNB GW carries the DH group number and the DH value of the first base station in the first mobility. The management entity configuration forwarding message is sent to the second base station; Then, the first base station may receive a second mobility management entity configuration forwarding message sent by the MME or the HeNB GW, where the second mobility management entity configures the forwarding message to carry the DH group number and the DH value selected by the second base station, where the second mobile The MME or the HeNB GW sends the base station configuration forwarding message that is sent by the second base station and carries the DH group number and the DH value selected by the second base station, and then sends the message to the first base station; The shared key between the second base station and the first base station may be: The first base station generates the shared key according to the DH group number and the DH value selected by the second base station.

 In the foregoing embodiment, the first base station may obtain a root certificate for verifying the second base station certificate or a shared key between the second base station and the first base station, so that the first base station may use the shared key or the foregoing The root certificate of the second base station certificate is verified to establish an IPsec tunnel with the second base station, so that the security of the interface between the first base station and the second base station can be ensured.

 FIG. 2 is a flowchart of another embodiment of a method for establishing a secure tunnel according to the present invention. In this embodiment, the first base station is HeNB 1 , the second base station is HeNB 2 , and the core network device is MME or HeNB GW as an example. In this embodiment, the MME or the HeNB GW needs to have a shared key generation and distribution function, and the MME or the HeNB GW can complete the distribution of the shared key by using the Configuration Transfer function. The configuration forwarding function is a function of requesting and transmitting configuration information (for example, an IP address, etc.) between two base stations through a core network. The MME or the HeNB GW may distribute the shared key to the HeNB1 and the HeNB2 establishing the direct interface through the mobility management entity configuration forwarding (MME Configuration Transfer) message.

 As shown in FIG. 2, the method for establishing a secure tunnel may include:

 Step 201: When the HeNB1 wants to establish a direct interface with the HeNB2, the HeNB1 sends an eNB Configuration Transfer message to the MME or the HeNB GW to request the IP address of the peer HeNB2.

Step 202: After the MME or the HeNB GW determines that the source node and/or the target node of the base station configuration forwarding message is the HeNB, the MME or the HeNB GW generates a shared key for the HeNB1 and the HeNB2. Specifically, the MME or the HeNB GW may determine, by using the source node identifier and the destination node identifier in the forwarding message of the base station, that the source node and/or the target node of the base station configuration forwarding message is the HeNB. In this embodiment, the source node of the base station configured to forward the message is HeNB1, and the target node is HeNB2. Therefore, the source node and the target node of the base station configured to forward the message are both HeNBs.

 Step 203: The MME or the HeNB GW sends a mobility management entity configuration forwarding message to the HeNB2, where the mobility management entity configures the forwarding message to carry the shared key generated by the MME or the HeNB GW for the HeNB1 and the HeNB2.

 Step 204: The HeNB2 sends a base station configuration forwarding message to the MME or the HeNB GW, where the base station configures the forwarding message to carry the IP address of the HeNB2.

 Step 205: The MME or the HeNB GW sends a mobility management entity configuration forwarding message to the HeNB1, where the mobility management entity configures the forwarding message to carry the shared key generated by the MME or the HeNB GW for the HeNB1 and the HeNB2, and the IP address of the HeNB2.

 Step 206: HeNB 1 and HeNB2 perform IKE negotiation through the shared key, and establish an IPSec tunnel between HeNB 1 and HeNB 2 to ensure the security of the direct interface between HeNB1 and HeNB2.

 In this embodiment, the shared key needs to be updated in the following cases:

 (1) The MME or the HeNB GW sets a shared key period, and after the shared key period set by the MME or the HeNB GW expires, the MME or the HeNB GW generates a new shared key, and configures forwarding through a dedicated message or a mobility management entity. The message sends the updated shared key to HeNB1 and HeNB2;

 (2) The shared key period is set on the HeNB1 or the HeNB2, and after the shared key period set by the HeNB1 or the HeNB2 expires, the HeNB 1 or the HeNB 2 may request the MME or the HeNB GW to update the shared key by using a dedicated message or a base station configuration forwarding message. After the MME or the HeNB GW generates a new shared key, the updated shared key may be sent to the HeNB1 and the HeNB2 by using a dedicated message or a mobility management entity configuration forwarding message;

(3) When HeNB1 initiates IKE negotiation to HeNB2, if HeNB1 or HeNB2 is found If there is no shared key available, the HeNB1 may request the MME or the HeNB GW to update the shared key through a dedicated message or a base station configuration forwarding message. After the MME or the HeNB GW generates a new shared key, the HeNB may use a dedicated message or a mobility management entity. The configuration forwarding message sends the updated shared key to HeNB1 and HeNB2.

 In the foregoing embodiment, the HeNB1 can obtain the shared key generated by the MME or the HeNB GW for the HeNB1 and the HeNB2, and the HeNB1 can establish an IPsec tunnel with the HeNB2 through the shared key, so as to ensure the security of the direct interface between the HeNB1 and the HeNB2.

 FIG. 3 is a flowchart of another embodiment of a method for establishing a secure tunnel according to the present invention. In this embodiment, the first base station is HNB1, the second base station is HNB2, and the core network device is HNB GW. In this embodiment, the HNB GW needs to have a shared key generation and distribution function, and the HNB GW can complete the distribution of the shared key through the HNB Configuration Transfer function. The home base station configuration forwarding function provides a method for the HNB to obtain the IP address of the neighboring cell HNB. The HNB can establish a direct interface with the neighboring cell HNB by using the IP address sent by the HNB GW. In addition, the HNB can use the HNB Application Protocol Registration Accept (HNBAP) to transmit the HNB Application Protocol Registration Accept message to the HNB, the HNB Configuration Transfer Response message, or the home base station configuration forwarding. The HNB Configuration Transfer Request message is distributed to the corresponding neighboring cell HNB by the shared key generated by the HNB GW.

 As shown in FIG. 3, the method for establishing a secure tunnel may include:

 Step 301, HNB 1 enters the running mode and has been registered in the HNB GW.

 Step 302: HNB2 enters an operation mode, and detects a neighboring area, and obtains a neighboring area of HNB2.

 The neighboring area HNB of the HNB2 includes the HNB 1.

Step 303: The HNB2 registers with the HNB GW, and sends the IP address of the HNB2 and the information of the neighboring HNB detected by the HNB2 to the HNB GW. Step 304: The HNB GW saves the IP address of the HNB2 and the information of the neighboring cell HNB detected by the HNB2, and then the HNB GW generates a shared key for the HNB2 and the neighboring cell HNB of the HNB2.

 Step 305: The HNB GW sends the information about the neighboring HNBs available on the HNB GW to the HNB2, and sends the shared key generated by the HNB GW to the HNB2 and the neighboring HNB of the HNB2 to the HNB2.

 Step 306, HNB1 detects HNB2.

 Step 307: The HNB1 sends a home base station configuration forwarding request message to the HNB GW to request the IP address of the HNB2.

 Step 308: The HNB GW sends a home base station configuration forwarding response message to the HNB1, where the home base station configures the forwarding response message to carry the IP address of the HNB2, and the shared key generated by the HNB GW in advance for the HNB1 and the HNB2.

 Specifically, if the HNB GW has a shared key generated by the HNB GW for the HNB1 and the HNB2 before the home base station configures the forwarding response message, the HNB GW may directly carry the shared key in the home base station configuration forwarding response message. If the HNB GW does not generate a shared key for HNB1 and HNB2 before the home base station configures the forwarding response message, the HNB GW needs to generate a share for HNB1 and HNB2 before sending the home base station to configure the forwarding response message. The key is sent to the HNB 1 in the home base station configuration forwarding response message.

 Step 309: The HNB GW finds that the HNB GW controlled neighbor HNB information is not updated to HNB1 at a certain point in time, and the HNB GW is HNB1 and the updated neighboring HNB shared key, and the HNB GW is HNB1 and The updated neighbor HNB generates a shared key.

In step 310, the HNB-GW initiates the home base station configuration forwarding process to provide the information of the updated neighboring cell HNB to the HNB1, and sends the shared key generated by the HNB GW to the HNB1 and the updated neighboring cell HNB to the HNB1. Step 311: Optionally, the HNB1 may provide the HNB GW with information of the updated neighboring cell HNB.

 In this embodiment, the HNB1 and the HNB2 can establish an IPSec tunnel through the shared key distributed by the HNB GW to ensure the security of the direct interface between the HNB 1 and the HNB 2.

 It should be noted that, for an HNB, the foregoing steps 301 to 312 may not be all performed, and only some steps may be performed. For example, only step 302, step 303, step 304, step 305, step 309, and step may be performed. 310 and step 311, or, only step 301, step 306, step 307, step 308, step 309, step 310, and step 311 may be performed. However, whether all steps or partial steps are performed, two adjacent HNBs can obtain a shared key.

 In this embodiment, the shared key needs to be updated in the following cases:

 (1) The HNB GW sets the shared key period. After the shared key period set by the HNB GW expires, the HNB GW generates a new shared key, and configures the forwarding request message through the dedicated message or the home base station to update the shared secret. The key is sent to HNB1 and HNB2;

 (2) The shared key period is set on HNB1 or HNB2. After the shared key period set by HNB1 or HNB2 expires, HNB1 or HNB2 may request the HNB GW to update the shared key through a dedicated message or a home base station configuration forwarding request message. After the HNB GW generates a new shared key, the updated shared key may be sent to HNB1 and HNB2 through a dedicated message or a home base station configuration forwarding response message;

 (3) When HNB1 initiates IKE negotiation to HNB2, if it is found that HNB1 or HNB2 does not have a shared key available, HNB1 may request the HNB GW to update the shared key through a dedicated message or a home base station configuration forwarding request message, and the HNB GW generates a new one. After the key is shared, the updated shared key can be sent to HNB1 and HNB2 through a dedicated message or a home base station configuration forwarding response message.

In the foregoing embodiment, the HNB1 can obtain the shared key generated by the HNB GW for the HNB1 and the HNB2, and the HNB1 can establish an IPsec tunnel with the HNB2 through the shared key. The security of the direct interface between HNB1 and HNB2 can be guaranteed.

 4 is a flowchart of another embodiment of a method for establishing a secure tunnel according to the present invention. In this embodiment, a base station is an H(e)NB, and a core network device is an H(e)MS. In this embodiment, the H(e)MS has a shared key generation and distribution function, and the H(e)MS may be in a home base station provision (H(e)NB Provision) flow, and the H(e)MS may be H(e) The NB generates a shared key with the neighboring area H(e)NB of the H(e)NB, and then supplies the shared key to the H(e)NB along with the neighbor list.

 As shown in FIG. 4, the method for establishing a secure tunnel may include:

 Step 401: An IPSec tunnel is established between the H(e)NB and the security gateway.

 Step 402: The H(e)MS performs location verification on the H(e)NB. After the location verification succeeds, the H(e)MS sends configuration parameters to the H(e)NB through the home base station provisioning process, where the configuration parameter includes H ( e) information of the neighboring cell H(e)NB of the NB, and the shared key generated by the H(e)NB in advance for the H(e)NB and the neighboring zone H(e)NB of the H(e)NB.

 Specifically, if the H(e)MS has a shared key generated by the H(e)NB on the H(e)MS before transmitting the configuration parameter, the H(e)MS may directly carry the shared key in the The configuration parameter is sent to the H(e)NB; if the shared key is not generated for the H(e)NB on the H(e)MS before the configuration parameter is sent, the H(e)MS needs to send the configuration parameters before A shared key is generated for the H(e)NB, and the shared key is carried in the configuration parameter and sent to the H(e)NB.

 In this embodiment, after the shared key period set by the H(e)NB expires or the neighboring area of the H(e)NB is updated, or the H(e)NB initiates an IKE negotiation to the neighboring area H(e)NB, After the H(e)NB or neighboring zone H(e)NB has no shared key available, the H(e)NB may request the H(e)MS to update the shared key through a dedicated message; or, at H(e) After the shared key period set by the MS expires or the H(e)MS discovers the neighboring area update of the H(e)NB, the H(e)MS may actively send the flow or the dedicated message to the H(e)NB through the home base station. Send the updated shared secret.

 FIG. 5 is a flowchart of an embodiment of a shared key update method according to the present invention. As shown in FIG. 5, the shared key update method may include:

Step 501: H(e)NB discovers that the shared key period set by the H(e)NB expires or H(e)NB The neighboring area is updated, or the H(e)NB initiates an IKE negotiation to the neighboring area H(e)NB of the H(e)NB, and finds that the H(e)NB or the neighboring area H(e)NB is not available. Shared key.

 Step 502: The H(e)NB requests the H(e)MS to update the shared key.

 Step 503: The H(e)MS generates an updated shared key for the H(e)NB and the neighboring area H(e)NB of the H(e)NB.

 Step 504: The H(e)MS sends the updated shared key to the H(e)NB through the home base station provisioning process or a dedicated message.

 FIG. 6 is a flowchart of another embodiment of a shared key update method according to the present invention. As shown in FIG. 6, the shared key update method may include:

 Step 601: The H(e)MS finds that the shared key period set by the H(e)MS expires or the H(e)MS finds that the neighboring area of the H(e)NB is updated.

 Step 602: The H(e)MS generates an updated shared key for the H(e)NB and the neighboring area H(e)NB of the H(e)NB.

 Step 603: The H(e)MS sends the updated shared key to the H(e)NB through the home base station provisioning process or a dedicated message.

 In the foregoing embodiment, the H(e)NB can obtain the shared key generated by the H(e)MS as the H(e)NB and the neighboring area H(e)NB of the H(e)NB, and then the H(e)NB An IPsec tunnel can be established with the neighboring zone H(e)NB of the H(e)NB by using the shared key, so that the H(e)NB and the neighboring zone H(e)NB of the H(e)NB can be guaranteed. Direct interface security.

 FIG. 7 is a flowchart of another embodiment of a method for establishing a secure tunnel according to the present invention. In this embodiment, the first base station is HeNB1, the second base station is HeNB2, and the core network device is MME or HeNB GW as an example.

 Step 701: When the HeNB1 wants to establish a direct interface with the HeNB2, the HeNB1 sends a base station configuration forwarding message to the MME or the HeNB GW to request the IP address of the opposite HeNB2.

In this embodiment, in order to negotiate a shared key between the HeNB1 and the HeNB2, the HeNB1 may also carry the DH group number and the DH value in the base station configuration forwarding message. Step 702: The MME or the HeNB GW sends a mobility management entity configuration forwarding message to the HeNB2, where the mobility management entity configures the forwarding message to carry the DH group number and the DH value sent by the HeNB1.

 Step 703: The HeNB2 sends a base station configuration forwarding message to the MME or the HeNB GW, where the base station configures the forwarding message to carry the IP address of the HeNB2, and the DH group number and the DH value selected by the HeNB2.

 Step 704: The MME or the HeNB GW sends a mobility management entity configuration forwarding message to the HeNB1, where the mobility management entity configures the forwarding message to carry the DH group number and the DH value selected by the HeNB2, and the IP address of the HeNB2.

 In step 705, the HeNB1 and the HeNB2 generate a shared key according to the DH group number and the DH value selected by the HeNB2, and establish an IPSec tunnel through the shared key to ensure the security of the direct interface between the HNB1 and the HNB2.

 In the foregoing embodiment, the HeNB1 and the HeNB2 can generate a shared key according to the selected DH group number and the DH value, and the IPSec tunnel can be established through the shared key, so that the security of the direct interface between the HeNB1 and the HeNB2 can be ensured.

 FIG. 8 is a flowchart of another embodiment of a method for establishing a secure tunnel according to the present invention. In this embodiment, the first base station is HeNB1, the second base station is HeNB2, and the core network device is MME or HeNB GW as an example.

 Step 801: When the HeNB1 wants to establish a direct interface with the HeNB2, the HeNB1 sends a base station configuration forwarding message to the MME or the HeNB GW to request the IP address of the opposite HeNB2.

 Step 802: After the MME or the HeNB GW determines that the source node and/or the target node of the base station configuration forwarding message is the HeNB, the MME or the HeNB GW sends a mobility management entity configuration forwarding message to the HeNB2, where the mobility management entity configures that the forwarding message carries the available information. The root certificate for verifying the certificate of HeNB 1.

Specifically, the MME or the HeNB GW may determine, by using the source node identifier and the destination node identifier in the forwarding message, the source node and/or the target node of the base station configuration forwarding message is HeNB. In this embodiment, the source node of the base station configured to forward the message is HeNB1, and the target node is HeNB2. Therefore, the source node and the target node of the base station configured to forward the message are both HeNBs.

 Step 803: The HeNB2 sends a base station configuration forwarding message to the MME or the HeNB GW, where the base station configures the forwarding message to carry the IP address of the HeNB2.

 Step 804: The MME or the HeNB GW sends a mobility management entity configuration forwarding message to the HeNB1, where the mobility management entity configures the forwarding message to carry a root certificate that can be used to verify the HeNB2 certificate, and an IP address of the HeNB2.

 Step 805: HeNB1 and HeNB2 establish an IPSec tunnel through certificate authentication to ensure the security of the direct interface between HeNB1 and HeNB2.

 In the foregoing embodiment, the HeNB1 and the HeNB2 can obtain the root certificate that can be used by the MME or the HeNB GW to verify the peer certificate, so that the HeNB1 and the HeNB2 can establish an IPsec tunnel through the certificate authentication manner, thereby ensuring direct connection between the HeNB1 and the HeNB2. The security of the interface.

 A person skilled in the art can understand that all or part of the steps of implementing the above method embodiments may be completed by using hardware related to program instructions, and the foregoing program may be stored in a computer readable storage medium, and the program is executed when executed. The foregoing steps include the steps of the foregoing method embodiments; and the foregoing storage medium includes: a medium that can store program codes, such as a ROM, a RAM, a magnetic disk, or an optical disk.

 FIG. 9 is a schematic structural diagram of an embodiment of a first base station according to the present invention. The first base station in this embodiment may implement the process of the embodiment shown in FIG. 1 of the present invention. As shown in FIG. 9, the first base station may include:

 The obtaining module 901 is configured to obtain a root certificate used for verifying the second base station certificate or a shared key between the second base station and the first base station; specifically, the obtaining module 901 may receive the second information sent by the core network device for verifying The root certificate of the base station certificate or the core network device is a shared key generated by the second base station and the first base station.

The establishing module 902 is configured to use the shared key or the foregoing to verify the second base station certificate The root certificate establishes an IP _sec tunnel with the second base station to ensure the security of the direct interface between the first base station and the second base station.

 In this embodiment, when the first base station is a home base station, the second base station may be a home base station or a macro base station; or, when the first base station is a macro base station, the second base station may be a home base station; that is, the first At least one of the base station and the second base station may be a home base station. The macro base station may be an eNB or another type of macro base station; the home base station may be an HeNB or an HNB, which is not limited in this embodiment.

 In the foregoing embodiment, the obtaining module 901 can obtain a root certificate for verifying the second base station certificate or a shared key between the second base station and the first base station, so that the establishing module 902 can use the shared key or the foregoing. The root certificate of the second base station certificate is verified to establish an IPsec tunnel with the second base station, so that the security of the interface between the first base station and the second base station can be ensured.

 FIG. 10 is a schematic structural diagram of another embodiment of the first base station according to the present invention. The first base station in this embodiment may implement the process of the embodiment shown in FIG. 1 and FIG. 4 of the present invention, and the first base station shown in FIG. The first base station shown in FIG. 10 may further include: a receiving module 903; or, a receiving module 903 and a requesting module 904; or, a negotiating module 905, a requesting module 904, and a receiving module 903.

 The receiving module 903 is configured to receive, after the expiration of the shared key period set by the core network device, the core network device sent by the core network device as the updated shared key generated by the second base station and the first base station.

 The requesting module 904 is configured to: after the expiration of the shared key period set by the first base station, request the core network device to update the shared key; at this time, the receiving module 903 may further receive the core network device sent by the core network device according to the The updated shared key generated by the request of a base station.

The negotiation module 905 is configured to initiate IKE negotiation to the second base station. At this time, the requesting module 904 may also, when the negotiation module 905 initiates the Internet key exchange negotiation, if the negotiation module 905 finds that the first base station or the second base station is not available. The shared key is sent to the core network device to update the shared key. The receiving module 903 can also receive the core network device according to the core network device. The updated shared key generated by the request of the first base station.

The first base station may establish an IP _sec tunnel with the second base station by using the shared key or the root certificate for verifying the second base station certificate, so that the security of the interface between the first base station and the second base station can be ensured.

 FIG. 11 is a schematic structural diagram of another embodiment of the first base station according to the present invention. The first base station in this embodiment can implement the flow of the embodiment shown in FIG. 1, FIG. 2, FIG. 7 and FIG. 8 of the present invention. The difference from the first base station shown in FIG. 10 is that the first base station shown in FIG. 11 may further include: a sending module 906, configured to send a base station configuration forwarding message to the mobility management entity or the home evolved base station gateway. ;

 In this embodiment, the obtaining module 901 may receive the mobility management entity configuration forwarding message sent by the mobility management entity or the home evolved base station gateway, where the mobility management entity configures the forwarding message to carry the foregoing root certificate for verifying the second base station certificate. Or a shared key generated by the mobility management entity or the home evolved base station gateway for the first base station and the second base station.

 After the mobility management entity configures the forwarding message, the mobility management entity or the home evolved base station gateway receives the base station configuration forwarding message, and determines the base station configuration forwarding message according to the source node identifier and the destination node identifier in the base station configuration forwarding message. After the source node and/or the target node are the home evolved base station, the root certificate to be used for verifying the first base station certificate, or the shared key generated by the mobility management entity or the home evolved base station gateway for the first base station and the second base station is sent to The second base station sends the base station configuration forwarding message sent by the second base station to the first base station.

In this embodiment, the sending module 906 may further send a base station configuration forwarding message to the mobility management entity or the home evolved base station gateway, where the base station configures the forwarding message to carry the DH group number and the DH value of the first base station, so that the mobility management entity or the home The evolved base station gateway sends the DH group number and the DH value of the first base station to the second base station in the first mobility management entity configuration forwarding message. At this time, the receiving module 903 can also receive the mobility management entity or the home evolved base station gateway. The sent second mobility management entity configures a forwarding message, and the second mobility management entity configures forwarding forwarding And carrying the DH group number and the DH value selected by the second base station, where the second mobility management entity configuring the forwarding message is that the mobility management entity or the home evolved base station gateway receives the DH group number that is sent by the second base station and carries the second base station selection. The base station and the DH value are configured to forward the message to the first base station.

 In this embodiment, the obtaining module 901 can generate a shared key according to the DH group number and the DH value selected by the second base station.

 The first base station may establish an IPsec tunnel with the second base station by using a shared key or a root certificate for verifying the second base station certificate, so that the security of the interface between the first base station and the second base station can be ensured.

 FIG. 12 is a schematic structural diagram of another embodiment of the first base station according to the present invention. The first base station in this embodiment may implement the flow of the embodiment shown in FIG. 1 and FIG. 3 of the present invention as an HNB, or a part of the HNB. The difference from the first base station shown in FIG. 11 is that, in an implementation manner of the embodiment shown in FIG. 12, the first base station may further include:

 Registration module 907, configured to register to the home base station gateway;

 The detecting module 908 is configured to detect, after the registration module 907 registers with the home base station gateway, the second base station to register with the home base station gateway;

 At this time, the requesting module 904 may also request the IP address of the second base station from the home base station gateway; the obtaining module 901 may receive a response message sent by the home base station gateway, where the response message carries the IP address of the second base station and the home base station gateway is in advance A shared key generated by a base station and a second base station.

 In another implementation manner of the embodiment, the sending module 906 may further send information about the neighboring home base station detected by the first base station to the home base station gateway, where the neighboring cell home base station of the first base station includes the second base station; The obtaining module 901 may receive information about a neighboring home base station available on the home base station gateway sent by the home base station gateway, and the shared key generated by the home base station gateway as a first base station and a neighboring home base station of the first base station.

The first base station may use a shared key or a root certificate for verifying the second base station certificate. An IPsec tunnel is established with the second base station, so that the security of the interface between the first base station and the second base station can be ensured.

 A person skilled in the art can understand that the drawings are only a schematic diagram of a preferred embodiment, and the modules or processes in the drawings are not necessarily required to implement the invention.

 Those skilled in the art can understand that the modules in the apparatus in the embodiments may be distributed in the apparatus of the embodiment according to the embodiment, or may be correspondingly changed in one or more apparatuses different from the embodiment. The modules of the above embodiments may be combined into one module, or may be further split into a plurality of sub-modules.

 It should be noted that the above embodiments are only for explaining the technical solutions of the present invention, and are not intended to be limiting; although the present invention has been described in detail with reference to the foregoing embodiments, it will be understood by those skilled in the art that: The technical solutions described in the foregoing embodiments are modified, or some of the technical features are equivalently replaced. The modifications and substitutions do not depart from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

Rights request A method for establishing a secure tunnel, comprising:  The first base station obtains a root certificate for verifying the second base station certificate or a shared key between the second base station and the first base station; when the first base station is a home base station, the second base station is a home base station or Or a macro base station; or, when the first base station is a macro base station, the second base station is a home base station;  The first base station establishes an Internet Protocol security tunnel with the second base station by using the shared key or the root certificate for verifying the second base station certificate, to ensure that the first base station and the second base station The security of the interface.  The method according to claim 1, wherein the obtaining, by the first base station, a root certificate for verifying a second base station certificate or a shared key between the second base station and the first base station includes:  The first base station receives a root certificate sent by the core network device for verifying the second base station certificate or the core network device is a shared key generated by the second base station and the first base station.  The method according to claim 2, after the first base station receives the shared key generated by the core network device and the shared key generated by the second base station and the first base station, Also includes:  After the shared key period set by the core network device expires, the first base station receives the update generated by the core network device by the core network device for the second base station and the first base station. Shared key.  The method according to claim 2, after the first base station receives the shared key generated by the core network device and the shared key generated by the second base station and the first base station, Also includes: After the shared key period set by the first base station expires, the first base station requests the core network device to update the shared key, and receives the core network device sent by the core network device according to the An updated shared key generated by a request of a base station; or When the first base station initiates an Internet key exchange negotiation with the second base station, if it is found that the first base station or the second base station does not have a shared key available, the first base station sends the core network to the core network. The device requests to update the shared key, and receives an updated shared key generated by the core network device according to the request of the first base station by the core network device.  The method according to claim 2 or 4, wherein the core network device comprises a mobility management entity or a home evolved base station gateway;  Before the first base station receives the root certificate that is sent by the core network device to verify the second base station certificate, or the core network device is the shared key generated by the second base station and the first base station, the first base station further includes:  Transmitting, by the first base station, a base station configuration forwarding message to the mobility management entity or the home evolved base station gateway;  The first base station receives a root certificate sent by the core network device for verifying the second base station certificate or the shared key generated by the core network device for the second base station and the first base station includes:  The first base station receives a mobility management entity configured to send a forwarding message to the mobility management entity or the home evolved base station gateway, where the mobility management entity configures the forwarding message to carry the verification for the second base station certificate. a root certificate, or a shared key generated by the mobility management entity or the home evolved base station gateway for the first base station and the second base station;  The mobility management entity configures the forwarding message to be determined by the mobility management entity or the home evolved base station gateway after receiving the base station configuration forwarding message, according to the source node identifier and the destination node identifier in the base station configuration forwarding message. After the base station configures the source node and/or the target node of the forwarding message to be the home evolved base station, the root certificate to be used for verifying the first base station certificate, or the mobility management entity or the home evolved base station gateway is the The shared key generated by the base station and the second base station is sent to the second base station, and is sent to the first base station after receiving the base station configuration forwarding message sent by the second base station. The method according to claim 2 or 4, wherein the core network device comprises a home base station gateway; Before the receiving, by the first base station, the core network device sent by the core network device is the shared key generated by the second base station and the first base station, the first base station further includes:  After the first base station registers with the home base station gateway, detecting that the second base station is registered to the home base station gateway;  The first base station requests an internet protocol address of the second base station from the home base station gateway;  The receiving, by the first base station, the shared key generated by the core network device that is sent by the core network device to the second base station and the first base station includes:  Receiving, by the first base station, a response message sent by the home base station gateway, where the response message carries an Internet Protocol address of the second base station and the home base station gateway generates the first base station and the second base station Shared key.  The method according to claim 2 or 4, wherein the core network device comprises a home base station gateway;  Before the first base station receives the shared key generated by the core network device, where the core network device is the second base station and the first base station, the first base station further includes:  The first base station is registered with the home base station gateway, and sends information about the neighboring home base station detected by the first base station to the home base station gateway, where the neighboring cell home base station of the first base station includes the first Two base stations;  The receiving, by the first base station, the shared key generated by the core network device that is sent by the core network device to the second base station and the first base station includes:  Receiving, by the first base station, information about a neighboring home base station available on the home base station gateway sent by the home base station gateway, and the home base station gateway is a neighboring cell family of the first base station and the first base station; The shared key generated by the base station.  The method according to claim 2 or 4, wherein the core network device comprises a home base station gateway; The receiving, by the first base station, the shared key generated by the core network device that is generated by the core network device by the second base station and the first base station includes: The home base station gateway discovers that the information of the neighboring home base station controlled by the home base station gateway is not updated to the first base station, and the first base station and the updated neighboring home base station are not on the home base station gateway. After the shared key, the first base station receives information of the updated neighboring home base station sent by the home base station gateway through the home base station configuration forwarding process, and the home base station gateway is the first base station and the The shared key generated by the updated neighboring home base station.  The method according to claim 1, wherein before the first base station obtains the shared key between the second base station and the first base station, the method further includes:  Transmitting, by the first base station, a base station configuration forwarding message to a mobility management entity or a home evolved base station gateway, where the base station configuration forwarding message carries a Difei-Hellman (DH) group number and a DH value of the first base station, so that The mobility management entity or the home eNodeB gateway carries the DH group number and the DH value of the first base station in the first mobility management entity configuration forwarding message, and sends the message to the second base station;  Receiving, by the first base station, a second mobility management entity configured to send a forwarding message by the mobility management entity or the home eNodeB gateway, where the second mobility management entity configures a forwarding message to carry the second base station selected a DH group number and a DH value, where the second mobility management entity configuration forwarding message is that the mobility management entity or the home evolved base station gateway receives the DH that is sent by the second base station and carries the second base station selection. The base station of the group number and the DH value is configured to forward the message to the first base station;  The obtaining, by the first base station, the shared key between the second base station and the first base station includes: generating, by the first base station, the shared key according to the DH group number and the DH value selected by the second home evolved base station .  10. A first base station, comprising:  And an obtaining module, configured to obtain a root certificate for verifying the second base station certificate or a shared key between the second base station and the first base station; And a establishing module, configured to establish an Internet Protocol security tunnel with the second base station by using the shared key or the root certificate for verifying the second base station certificate, to ensure that the first base station and the first base station The security of the interface between the second base stations.  The base station according to claim 10, wherein the obtaining module is specifically configured to receive a root certificate sent by the core network device for verifying the second base station certificate, or the core network device is the second base station A shared key generated with the first base station.  The base station according to claim 11, further comprising:  a receiving module, configured to receive, after the expiration of the shared key period set by the core network device, the core network device that is sent by the core network device to be updated by the second base station and the first base station Shared key.  The base station according to claim 12, further comprising:  a requesting module, configured to request, after the expiration of the shared key period set by the first base station, an update shared key to the core network device;  The receiving module is further configured to receive, by the core network device, the updated shared key generated by the core network device according to the request of the first base station.  The base station according to claim 13, further comprising:  a negotiation module, configured to initiate an Internet key exchange negotiation to the second base station;  The requesting module is further configured to: when the negotiation module initiates an Internet key exchange negotiation, if the negotiation module finds that the first base station or the second base station does not have a shared key available, The core network device requests to update the shared key.  The base station according to claim 14, further comprising:  a sending module, configured to send a base station configuration forwarding message to the mobility management entity or the home evolved base station gateway;  The obtaining module is configured to receive a mobility management entity configured to send a forwarding message by the mobility management entity or the home eNodeB gateway, where the mobility management entity configures the forwarding message to carry the verification a root certificate of the base station certificate, or a shared key generated by the mobility management entity or the home evolved base station gateway for the first base station and the second base station. The base station according to claim 15, further comprising: a registration module, configured to register to the home base station gateway;  a detecting module, configured to detect, after the registration module is registered to the home base station gateway, that the second base station is registered to the home base station gateway;  The requesting module is further configured to request, by the home base station gateway, an Internet protocol address of the second base station;  The obtaining module is specifically configured to receive a response message sent by the home base station gateway, where the response message carries an Internet Protocol address of the second base station, and the home base station gateway is configured as the first base station and the first The shared key generated by the second base station.  17. The base station according to claim 15, wherein:  The sending module is further configured to send information about the neighboring home base station detected by the first base station to the home base station gateway, where the neighboring cell home base station of the first base station includes the second base station; The module is specifically configured to receive information about a neighboring home base station available on the home base station gateway sent by the home base station gateway, and the home base station gateway is a neighboring cell family of the first base station and the first base station The shared key generated by the base station.  18. The base station according to claim 15, wherein:  The sending module is further configured to send a base station configuration forwarding message to the mobility management entity or the home evolved base station gateway, where the base station configuration forwarding message carries the Difei-Hermann (DH) group number and the DH of the first base station. a value, such that the mobility management entity or the home eNodeB gateway carries the DH group number and the DH value of the first base station in the first mobility management entity configuration forwarding message, and sends the message to the second base station;  The receiving module is further configured to receive a second mobility management entity configured to send a forwarding message sent by the mobility management entity or the home eNodeB gateway, where the second mobility management entity configures a forwarding message to carry the second a DH group number and a DH value selected by the base station, where the second mobility management entity configures the forwarding message to be that the mobility management entity or the home evolved base station gateway receives the second base station and sends the second base station The selected DH group number and the DH value of the base station configuration forwarding message are sent to the first base station; The obtaining module is specifically configured to generate a DH group number and a DH value according to the second base station Into the shared key.