WO2018201440A1 - Communication method, device and system - Google Patents

Abstract

Disclosed in the embodiments of the present invention are a communication method, device and system. Said method comprises: user equipment sending to a source base station an extended service request message; the user equipment receiving an RRC connection release message sent by the source base station, the RRC connection release message comprising an NAS-MAC and a second RRC parameter, the second RRC parameter being a parameter generated from the NAS-MAC, the second RRC parameter comprising redirection information; the user equipment checking the NAS-MAC according to an NAS integrity key of the user equipment and the second RRC parameter; if the NAS-MAC has successfully passed the check, the user equipment being redirected to a target base station indicated by the redirection information. The embodiments of the present invention can be used to perform identity recognition on the source base station, improving the security for the user equipment performing CSFB.

Description

Communication method, device and system Technical field

The present application relates to the field of communications technologies, and in particular, to a communication method, apparatus, and system.

Background technique

In a Long Term Evolution (LTE) network, when a user equipment (UE) makes a call, the network side triggers a Circuit Switched Fallback (CSFB) process to make the user equipment evolved from the generalized The extended universal terrestrial radio access network (E-UTRAN) is disconnected and connected to the GSM/EDGE radio access network (GERAN), or the UMTS terrestrial radio access network (universal) The terrestrial radio access network (UTRAN) enables the network to transmit telephone services through a Circuit Switched Domain (CS domain).

However, the CSFB process occurs before the access layer (AS) is activated. The network side sends a Radio Resource Control (RRC) Connection Release (RRC Connection Release) message to the user equipment. The RRC Connection Release message is sent. With the indication that the user equipment is connected to a target base station, there is no risk of being tampered with, forged or intercepted because the RRC Connection Release message does not have any security protection. For example, there is a man-in-the-middle attack, that is, a 4G pseudo-source base station or a 5G pseudo-source base station uses a strong signal to cause the user equipment to camp on the source base station, and then falsifies the RRC Connection Release message, and passes the indication information in the RRC Connection Release message. The user equipment is connected to another 2G pseudo target base station controlled by the attacker. Because the security protection of 2G is relatively poor compared to 4G and 5G, the attacker can easily initiate other attacks, such as phishing messages, resulting in user equipment. The security is lower.

Summary of the invention

The embodiment of the invention discloses a communication method, device and system, which can identify the source base station and improve the security of the user equipment to perform CSFB.

In a first aspect, the embodiment of the present invention provides a communication method, in which a user equipment sends an Extended Service Request message to a source base station, and the source base station sends a Mobility Management Entity (MME) to the mobility management entity according to the extended service request message. Transmitting a first RRC parameter, the first RRC parameter includes redirection information; the MME generates a non-access stratum-message verification code according to the non-access stratum (NAS) integrity key of the user equipment and the NAS -Message Authentication Code) The second RRC parameter of the NAS-MAC, the NAS-MAC is obtained, the second RRC parameter includes the plaintext or ciphertext of the first RRC parameter; the MME sends the NAS-MAC to the source base station; the source base station sends the RRC to the user equipment a connection release message, the RRC connection release message includes a NAS-MAC and a second RRC parameter for generating a NAS-MAC; the user equipment checks the NAS-MAC according to the NAS integrity key and the second RRC parameter of the user equipment; and when the NAS-MAC When the verification is successful, the user equipment is redirected to the target base station indicated by the redirection information; when the NAS-MAC verification fails, the user equipment disconnects from the source base station.

In this technical solution, the pseudo base station is a base station in the UE side, but it is a UE in the base station side, and the pseudo base station cannot send the correct RRC parameters to the MME. Based on this, the MME according to the embodiment of the present invention is The second RRC parameter sent by the source base station generates a NAS-MAC, and the MME sends the NAS-MAC to the UE through the source base station, and the UE verifies NAS-MAC, when the NAS-MAC check succeeds, the user equipment identifies the source base station as a real base station, and then redirects to the target base station indicated by the redirection information; when the NAS-MAC check fails, the user equipment identifies the source base station. The pseudo base station is disconnected from the source base station, that is, the user equipment can check whether the currently received RRC parameter is a forged parameter or a tampering parameter, thereby preventing the pseudo base station from actively triggering the CSFB. The process is such that the terminal is connected to the pseudo base station of the 2G, and the source base station can be identified to improve the security of the user equipment to perform CSFB.

The extended service request message is encapsulated in an RRC Connection Setup Complete message, and the extended service request message may include service type indication information, where the service type indication information is used to indicate that the service type requested by the UE is CSFB. For example, the call originating CS fallback of the calling party, the mobile terminating CS fallback of the called party, the mobile originating CS fallback emergency call, and the like.

The first RRC parameter may include redirection information, where the redirection information is used to indicate the target base station to which the user equipment is redirected, and the redirection information may include redirection control information or physical cell identity (PCI). At least one of the PCIs, the PCI is used to indicate the base station identity of the target base station to which the user equipment is redirected. When the redirection information includes the redirection control information, the UE may search for the PCI corresponding to the redirection control information, and then the base station corresponding to the PCI is used as the target base station, and is redirected to the target base station. When the redirection information includes the PCI, the UE may use the base station corresponding to the PCI as the target base station, and redirect to the target base station. Optionally, the first RRC parameter may further include a release cause (ReleaseCause, the cause value is fixed as CS Fallback High Priority), or system information related to PCI, and the like.

The second RRC parameter may include plaintext or ciphertext of the first RRC parameter. When the second RRC parameter includes the plaintext of the first RRC parameter, the second RRC parameter is the same as the first RRC parameter. After the second RRC parameter includes the ciphertext of the first RRC parameter, after receiving the first RRC parameter sent by the source base station, the MME may encrypt the first RRC parameter according to the NAS encryption key of the user equipment, to obtain the first RRC. The ciphertext of the parameter, and the ciphertext of the first RRC parameter is used as the second RRC parameter. Optionally, when the second RRC parameter includes the ciphertext of the first RRC parameter, after receiving the first RRC parameter sent by the source base station, the MME may be configured according to the Access Security Management Entity (ASME) of the user equipment. And the NAS count (NAS COUNT), the derived NAS encryption key is obtained, and the MME can encrypt the first RRC parameter by using the derived NAS encryption key to obtain the ciphertext of the first RRC parameter, and the first RRC parameter The ciphertext is used as the second RRC parameter.

Optionally, the MME may perform integrity protection on the second RRC parameter by using a NAS integrity key of the user equipment to generate a NAS-MAC.

Optionally, the MME may perform integrity protection on the second RRC parameter and the NAS count by using the NAS integrity key of the user equipment to generate a NAS-MAC; the MME sends the NAS-MAC and the NAS count part bits to the source. The base station sends an RRC connection release message to the user equipment, where the connection release message includes a NAS-MAC, a second RRC parameter, and a partial bit of the NAS count; the user equipment acquires the NAS count according to a part of the bit counted by the NAS; the user equipment The NAS-MAC is verified according to the NAS integrity key, the second RRC parameter, and the NAS count of the user equipment.

In this technical solution, the NAS count is the freshness parameter of the NAS layer, and the NAS count can be updated in real time, and the NAS-MAC generated by the MME is different each time, and can resist the replay attack.

Optionally, the MME obtains the derived NAS integrity key according to the ASME key of the user equipment and the NAS count. Key; the MME uses the derived NAS integrity key to perform integrity protection on the second RRC parameter to generate a NAS-MAC; the MME sends the NAS-MAC and NAS counted partial bits to the source base station; the source base station sends the user base station RRC connection release message, the RRC connection release message includes the NAS-MAC, the second RRC parameter, and a partial bit of the NAS count; the user equipment acquires the NAS count according to the partial bit counted by the NAS; the user equipment is based on the ASME key of the user equipment And NAS counting, obtaining a derived NAS integrity key; the user equipment checks the NAS-MAC according to the derived NAS integrity key and the second RRC parameter.

In this technical solution, the NAS count is the freshness parameter of the NAS layer, and the NAS count can be updated in real time, and the derived NAS integrity keys obtained according to the NAS count each time are different, based on the derived NAS integrity key. The generated NAS-MACs are also different and can resist replay attacks.

Optionally, the MME encrypts the first RRC parameter by using the NAS encryption key of the user equipment to obtain a second RRC parameter; the MME uses the NAS integrity key of the user equipment to perform integrity protection on the second RRC parameter to generate the NAS. -MAC; the MME sends the NAS-MAC to the source base station; the source base station sends an RRC connection release message to the user equipment, the connection release message includes a NAS-MAC and a second RRC parameter; and the user equipment is based on the NAS integrity of the user equipment. The key and the second RRC parameter are used to check the NAS-MAC. When the NAS-MAC check succeeds, the user equipment decrypts the second RRC parameter by using the NAS encryption key of the user equipment to obtain redirection information; To the target base station indicated by the redirect information.

In the technical solution, the MME encrypts and protects the first RRC parameter sent by the source base station, and prevents the first RRC parameter from being forged, falsified, or monitored, and improves the security of the user equipment.

Optionally, the MME encrypts the first RRC parameter by using the NAS encryption key of the user equipment to obtain a second RRC parameter; the MME uses the NAS integrity key of the user equipment to perform integrity protection on the second RRC parameter and the NAS count. Generating a NAS-MAC; the MME sends the NAS-MAC and the NAS to count the partial bits to the source base station; the source base station sends an RRC connection release message to the user equipment, where the connection release message includes the NAS-MAC, the second RRC parameter, and the NAS. Counting the partial bits; the user equipment obtains the NAS count according to the partial bits counted by the NAS; the user equipment checks the NAS-MAC according to the NAS integrity key, the second RRC parameter, and the NAS count of the user equipment; when NAS- When the MAC check succeeds, the user equipment decrypts the second RRC parameter by using the NAS encryption key of the user equipment to obtain redirection information; the user equipment is redirected to the target base station indicated by the redirection information.

In this technical solution, the NAS count is the freshness parameter of the NAS layer, and the NAS count can be updated in real time, and the NAS-MAC generated by the MME is different each time, and can resist the replay attack. In addition, the MME encrypts and protects the first RRC parameter sent by the source eNB, and prevents the first RRC parameter from being forged, falsified, or monitored, and improves the security of the user equipment.

Optionally, the MME obtains the derived NAS integrity key and the derived NAS encryption key according to the ASME key and the NAS count of the user equipment; the MME encrypts the first RRC parameter by using the derived NAS encryption key to obtain the first a second RRC parameter; the MME performs integrity protection on the second RRC parameter by using the derived NAS integrity key to generate a NAS-MAC; the MME sends the NAS-MAC and the NAS to count the partial bits to the source base station; the source base station to the user The device sends an RRC connection release message, where the RRC connection release message includes the NAS-MAC, the second RRC parameter, and a part of the bit counted by the NAS; the user equipment acquires the NAS count according to part of the bit counted by the NAS; and the user equipment is based on the ASME of the user equipment. Key and NAS count, obtaining a derived NAS integrity key and a derived NAS encryption key; the user equipment verifies the NAS-MAC according to the derived NAS integrity key and the second RRC parameter; When the NAS-MAC check succeeds, the user equipment decrypts the second RRC parameter using the derived NAS encryption key to obtain redirection information; the user equipment redirects to the target base station indicated by the redirection information.

In this technical solution, the NAS count is a freshness parameter of the NAS layer, and the NAS count can be updated in real time, and each time the derived NAS integrity key and the derived NAS encryption key obtained according to the NAS count are different, based on The second RRC parameters obtained by the derived NAS encryption key are different, and the NAS-MAC generated based on the derived NAS integrity key is also different, and can resist the replay attack. In addition, the MME encrypts and protects the first RRC parameter sent by the source eNB, and prevents the first RRC parameter from being forged, falsified, or monitored, and improves the security of the user equipment.

In a second aspect, an embodiment of the present invention provides a computer storage medium, where the computer storage medium stores a program, and the program includes all or part of the steps of the communication method provided by the first aspect of the embodiment of the present invention.

In a third aspect, an embodiment of the present invention provides a communication apparatus, where the communication apparatus includes a module for performing the communication method disclosed in the first aspect of the embodiment of the present invention.

In a fourth aspect, an embodiment of the present invention provides a base station, including a processor, a memory, and a transceiver. The memory stores a set of program codes, and the processor calls the program code stored in the memory to perform the following operations. :

Receiving an extended service request message from the user equipment, and sending, according to the extended service request message, a first RRC parameter, where the first RRC parameter includes redirection information, the redirection information is used to indicate a target base station that is redirected by the user equipment, and the NAS is received from the MME. -MAC; sending an RRC connection release message to the user equipment, the RRC connection release message including the NAS-MAC and the second RRC parameter for generating the NAS-MAC, the second RRC parameter including the plaintext or ciphertext of the first RRC parameter.

In a fifth aspect, an embodiment of the present invention provides a user equipment, including: a processor, a memory, and a transceiver, wherein the memory stores a set of program codes, and the processor calls the program code stored in the memory, and is configured to execute the following: operating:

Sending an extended service request message to the source base station; receiving an RRC connection release message sent by the source base station, where the RRC connection release message includes a NAS-MAC and a second RRC parameter for generating a NAS-MAC, where the second RRC parameter includes redirection information; The NAS integrity key and the second RRC parameter check the NAS-MAC; when the NAS-MAC check succeeds, redirect to the target base station indicated by the redirect information.

In a sixth aspect, an embodiment of the present invention provides an MME, including a processor, a memory, and a transceiver, where a set of program codes is stored in the memory, and the processor calls the program code stored in the memory to perform the following operations. :

Receiving a first RRC parameter from a source base station of the user equipment, where the first RRC parameter includes redirection information, the redirection information is used to indicate a target base station that is redirected by the user equipment, and the NAS integrity key is generated according to the user equipment and the NAS-MAC is generated. The second RRC parameter obtains a NAS-MAC, and the second RRC parameter includes a plaintext or a ciphertext of the first RRC parameter; and sends the NAS-MAC to the source base station.

The seventh aspect of the present invention provides a communication system, including the base station disclosed in the fourth aspect of the embodiment of the present invention, the user equipment disclosed in the fifth aspect, and the MME disclosed in the sixth aspect.

DRAWINGS

In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the background art, the drawings to be used in the embodiments of the present invention or the background art will be described below.

1 is a schematic structural diagram of a communication system according to an embodiment of the present invention;

2 is a schematic flow chart of a communication method according to an embodiment of the present invention;

3 is a schematic flow chart of a communication method according to another embodiment of the present invention;

4 is a schematic flow chart of a communication method according to another embodiment of the present invention;

FIG. 5 is a schematic flowchart of a communication method according to another embodiment of the present invention; FIG.

6 is a schematic flow chart of a communication method according to another embodiment of the present invention;

FIG. 7 is a schematic flowchart of a communication method according to another embodiment of the present invention; FIG.

FIG. 8 is a schematic flowchart diagram of a communication method according to another embodiment of the present invention; FIG.

FIG. 9 is a schematic flowchart diagram of a communication method according to another embodiment of the present invention; FIG.

FIG. 10 is a schematic flowchart diagram of a communication method according to another embodiment of the present invention; FIG.

11 is a schematic structural diagram of a communication apparatus according to an embodiment of the present invention;

FIG. 12 is a schematic structural diagram of a base station according to an embodiment of the present disclosure;

FIG. 13 is a schematic structural diagram of a communication apparatus according to another embodiment of the present invention; FIG.

FIG. 14 is a schematic structural diagram of a user equipment according to an embodiment of the present disclosure;

FIG. 15 is a schematic structural diagram of a communication apparatus according to another embodiment of the present invention; FIG.

16 is a schematic structural diagram of a mobility management entity according to an embodiment of the present invention;

FIG. 17 is a schematic structural diagram of a communication system according to an embodiment of the present invention.

detailed description

The embodiments of the present invention are described below in conjunction with the accompanying drawings in the embodiments of the present invention.

For a better understanding of a communication method and apparatus disclosed in the embodiments of the present invention, a network architecture to which the embodiments of the present invention are applied is first described. Referring to FIG. 1, FIG. 1 is a schematic structural diagram of a communication system according to an embodiment of the present invention. As shown in FIG. 1, the communication system may include a user equipment 10, a General Packet Radio Service (GPRS) service support node (SGSN) 20, and an MME 30. The user equipment 10, the SGSN 20, and the MME 30 can perform data transmission through a communication connection.

The user equipment 10 may establish a communication connection with the MME 30 through the E-UTRAN, and the base station in the E-UTRAN may include an evolved base station (eNB) or the like. The user equipment 10 can establish a communication connection with the SGSN 20 through the UTRAN or the GERAN. The base station in the UTRAN can include a Base Transceiver Station (BTS) or a Base Station Controller (BSC), and the base station in the GERAN. It may include a base station (NodeB, NB) or a radio network controller (RNC). Wait.

The user equipment 10 may be referred to as a mobile station, an access terminal, a subscriber unit, a subscriber station, a mobile station, a remote station, a remote terminal, a mobile device, a terminal, a wireless communication device, a user agent, or a user device, etc., which may specifically be Stations in the WLAN (Station, ST), cellular phones, cordless phones, Session Initiation Protocol (SIP) phones, Wireless Local Loop (WLL) stations, Personal Digital Assistant (PDA) ), handheld devices with wireless communication capabilities, computing devices, other processing devices connected to wireless modems, in-vehicle devices, wearable devices, mobile stations in future 5G networks, and the future evolution of the Public Land Mobile Network (Public Land Mobile Network, PLMN) Any of terminal devices and the like in the network.

The MME 30 is a key control node of the 3GPP protocol LTE access network, and can be used for encryption and integrity protection of NAS signaling.

It should be understood that the technical solutions of the embodiments of the present invention can be applied to various communication systems, for example, Global System for Mobile Communication (GSM), Code Division Multiple Access (CDMA) system, and wideband code. Wideband Code Division Multiple Access (WCDMA) system, General Packet Radio Service (GPRS), LTE system, LTE Frequency Division Duplex (FDD) system, LTE time division duplex (Time Division Duplex, referred to as TDD), Universal Mobile Telecommunication System (UMTS) or Worldwide Interoperability for Microwave Access (WiMAX) communication system.

FIG. 2 is a schematic diagram of a communication method according to the embodiment of the present invention. The method includes, but is not limited to, the following steps:

Step S201: The source base station receives an extended service request message from the user equipment.

The source base station may be an eNB in an LTE system.

The extended service request message may be encapsulated in an RRC connection setup complete message.

The extended service request message may include service type indication information, where the service type indication information is used to indicate that the service type requested by the UE is CSFB, for example, the circuit switched domain of the calling party falls back, the called circuit switched domain falls back, and the emergency call is The circuit switched domain falls back and so on.

Step S202: The source base station sends a first RRC parameter to the MME according to the extended service request message, where the first RRC parameter includes redirection information.

The first RRC parameter includes redirection information, and the redirection information is used to indicate a target base station that is redirected by the user equipment.

The redirection information may include at least one of redirection control information and PCI.

The redirection control information may be used to indicate a target base station to which the user equipment is redirected, for example, may be an identifier of the target base station.

The PCI can be used to distinguish different cells. For example, the cell corresponding to the PCI can be searched, and the base station to which the cell belongs is used as the target base station, so as to be redirected to the target base station.

The first RRC parameter may be part or all parameters included in the RRC connection release message sent by the source base station to the UE, for example, redirection information, release reason, system information related to the PCI, and the like.

The PCI related system information includes system parameters of a cell corresponding to the PCI, for example, a service frequency point, a neighbor frequency point, normal or shared channel information, and the like.

Step S203: The source base station receives the NAS-MAC from the MME.

In one example, the method further includes the source base station receiving a partial bit of the NAS count from the MME.

In an example, the method further includes the source base station receiving the second RRC parameter from the MME. The second RRC parameter is a generation parameter of the NAS-MAC, and the second RRC parameter includes a plaintext or a ciphertext of the first RRC parameter.

Step S204: The source base station sends an RRC connection release message to the user equipment, where the RRC connection release message includes a NAS-MAC and a second RRC parameter.

In an example, if the source base station receives a partial bit of the NAS count from the MME, the RRC Connection Release message sent by the source base station to the user equipment may further include a partial bit of the NAS count, for example, the lower 4 bits of the NAS count.

In an example, if the source eNB receives the second RRC parameter from the MME, the RRC connection release message sent by the source base station to the user equipment may further include the second RRC parameter.

In the method described in FIG. 2, the source base station sends a first RRC parameter to the MME according to the extended service request message sent by the user equipment, receives the NAS-MAC from the MME, and sends an RRC connection release message to the user equipment, where the RRC connection release message includes The NAS-MAC and the second RRC parameter, the second RRC parameter is a NAS-MAC generation parameter, and the second RRC parameter includes a plaintext or a ciphertext of the first RRC parameter, and the pseudo base station cannot notify the MME of the correct first RRC parameter. Therefore, the user equipment cannot be sunk to 2G by tampering with the first RRC parameter, and the security of the user equipment to perform CSFB is improved.

FIG. 3 is a schematic diagram of a communication method according to an embodiment of the present invention. The method includes, but is not limited to, the following steps:

Step S301: The user equipment sends an extended service request message to the source base station.

Step S302: The user equipment receives an RRC connection release message sent by the source base station, where the RRC connection release message includes a NAS-MAC and a second RRC parameter.

The second RRC parameter is a generation parameter of the NAS-MAC, and the second RRC parameter includes redirection information, where the redirection information is used to indicate the target base station to which the user equipment is redirected.

The second RRC parameter may include plaintext or ciphertext of the first RRC parameter.

The first RRC parameter may include redirection information.

In one example, the RRC Connection Release message may also include a partial bit of the NAS count.

It should be noted that the foregoing first RRC parameter, the second RRC parameter, the NAS count, and the redirection information can be referred to the related description in the embodiment shown in FIG. 2, and details are not described herein again.

Step S303: The user equipment checks the NAS-MAC according to the NAS integrity key of the user equipment and the second RRC parameter.

In an example, the user equipment may perform integrity protection on the second RRC parameter based on the NAS integrity algorithm between the MME and the NAS integrity key of the user equipment to generate a NAS-MAC; the user equipment the user The NAS-MAC generated by the device is compared with the NAS-MAC in the RRC connection release message. When the NAS-MAC generated by the user equipment and the NAS-MAC in the RRC connection release message are the same, the NAS-MAC check succeeds. When the NAS-MAC generated by the user equipment is different from the NAS-MAC in the RRC Connection Release message, the NAS-MAC check fails.

In another example, if the RRC connection release message includes a partial bit of the NAS count, the user equipment may acquire the NAS count according to the partial bits of the NAS count, and according to the NAS integrity key, the second RRC parameter, and the NAS count. , verify the NAS-MAC.

In a specific implementation, the user equipment may obtain the NAS count corresponding to the partial bits of the NAS count according to the correspondence between the partial bits of the NAS count and the NAS count. The user equipment may perform integrity protection on the second RRC parameter and the acquired NAS count based on the NAS integrity algorithm between the MME and the NAS integrity key of the user equipment to generate a NAS-MAC; the user equipment will The NAS-MAC generated by the user equipment is compared with the NAS-MAC in the RRC connection release message. When the NAS-MAC generated by the user equipment and the NAS-MAC in the RRC connection release message are the same, the NAS-MAC check succeeds; When the NAS-MAC generated by the user equipment is different from the NAS-MAC in the RRC Connection Release message, the NAS-MAC check fails.

In another example, if the RRC connection release message includes a partial bit of the NAS count, the user equipment may acquire the NAS count according to the partial bits of the NAS count, according to the ASME key (eg, Kasme) and NAS count of the user equipment. Obtain a derived NAS integrity key and verify the NAS-MAC according to the derived NAS integrity key and the second RRC parameter.

In a specific implementation, the user equipment may process the ASME key of the user equipment and the obtained NAS count by using a key derivation algorithm between the user equipment and the MME to obtain a derived NAS integrity key. The user equipment may perform integrity protection on the second RRC parameter based on the NAS integrity algorithm between the MME and the obtained NAS integrity algorithm to generate the NAS-MAC. The user equipment compares the NAS-MAC generated by the user equipment with the NAS-MAC in the RRC connection release message. When the NAS-MAC generated by the user equipment and the NAS-MAC in the RRC connection release message are the same, the NAS-MAC school The success is successful; when the NAS-MAC generated by the user equipment and the NAS-MAC in the RRC Connection Release message are different, the NAS-MAC check fails.

Step S304: When the NAS-MAC verification is successful, the user equipment is redirected to the target base station indicated by the redirection information.

In an example, when the NAS-MAC check succeeds and the second RRC parameter is the ciphertext of the first RRC parameter, the user equipment may decrypt the second RRC parameter by using the NAS encryption key of the user equipment, and obtain the weight. The information is directed and redirected to the target base station indicated by the redirect information.

In another example, when the NAS-MAC check succeeds and the second RRC parameter is the ciphertext of the first RRC parameter, the user equipment may obtain the derived NAS encryption key according to the ASME key and the NAS count of the user equipment. Decrypting the second RRC parameter using the derived NAS encryption key, obtaining redirection information, and redirecting to the target base station indicated by the redirection information.

In another example, when the NAS-MAC check fails, the user equipment can disconnect from the source base station.

In the method described in FIG. 3, the user equipment receives the NAS-MAC and the second RRC parameter sent by the source base station, the second RRC parameter is a NAS-MAC generation parameter, and the second RRC parameter includes redirection information, and the user equipment is based on the user. The NAS integrity key and the second RRC parameter of the device verify the NAS-MAC. When the NAS-MAC check succeeds, the user equipment is redirected to the target base station indicated by the redirection information, and the user equipment passes the verification NAS-MAC. The identification of the source base station can improve the security of the user equipment to perform CSFB.

FIG. 4 is a schematic diagram of a communication method according to the embodiment of the present invention. The method includes, but is not limited to, the following steps:

Step S401: The MME receives the first RRC parameter from the source base station of the user equipment, where the first RRC parameter includes redirection information.

Step S402: The MME obtains the NAS-MAC according to the NAS integrity key of the user equipment and the second RRC parameter, and the second RRC parameter is a generation parameter of the NAS-MAC.

For example, the MME may perform integrity protection on the second RRC parameter based on the NAS integrity algorithm negotiated with the user equipment and the NAS integrity key of the user equipment to generate a NAS-MAC.

The second RRC parameter may include plaintext or ciphertext of the first RRC parameter.

For the second RRC parameter, the first RRC parameter, and the redirection information, refer to the related description in the embodiment shown in FIG. 2, and details are not described herein.

In an example, the MME may perform integrity protection on the second RRC parameter using the NAS integrity key of the user equipment to generate a NAS-MAC. The second RRC parameter in this example may be the plaintext of the first RRC parameter.

In another example, the MME may perform integrity protection on the second RRC parameter and the NAS count using the NAS integrity key of the user equipment to generate a NAS-MAC. The second RRC parameter in this example may be the plaintext of the first RRC parameter.

In another example, before obtaining the NAS-MAC according to the NAS integrity key and the second RRC parameter of the user equipment, the MME may use the NAS encryption key of the user equipment to encrypt the first RRC parameter to obtain the second RRC. parameter. The second RRC parameter in this example may be the ciphertext of the first RRC parameter.

In another example, the MME may obtain a derived NAS integrity key according to the ASME key and the NAS count of the user equipment, and perform integrity protection on the second RRC parameter using the derived NAS integrity key to generate a NAS-MAC. . The second RRC parameter in this example may be the plaintext of the first RRC parameter.

In another example, before obtaining the NAS-MAC according to the NAS integrity key and the second RRC parameter of the user equipment, the MME may obtain the derived NAS encryption key according to the ASME key and the NAS count of the user equipment, and use The derived NAS encryption key encrypts the first RRC parameter to obtain a second RRC parameter. The second RRC parameter in this example may be the ciphertext of the first RRC parameter.

Step S403: The MME sends the NAS-MAC to the source base station.

In an example, if the MME encrypts the first RRC parameter by using the NAS encryption key of the user equipment, the second RRC parameter is obtained, and the NAS is obtained according to the NAS integrity key of the user equipment and the second RRC parameter. MAC, the MME may send the NAS-MAC and the second RRC parameter to the source base station.

In another example, if the MME obtains the derived NAS encryption key according to the ASME key and the NAS count of the user equipment, the first RRC parameter is encrypted by using the derived NAS encryption key to obtain the second RRC parameter, and Obtaining the NAS-MAC according to the NAS integrity key of the user equipment and the second RRC parameter, the MME may send the NAS-MAC and the second RRC parameter to the source base station.

In another example, if the MME performs integrity protection on the second RRC parameter and the NAS count using the NAS integrity key of the user equipment to generate the NAS-MAC, the MME may send the NAS-MAC and the NAS to the source base station. Part of the bit counted.

In another example, if the MME obtains the derived NAS integrity key according to the ASME key and the NAS count of the user equipment, and uses the derived NAS integrity key to perform integrity protection on the second RRC parameter to generate the NAS-MAC. The MME may send the NAS-MAC and some bits of the NAS count to the source base station.

In another example, if the MME obtains the derived NAS integrity key and the derived NAS encryption key according to the ASME key and the NAS count of the user equipment, and the MME uses the derived NAS encryption key to perform the first RRC parameter. Encrypting, obtaining the second RRC parameter, and performing integrity protection on the second RRC parameter by using the derived NAS integrity key to generate a NAS-MAC, where the MME may send the NAS-MAC and the NAS count part of the bit to the source base station. .

In the method described in FIG. 4, the MME receives a first RRC parameter from a source base station of the user equipment, where the first RRC parameter includes redirection information, and obtains NAS-MAC according to the NAS integrity key and the second RRC parameter of the user equipment. The second RRC parameter is a NAS-MAC generation parameter, and sends a NAS-MAC to the source base station. The MME uses the NAS integrity key of the UE to perform integrity protection on the second RRC parameter, thereby avoiding tampering with the first RRC parameter. Improve the security of user equipment to perform CSFB.

FIG. 5 is a schematic diagram of a communication system according to the embodiment of the present invention. The method includes, but is not limited to, the following steps:

Step S501: The UE sends an extended service request message to the source base station.

The source base station may be an eNB in an LTE system.

In one example, when the UE is ready to connect to the network, the UE may send an Extended Service Request message to the eNB.

In another example, when the UE is ready to connect to the network, the UE may actively send an RRC Connection Request (RRC Conncetion Request) message to the eNB, and the RRC connection request message may carry an establishment cause of the UE requesting to establish an RRC connection. The eNB transmits an RRC Connection Setup message to the UE in response to the RRC Connection Request message. The UE transmits an extended service request message carrying the service type indication information to the eNB in response to the RRC connection setup message.

The service type indication information is used to indicate that the service type requested by the UE is CSFB, for example, the circuit switched domain of the calling party falls back, the circuit switched domain of the called party falls back, and the circuit switched domain of the emergency call falls back.

Step S502: The source base station sends the first RRC parameter to the MME according to the extended service request message.

The first RRC parameter includes redirection information, and the redirection information is used to indicate a target base station that is redirected by the user equipment.

The redirection information may include at least one of redirection control information and PCI.

It should be noted that the redirection information, the redirection control information, the PCI, the first RRC parameter, the second RRC parameter, and the like may be referred to the related description in the implementation shown in any of the figures in FIG.

Taking the source base station as an eNB as an example, after the UE sends an extended service request message to the eNB, the eNB may send an initializing UE message to the MME, and the initializing UE message carries the first RRC parameter. The first RRC parameter may be part or all parameters included in the RRC connection release message sent by the eNB to the UE, for example, redirection information, release reason, system information related to the PCI, and the like. The initialization UE message may be encapsulated with an extended service request message.

Optionally, taking the source base station as an eNB as an example, before the eNB sends the initializing UE message to the MME, the eNB may The following two methods are used to learn that the first RRC parameter needs to be carried in the initialization UE message.

The first mode: if the UE actively sends an RRC connection request message to the eNB, the eNB may acquire the reason that the UE carried in the RRC connection request message requests to establish an RRC connection, and the reason that the UE requests to establish an RRC connection indicates that the UE will initiate the CSFB or initiate the initiation. When the connection type includes CSFB, the eNB may send an initialization UE message carrying the first RRC parameter to the MME.

The second mode: When the eNB receives the extended service request message, the eNB may send an initial UE message carrying the first RRC parameter to the MME. Optionally, the eNB may identify the service type indication information carried in the extended service request message, and when the service type indication information is used to indicate that the service type requested by the UE is CSFB, the eNB may send the initialization that carries the first RRC parameter to the MME. UE message.

Step S503: The MME performs integrity protection on the second RRC parameter by using the NAS integrity key of the UE, and generates a NAS-MAC.

In an example, after receiving the initialization UE message, the MME may decide to perform CSFB according to the extended service request message, and then based on the NAS integrity algorithm negotiated with the UE, and the NAS integrity key Knas-int pair of the UE. The second RRC parameter performs integrity protection to generate a NAS-MAC.

The second RRC parameter may be the plaintext of the first RRC parameter.

Step S504: The MME sends the NAS-MAC to the source base station.

Taking the source base station as an eNB as an example, the MME may send a UE Context Modification Request message to the eNB, and the UE context change request message may include the generated NAS-MAC.

In an example, the UE context change request message may further include CS Fallback Indication information, where the CSFB indication information is used to indicate that the source base station performs CSFB on the UE.

Step S505: The source base station sends an RRC connection release message to the UE, where the RRC connection release message includes a NAS-MAC and a second RRC parameter.

In an example, if the UE context change request message includes CSFB indication information, the source base station may send an RRC connection release message to the UE in response to the CSFB indication information, where the RRC connection release message may include the NAS in the UE context change request message. MAC and second RRC parameters.

In another example, the source base station may update the first RRC parameter according to the UE context change request message, and the source base station may compare the first RRC parameter sent to the MME in step S502 with the updated first RRC parameter, When the first RRC parameter sent to the MME and the updated first RRC parameter are different in step S502, the source base station may send the updated first RRC parameter to the MME, and the MME is updated based on the updated first RRC parameter. The second RRC parameter is followed, and the updated second RRC parameter is used for integrity protection using the NAS integrity key of the UE to generate an updated NAS-MAC, and the source base station receives the updated NAS-MAC sent by the MME. Thereafter, the RRC connection release message may be sent to the UE, where the RRC connection release message includes the updated NAS-MAC and the updated second RRC parameter. When the source eNB does not update the first RRC parameter, the source eNB may determine that the first RRC parameter remains unchanged, that is, the first RRC parameter sent to the MME in step S502 is the same as the second RRC parameter that needs to be sent to the UE, and the source The base station may send an RRC connection release message to the UE, where the RRC connection release message includes the NAS-MAC generated by the MME in step S503 and the first RRC parameter sent to the MME in step S502.

Step S506: The UE checks the NAS-MAC by using the NAS integrity key and the second RRC parameter of the UE.

In a specific implementation, the UE may use its own NAS based on the NAS integrity algorithm negotiated with the MME. The integrity key protects the integrity of the second RRC parameter to generate a NAS-MAC, and the UE can compare the NAS-MAC generated by the UE with the NAS-MAC in the RRC Connection Release message, and the NAS-MAC generated by the UE When the NAS-MAC in the RRC Connection Release message is the same, the UE may determine that the NAS-MAC check is successful; when the NAS-MAC generated by the UE and the NAS-MAC in the RRC Connection Release message are different, the UE may determine the NAS-MAC calibration. The test failed.

Step S507: When the NAS-MAC check succeeds, the UE redirects to the target base station indicated by the redirection information.

Exemplarily, when the NAS-MAC check is successful, the UE may redirect to the 2G base station indicated by the redirection information to implement CSFB.

Step S508: When the NAS-MAC check fails, the UE disconnects from the source base station.

In a specific implementation, when the NAS-MAC check fails, the UE may release the currently connected source base station and reselect one base station to access.

In the method described in FIG. 5, the MME performs integrity protection on the second RRC parameter using the NAS integrity key of the UE to generate a NAS-MAC, because the pseudo base station cannot notify the MME by initializing the UE message by correcting the first RRC parameter. It does not have the NAS integrity key of the UE, so the UE cannot be sunk to 2G by tampering with the second RRC parameter, and a threat scenario is solved. After the NAS-MAC check fails, the UE can disconnect from the pseudo base station. The connection between the two increases the security of the UE.

FIG. 6 is a schematic diagram of a communication method according to another embodiment of the present invention. The method includes, but is not limited to, the following steps:

Step S601: The UE sends an extended service request message to the source base station.

For the step S601 in the embodiment of the present invention, reference may be made to the step S501 in the fifth embodiment, which is not described in detail in the embodiment of the present invention.

Step S602: The source base station sends the first RRC parameter to the MME according to the extended service request message.

For the step S602 in the embodiment of the present invention, reference may be made to the step S502 in the fifth embodiment, which is not described in detail in the embodiment of the present invention.

Step S603: The MME performs integrity protection on the second RRC parameter and the NAS count by using the NAS integrity key of the UE, and generates a NAS-MAC.

In an example, after receiving the initial UE message sent by the source base station, the MME may acquire the NAS count in the context of the corresponding UE, and based on the NAS integrity algorithm negotiated with the UE, and the NAS integrity key of the UE. And performing integrity protection on the second RRC parameter and the acquired NAS count to generate a NAS-MAC.

The NAS count obtained by the MME may be a downlink NAS count.

The second RRC parameter may be the plaintext of the first RRC parameter.

Step S604: The MME sends partial bits of the NAS-MAC and NAS count to the source base station.

Taking the source base station as an eNB as an example, the MME may send a UE context change request message to the eNB, where the UE context change request message may include the generated NAS-MAC and a part of the bit counted by the NAS. Illustratively, the partial bits of the NAS count can be the lower 3-8 bits of the NAS count.

In one example, the UE Context Change Request message may further include CSFB indication information for indicating that the source base station performs CSFB on the UE.

Step S605: The source base station sends an RRC connection release message to the UE, where the RRC connection release message includes a NAS-MAC, a second RRC parameter, and a partial bit of the NAS count.

In an example, if the UE context change request message includes CSFB indication information, the source base station may send an RRC connection release message to the UE in response to the CSFB indication information, where the RRC connection release message may include the NAS in the UE context change request message. The MAC, the second RRC parameter, and a partial bit of the NAS count sent by the MME to the source base station.

In another example, the source base station may update the first RRC parameter according to the UE context change request message, and the source base station may compare the first RRC parameter sent to the MME in step S602 with the updated first RRC parameter, When the first RRC parameter sent to the MME and the updated first RRC parameter are different in step S602, the source base station may send the updated first RRC parameter to the MME, and the MME is updated based on the updated first RRC parameter. The second RRC parameter is followed, and the updated second RRC parameter and the NAS count are integrity-protected using the NAS integrity key of the UE, and the updated NAS-MAC is generated, and the source base station receives the updated MME sent After the NAS-MAC, the RRC connection release message may be sent to the UE, where the RRC connection release message includes the updated NAS-MAC, the updated second RRC parameter, and a partial bit of the NAS count. When the source eNB does not update the first RRC parameter, the source eNB may determine that the first RRC parameter remains unchanged, that is, the first RRC parameter sent to the MME in step S602 is the same as the second RRC parameter that needs to be sent to the UE, and the source The base station may send an RRC connection release message to the UE, where the RRC connection release message includes the NAS-MAC generated by the MME in step S603, the first RRC parameter sent to the MME in step S602, and a partial bit of the NAS count.

Step S606: The UE acquires the NAS count according to part of the bits counted by the NAS.

In a specific implementation, the UE may obtain the NAS count corresponding to the partial bits of the NAS count according to the correspondence between the partial bits of the NAS count and the NAS count. The partial bits of each NAS count and their corresponding NAS counts may be pre-stored in the memory of the UE.

Step S607: The UE checks the NAS-MAC by using the NAS integrity key of the UE, the second RRC parameter, and the acquired NAS count.

In a specific implementation, the UE may perform integrity protection on the second RRC parameter and the acquired NAS count based on the NAS integrity algorithm negotiated with the MME and the NAS integrity key of the UE, and generate a NAS-MAC. The UE may compare the NAS-MAC generated by the UE with the NAS-MAC in the RRC Connection Release message. When the NAS-MAC generated by the UE and the NAS-MAC in the RRC Connection Release message are the same, the UE may determine the NAS-MAC check. Successful; when the NAS-MAC generated by the UE and the NAS-MAC in the RRC Connection Release message are different, the UE may determine that the NAS-MAC check fails.

Step S608: When the NAS-MAC check succeeds, the UE redirects to the target base station indicated by the redirection information.

For the step S608 in the embodiment of the present invention, reference may be made to the step S507 in the fifth embodiment, which is not described in detail in the embodiment of the present invention.

Step S609: When the NAS-MAC check fails, the UE disconnects from the source base station.

For the step S609 in the embodiment of the present invention, reference may be made to the step S508 in the fifth embodiment, which is not described in detail in the embodiment of the present invention.

It should be noted that the redirection information, the redirection control information, the PCI, the first RRC parameter, the second RRC parameter, and the like may be referred to the related description in the implementation shown in any of the figures in FIG.

In the method described in FIG. 6, the MME generates a NAS-MAC according to the NAS count and the RRC parameters, and carries a partial bit of the NAS count in the downlink message. Since the NAS count is a fresh parameter of the NAS layer, the NAS-MACs generated each time are different, and thus can resist the replay attack.

FIG. 7 is a schematic diagram of a communication method according to another embodiment of the present invention. The method includes, but is not limited to, the following steps:

Step S701: The UE sends an extended service request message to the source base station.

For the step S701 in the embodiment of the present invention, reference may be made to the step S501 in the fifth embodiment, which is not described in detail in the embodiment of the present invention.

Step S702: The source base station sends the first RRC parameter to the MME according to the extended service request message.

For the step S702 in the embodiment of the present invention, reference may be made to the step S502 in the fifth embodiment, which is not repeatedly described in the embodiment of the present invention.

Step S703: The MME obtains the derived NAS integrity key according to the ASME key of the UE and the NAS count.

In a specific implementation, the MME may process the ASME key and the NAS count of the UE by using a key derivation algorithm that is preset or negotiated with the UE to obtain a derived NAS integrity key Kcsfb.

In an example, the MME may process the ASME key, the NAS count, and the first preset constant of the UE by using a key derivation algorithm negotiated with the UE to obtain a derived NAS integrity key Kcsfb. Exemplarily, the first preset constant can be a string such as "CSFB-INT".

Step S704: The MME performs integrity protection on the second RRC parameter by using the derived NAS integrity key to generate a NAS-MAC.

In an example, after receiving the initialization UE message, the MME may decide to perform CSFB according to the extended service request message, and further obtain a NAS integrity algorithm based on the negotiated NAS integrity algorithm, and obtain the derived NAS integrity key pair second RRC. The parameters are integrity protected and the NAS-MAC is generated.

The second RRC parameter may be the plaintext of the first RRC parameter.

Step S705: The MME sends partial bits of the NAS-MAC and NAS count to the source base station.

Taking the source base station as an eNB as an example, the MME may send a UE context change request message to the eNB, where the UE context change request message may include the generated NAS-MAC and a part of the bit counted by the NAS. Illustratively, the partial bits of the NAS count can be the lower 3-8 bits of the NAS count.

In one example, the UE context change request message may also include a first preset constant.

In another example, the UE Context Change Request message may further include CSFB indication information for indicating that the source base station performs CSFB on the UE.

Step S706: The source base station sends an RRC connection release message to the UE, where the RRC connection release message includes a NAS-MAC, a second RRC parameter, and a partial bit of the NAS count.

In an example, if the UE context change request message includes CSFB indication information, the source base station may send an RRC connection release message to the UE in response to the CSFB indication information, where the RRC connection release message may include the NAS in the UE context change request message. The MAC, the second RRC parameter, and a partial bit of the NAS count sent by the MME to the source base station.

In another example, the RRC Connection Release message may further include a first preset constant.

Optionally, the source eNB may update the first RRC parameter according to the UE context change request message, and the source eNB may compare the first RRC parameter sent to the MME in step S702 with the updated first RRC parameter, when When the first RRC parameter sent to the MME and the updated first RRC parameter are different, the source base station may send the updated first RRC parameter to the MME, and the MME obtains the derivative according to the ASME key and the NAS count of the UE. The NAS integrity key, the MME obtains the updated second RRC parameter based on the updated first RRC parameter, and performs integrity protection on the updated second RRC parameter by using the derived NAS integrity key, and generates an updated After receiving the updated NAS-MAC sent by the MME, the source base station may send an RRC connection release message to the UE, where the RRC connection release message includes the updated NAS-MAC, the updated second RRC parameter, and the Part of the bit counted by the NAS. When the source eNB does not update the first RRC parameter, the source eNB may determine that the first RRC parameter remains unchanged, that is, the first RRC parameter sent to the MME in step S702 is the same as the second RRC parameter that needs to be sent to the UE, and the source The base station may send an RRC connection release message to the UE, where the RRC connection release message includes the NAS-MAC generated by the MME in step S704 and the first RRC parameter sent to the MME in step S702.

Step S707: The UE acquires the NAS count according to part of the bits counted by the NAS.

For the step S707 in the embodiment of the present invention, reference may be made to the step S606 in the sixth embodiment, which is not repeatedly described in the embodiment of the present invention.

Step S708: The UE obtains the derived NAS integrity key by using the ASME key of the UE and the acquired NAS count.

In a specific implementation, the UE may process the ASME key and the acquired NAS count by using a key derivation algorithm that is preset or negotiated with the MME to obtain a derived NAS integrity key.

In an example, the UE may process its ASME key, NAS count, and first preset constant by a key derivation algorithm negotiated with the MME to obtain a derived NAS integrity key Kcsfb.

Step S709: The UE verifies the NAS-MAC by using the obtained derived NAS integrity key and the second RRC parameter.

In a specific implementation, the UE may perform integrity protection on the second RRC parameter based on the NAS integrity algorithm negotiated with the MME and the obtained derived NAS integrity key to generate a NAS-MAC, and then the UE may generate the UE. The NAS-MAC compares with the NAS-MAC in the RRC Connection Release message. When the NAS-MAC generated by the UE and the NAS-MAC in the RRC Connection Release message are the same, the UE may determine that the NAS-MAC check is successful; when the UE generates When the NAS-MAC in the NAS-MAC and the RRC Connection Release message are different, the UE may determine that the NAS-MAC check fails.

Step S710: When the NAS-MAC check succeeds, the UE redirects to the target base station indicated by the redirection information.

For the step S710 in the embodiment of the present invention, reference may be made to the step S507 in the fifth embodiment, which is not described in detail in the embodiment of the present invention.

Step S711: When the NAS-MAC check fails, the UE disconnects from the source base station.

For the step S711 in the embodiment of the present invention, refer to the step S508 in the fifth embodiment, which is not described in detail in the embodiment of the present invention.

It should be noted that the redirection information, the redirection control information, the PCI, the first RRC parameter, the second RRC parameter, and the like may be referred to the related description in the implementation shown in any of the figures in FIG.

In the method described in FIG. 7, the MME obtains the derived NAS integrity key according to the ASME key and the NAS count of the UE, and performs integrity protection on the RRC parameters using the derived NAS integrity key to obtain the NAS-MAC. Since the NAS count is a fresh parameter of the NAS layer, the derived NAS integrity keys obtained each time are different, resulting in different NAS-MACs generated each time, thereby being resistant to replay attacks.

FIG. 8 is a schematic diagram of a communication method according to another embodiment of the present invention. The method includes, but is not limited to, the following steps:

Step S801: The UE sends an extended service request message to the source base station.

For the step S801 in the embodiment of the present invention, reference may be made to the step S501 in the fifth embodiment, which is not described in detail in the embodiment of the present invention.

Step S802: The source base station sends the first RRC parameter to the MME according to the extended service request message.

For the step S802 in the embodiment of the present invention, reference may be made to the step S502 in the fifth embodiment, which is not described in detail in the embodiment of the present invention.

Step S803: The MME encrypts the first RRC parameter by using the NAS encryption key of the UE, to obtain a second RRC parameter.

In an example, after receiving the initialization UE message, the MME may decide to perform CSFB according to the extended service request message, and further base the algorithm based on the NAS confidentiality algorithm negotiated with the UE and the NAS encryption key Knas-enc of the UE. The first RRC parameter sent by the base station is encrypted to obtain a second RRC parameter.

The second RRC parameter may be a ciphertext of the first RRC parameter.

Step S804: The MME performs integrity protection on the second RRC parameter by using the NAS integrity key of the UE, and generates a NAS-MAC.

In an example, the MME may perform integrity protection on the second RRC parameter based on the NAS integrity algorithm negotiated with the UE and the NAS integrity key of the UE to generate a NAS-MAC.

In another example, the MME may perform integrity protection on the first RRC parameters based on the NAS integrity algorithm negotiated with the UE and the NAS integrity key of the UE to generate a NAS-MAC.

Step S805: The MME sends the NAS-MAC and the second RRC parameter to the source base station.

Step S806: The source base station sends an RRC connection release message to the UE, where the RRC connection release message includes a NAS-MAC and a second RRC parameter.

Optionally, the source base station may update the first RRC parameter according to the UE context change request message, and the source base station may compare the first RRC parameter sent to the MME in step S802 with the updated first RRC parameter, when When the first RRC parameter sent to the MME in step S802 is different from the updated first RRC parameter, the source base station may send the updated first RRC parameter to the MME, and the MME uses the NAS encryption key pair of the UE to update the number. An RRC parameter is encrypted, and the updated second RRC parameter is obtained. The MME performs integrity protection on the updated second RRC parameter according to the NAS integrity key of the UE, generates an updated NAS-MAC, and the source base station receives the MME. After the updated NAS-MAC is sent, the RRC connection release message may be sent to the UE, where the RRC connection release message includes the updated NAS-MAC and the updated second RRC parameter. When the source eNB does not update the first RRC parameter, the source eNB may determine that the first RRC parameter remains unchanged, that is, the information included in the first RRC parameter sent to the MME in step S802 and the second RRC that needs to be sent to the UE. The information included in the parameter is the same, and the source base station may send an RRC connection release message to the UE, where the RRC connection release message includes the NAS-MAC and the second RRC parameter generated by the MME in step S804.

Step S807: The UE checks the NAS-MAC by using the NAS integrity key and the second RRC parameter of the UE.

In a specific implementation, the UE may perform integrity protection on the second RRC parameter based on the NAS integrity algorithm negotiated with the MME and the NAS integrity key of the UE, and generate a NAS-MAC, and then the UE may generate the NAS by the UE. -MAC and NAS-MAC in the RRC Connection Release message are compared. When the NAS-MAC generated by the UE and the NAS-MAC in the RRC Connection Release message are the same, the UE may determine that the NAS-MAC check is successful; when the NAS generated by the UE When the MAC-MAC and the RRC Connection Release message are not the same, the UE may determine that the NAS-MAC check fails.

Step S808: When the NAS-MAC check succeeds, the UE decrypts the second RRC parameter by using the NAS encryption key of the UE, to obtain redirection information.

When the NAS-MAC check succeeds, the UE may decrypt the second RRC parameter based on the NAS confidentiality algorithm negotiated with the MME and the NAS encryption key of the UE, to obtain redirection information.

Step S809: The UE redirects to the target base station indicated by the redirection information.

Step S810: When the NAS-MAC check fails, the UE disconnects from the source base station.

It should be noted that the redirection information, the redirection control information, the PCI, the first RRC parameter, the second RRC parameter, and the like may be referred to the related description in the implementation shown in any of the figures in FIG.

In the method described in FIG. 8, the MME adds encryption protection to the first RRC parameter sent by the source base station, which can prevent the first RRC parameter from being forged, falsified or monitored, and improve the security of the first RRC parameter.

FIG. 9 is a schematic diagram of a communication method according to another embodiment of the present invention. The method includes, but is not limited to, the following steps:

Step S901: The UE sends an extended service request message to the source base station.

For the step S901 in the embodiment of the present invention, reference may be made to the step S501 in the fifth embodiment, which is not described in detail in the embodiment of the present invention.

Step S902: The source base station sends the first RRC parameter to the MME according to the extended service request message.

For the step S902 in the embodiment of the present invention, reference may be made to the step S502 in the fifth embodiment, which is not described in detail in the embodiment of the present invention.

Step S903: The MME encrypts the first RRC parameter by using the NAS encryption key of the UE, to obtain a second RRC parameter.

For the step S903 in the embodiment of the present invention, reference may be made to the step S803 in the eighth embodiment, which is not described in detail in the embodiment of the present invention.

Step S904: The MME performs integrity protection on the second RRC parameter and the NAS count by using the NAS integrity key of the UE, and generates a NAS-MAC.

In an example, the MME may perform integrity protection on the second RRC parameter and the NAS count based on the NAS integrity algorithm negotiated with the UE and the NAS integrity key of the UE to generate a NAS-MAC.

In another example, the MME may perform integrity protection on the first RRC parameters and the NAS count based on the NAS integrity algorithm negotiated with the UE and the NAS integrity key of the UE to generate a NAS-MAC.

Step S905: The MME sends the NAS-MAC, the second RRC parameter, and part of the bit counted by the NAS to the source base station.

Step S906: The source base station sends an RRC connection release message to the UE, where the RRC connection release message includes a NAS-MAC, a second RRC parameter, and a partial bit of the NAS count.

Optionally, the source eNB may update the first RRC parameter according to the UE context change request message, and the source eNB may compare the first RRC parameter sent to the MME in step S902 with the updated first RRC parameter, when When the first RRC parameter sent to the MME in step S902 is different from the updated first RRC parameter, the source base station may send the updated first RRC parameter to the MME, and the MME uses the NAS encryption key pair of the UE to update the number. An RRC parameter is encrypted to obtain an updated second RRC parameter, and the MME performs integrity protection on the updated second RRC parameter and the NAS count by using the NAS integrity key of the UE to generate an updated NAS-MAC, the source base station. After receiving the updated NAS-MAC sent by the MME, the RRC connection release message may be sent to the UE, where the RRC connection release message includes the updated NAS-MAC, the updated second RRC parameter, and a partial bit of the NAS count. When the source eNB does not update the first RRC parameter, the source eNB may determine that the first RRC parameter remains unchanged, that is, the information included in the first RRC parameter sent to the MME in step S902 and the second RRC that needs to be sent to the UE. The information included in the parameter is the same, and the source base station may send an RRC connection release message to the UE, where the RRC connection release message includes the NAS-MAC and the second RRC parameter generated by the MME in step S904.

Step S907: The UE acquires the NAS count according to part of the bits counted by the NAS.

For the step S907 in the embodiment of the present invention, reference may be made to the step S606 in the sixth embodiment, which is not described in detail in the embodiment of the present invention.

Step S908: The UE checks the NAS-MAC by using the NAS integrity key of the UE, the second RRC parameter, and the acquired NAS count.

In a specific implementation, the UE may perform integrity protection on the second RRC parameter and the acquired NAS count based on the NAS integrity algorithm negotiated with the MME and the NAS integrity key of the UE, and generate a NAS-MAC. The UE may compare the NAS-MAC generated by the UE with the NAS-MAC in the RRC Connection Release message. When the NAS-MAC generated by the UE and the NAS-MAC in the RRC Connection Release message are the same, the UE may determine the NAS-MAC check. Successful; when the NAS-MAC generated by the UE and the NAS-MAC in the RRC Connection Release message are different, the UE may determine that the NAS-MAC check fails.

Step S909: When the NAS-MAC check succeeds, the UE decrypts the second RRC parameter by using the NAS encryption key of the UE, to obtain redirection information.

When the NAS-MAC check succeeds, the UE may decrypt the second RRC parameter based on the NAS confidentiality algorithm negotiated with the MME and the NAS encryption key of the UE, to obtain redirection information.

Step S910: The UE redirects to the target base station indicated by the redirection information.

Step S911: When the NAS-MAC check fails, the UE disconnects from the source base station.

It should be noted that the redirection information, the redirection control information, the PCI, the first RRC parameter, the second RRC parameter, and the like may be referred to the related description in the implementation shown in any of the figures in FIG.

In the method described in FIG. 9, the MME adds encryption protection to the first RRC parameter, which can prevent the first RRC parameter from being forged, falsified or monitored, and improve the security of the first RRC parameter. In addition, the MME according to the NAS count and the number The second RRC parameter generates the NAS-MAC. Since the NAS count is a fresh parameter of the NAS layer, the NAS-MACs generated each time are different, so that the replay attack can be resisted.

FIG. 10 is a schematic diagram of a communication method according to another embodiment of the present invention. The method includes, but is not limited to, the following steps:

Step S1001: The UE sends an extended service request message to the source base station.

For the step S1001 in the embodiment of the present invention, reference may be made to the step S501 in the fifth embodiment, which is not described in detail in the embodiment of the present invention.

Step S1002: The source base station sends a first RRC parameter to the MME according to the extended service request message.

For the step S1002 in the embodiment of the present invention, reference may be made to the step S502 in the fifth embodiment, which is not described in detail in the embodiment of the present invention.

Step S1003: The MME obtains the derived NAS integrity key and the derived NAS encryption key according to the ASME key and the NAS count of the UE.

In a specific implementation, the MME may process the ASME key and the NAS count of the UE by using a key derivation algorithm that is preset or negotiated with the UE, to obtain a derived NAS integrity key Kcsfb-int and derived NAS encryption. Key Kcsfb-enc.

In an example, the MME may process the ASME key, the NAS count, and the second preset constant of the UE by using a key derivation algorithm negotiated with the UE to obtain a derived NAS integrity key. Exemplarily, the second preset constant can be a string such as "CSFB-INT".

In an example, the MME may process the ASME key, the NAS count, and the third preset constant of the UE by using a key derivation algorithm negotiated with the UE to obtain a derived NAS encryption key. Exemplarily, the third preset constant can be a string such as "CSFB-ENC".

Step S1004: The MME encrypts the first RRC parameter by using the derived NAS encryption key to obtain a second RRC parameter.

In an example, after receiving the initialization UE message, the MME may decide to perform CSFB according to the extended service request message, and then encrypt the first RRC parameter by using the derived NAS encryption key based on the NAS confidentiality algorithm negotiated with the UE. A second RRC parameter is obtained.

The second RRC parameter may be a ciphertext of the first RRC parameter.

Step S1005: The MME performs integrity protection on the second RRC parameter by using the derived NAS integrity key to generate a NAS-MAC.

The MME may perform integrity protection on the second RRC parameter based on the NAS integrity algorithm negotiated with the UE and the derived NAS integrity key to generate a NAS-MAC.

Step S1006: The MME sends the NAS-MAC, the second RRC parameter, and part of the bit counted by the NAS to the source base station.

Step S1007: The source base station sends an RRC connection release message to the UE, where the RRC connection release message includes a NAS-MAC, a second RRC parameter, and a partial bit of the NAS count.

Optionally, the source eNB may update the first RRC parameter according to the UE context change request message, and the source eNB may compare the first RRC parameter sent to the MME in step S1002 with the updated first RRC parameter, when When the first RRC parameter sent to the MME and the updated first RRC parameter are different, the source base station may send the updated first RRC parameter to the MME, and the MME obtains the derivative according to the ASME key and the NAS count of the UE. NAS integrity key and derived NAS encryption key, MME uses derived NAS encryption key pair The updated first RRC parameter is encrypted to obtain the updated second RRC parameter, and the MME performs integrity protection on the updated second RRC parameter by using the derived NAS integrity key to generate an updated NAS-MAC, source. After receiving the updated NAS-MAC sent by the MME, the base station may send an RRC connection release message to the UE, where the RRC connection release message includes the updated NAS-MAC, the updated second RRC parameter, and some bits of the NAS count. . When the source eNB does not update the first RRC parameter, the source eNB may determine that the first RRC parameter remains unchanged, that is, the information included in the first RRC parameter sent to the MME in step S1002 and the second RRC that needs to be sent to the UE. The information included in the parameter is the same, and the source base station may send an RRC connection release message to the UE, where the RRC connection release message includes the NAS-MAC and the second RRC parameter generated by the MME in step S1005.

Step S1008: The UE acquires the NAS count according to part of the bits counted by the NAS.

For the step S1008 in the embodiment of the present invention, reference may be made to the step S606 in the sixth embodiment, which is not described in detail in the embodiment of the present invention.

Step S1009: The UE obtains the derived NAS integrity key and the derived NAS encryption key by using the ASME key of the UE and the acquired NAS count.

In a specific implementation, the UE may process the ASME key of the UE and the obtained NAS count by using a preset key derivation algorithm negotiated with the MME to obtain a derived NAS integrity key and derived NAS encryption. Key.

In an example, the UE may process the ASME key of the UE, the obtained NAS count, and the second preset constant by using a key derivation algorithm negotiated with the MME to obtain a derived NAS integrity key.

In an example, the UE may process the ASME key of the UE, the obtained NAS count, and the third preset constant by using a key derivation algorithm negotiated with the MME to obtain a derived NAS encryption key.

Step S1010: The UE verifies the NAS-MAC by using the obtained derived NAS integrity key and the second RRC parameter.

In a specific implementation, the UE may perform integrity protection on the second RRC parameter by using the obtained NAS integrity key based on the NAS integrity algorithm negotiated with the MME to generate a NAS-MAC, and then the UE may generate the UE. The NAS-MAC compares with the NAS-MAC in the RRC Connection Release message. When the NAS-MAC generated by the UE and the NAS-MAC in the RRC Connection Release message are the same, the UE may determine that the NAS-MAC check is successful; when the UE generates When the NAS-MAC in the NAS-MAC and the RRC Connection Release message are different, the UE may determine that the NAS-MAC check fails.

Step S1011: When the NAS-MAC check succeeds, the UE decrypts the second RRC parameter by using the obtained derived NAS encryption key to obtain redirection information.

When the NAS-MAC check succeeds, the UE may decrypt the second RRC parameter by using the obtained NAS encryption key based on the NAS confidentiality algorithm negotiated with the MME to obtain the redirection information.

Step S1012: The UE redirects to the target base station indicated by the redirection information.

Step S1013: When the NAS-MAC check fails, the UE disconnects from the source base station.

In the method described in FIG. 10, the MME adds encryption protection to the first RRC parameter, which can prevent the first RRC parameter from being forged, falsified or intercepted, and improve the security of the first RRC parameter. In addition, the MME is based on the ASME of the UE. The key and NAS counts the derived NAS integrity key and the derived NAS encryption key, and the first RRC parameter is encrypted using the derived NAS encryption key to obtain a second RRC parameter, using the derived NAS integrity key pair. The second RRC parameter performs integrity protection to obtain NAS-MAC. Since the NAS count is a fresh parameter of the NAS layer, The derived NAS integrity key and the derived NAS encryption key obtained each time are different, resulting in different NAS-MACs generated each time, thereby being resistant to replay attacks.

The above describes the method of the embodiment of the present invention in detail, and the apparatus of the embodiment of the present invention is provided below.

Referring to FIG. 11, FIG. 11 is a schematic structural diagram of a communication apparatus according to an embodiment of the present invention. The communication apparatus may include a receiving module 1101 and a sending module 1102. The detailed description of each module is as follows.

The receiving module 1101 is configured to receive an extended service request message from the user equipment.

The sending module 1102 is configured to send, according to the extended service request message, a first RRC parameter to the MME, where the first RRC parameter includes redirection information, where the redirection information is used to indicate a target base station that is redirected by the user equipment. .

The receiving module 1101 is further configured to receive a NAS-MAC from the MME.

The sending module 1102 is further configured to send an RRC connection release message to the user equipment, where the RRC connection release message includes the NAS-MAC and a second RRC parameter, and the second RRC parameter is the NAS-MAC a generating parameter, where the second RRC parameter includes a plaintext or a ciphertext of the first RRC parameter.

Optionally, the RRC connection release message further includes a partial bit of the NAS, and the receiving module 1101 is further configured to: after the sending, the module 1102 sends the first RRC parameter to the MME, The MME receives a partial bit of the NAS count.

Optionally, the second RRC parameter includes the ciphertext of the first RRC parameter, and the receiving module 1101 is further configured to receive the second RRC parameter from the MME.

It should be noted that the embodiments of the present invention may be specifically referred to the related descriptions of the embodiments shown in FIG. 2 and FIG.

In the communication device described in FIG. 11, the receiving module 1101 receives an extended service request message from the user equipment, and the sending module 1102 sends a first RRC parameter to the MME according to the extended service request message, where the first RRC parameter includes redirection. The information receiving module 1101 receives the NAS-MAC from the MME, and the sending module 1102 sends an RRC connection release message to the user equipment, where the RRC connection release message includes the NAS-MAC and the second RRC parameter, and may be used by the source base station. Identification is performed to improve the security of the user equipment performing CSFB.

Referring to FIG. 12, FIG. 12 is a base station according to an embodiment of the present invention. The base station includes a processor 1201, a memory 1202, and a transceiver 1203. The processor 1201, the memory 1202, and the transceiver 1203 are connected to each other through a bus.

The memory 1202 includes, but is not limited to, a random access memory (RAM), a read-only memory (ROM), an Erasable Programmable Read Only Memory (EPROM), or A Compact Disc Read-Only Memory (CD-ROM) for storing related instructions and data, such as an extended service request message, a first RRC parameter of the user equipment, and the like. The transceiver 1203 is configured to receive and transmit data, for example, receive an extended service request message from a user equipment, or send a first RRC parameter or the like to the MME.

The processor 1201 may be one or more Central Processing Units (CPUs) or one or more Microcontroller Units (MCUs). In the case where the processor 1201 is a CPU, the CPU may be a single core CPU or a multi-core CPU. The processor 1201 can be combined with the communication shown in FIG. Letter device.

The processor 1201 in the base station is configured to read the program code stored in the memory 1202 and perform the following operations:

Receiving an extended service request message from the user equipment through the transceiver 1203;

Transmitting, by the transceiver 1203, the first RRC parameter to the MME according to the extended service request message, where the first RRC parameter includes redirection information, where the redirection information is used to indicate a target base station that is redirected by the user equipment;

Receiving a NAS-MAC from the MME through the transceiver 1203;

Transmitting, by the transceiver 1203, an RRC connection release message to the user equipment, where the RRC connection release message includes the NAS-MAC and a second RRC parameter, where the second RRC parameter is a generation parameter of the NAS-MAC, where The second RRC parameter includes a plaintext or a ciphertext of the first RRC parameter.

Optionally, the RRC connection release message further includes a partial bit of the NAS, and after the processor 1201 sends the first RRC parameter to the MME by using the transceiver 1203, the following operations may also be performed:

A portion of the bits of the NAS count is received from the MME by the transceiver 1203.

Optionally, the second RRC parameter includes the ciphertext of the first RRC parameter, and the processor 1201 may further perform, by using the transceiver 1203, the following: receiving the second RRC parameter from the MME.

It should be noted that the embodiments of the present invention may be specifically referred to the related descriptions of the embodiments shown in FIG. 2 and FIG.

In the base station depicted in FIG. 12, the processor 1201 receives an extended service request message from the user equipment through the transceiver 1203, and sends a first RRC parameter to the MME according to the extended service request message, where the first RRC parameter includes redirection information, from the MME. Receiving the NAS-MAC, sending an RRC connection release message to the user equipment, where the RRC connection release message includes a NAS-MAC and a second RRC parameter, and the base station can be identified to improve the security of the user equipment to perform CSFB.

Referring to FIG. 13, FIG. 13 is a schematic structural diagram of a communication apparatus according to an embodiment of the present invention. The communication apparatus may include a sending module 1301, a receiving module 1302, a checking module 1303, and an orientation module 1304, where details of each module are provided. Described as follows.

The sending module 1301 is configured to send an extended service request message to the source base station.

The receiving module 1302 is configured to receive an RRC connection release message sent by the source base station, where the RRC connection release message includes a NAS-MAC and a second RRC parameter, where the second RRC parameter is a generation parameter of the NAS-MAC, The second RRC parameter includes redirection information.

The verification module 1303 is configured to check the NAS-MAC according to the NAS integrity key of the communication device and the second RRC parameter.

The directional module 1304 is configured to redirect to the target base station indicated by the redirection information when the NAS-MAC check succeeds.

Optionally, the RRC connection release message further includes a partial bit of the NAS count.

Optionally, the verification module 1303 is specifically configured to:

Obtaining the NAS count according to a part of the bits counted by the NAS;

The NAS-MAC is verified according to the NAS integrity key, the second RRC parameter, and the NAS count.

Optionally, when the second RRC parameter is a ciphertext, the directional module 1304 is specifically configured to:

Decrypting the second RRC parameter by using a NAS encryption key of the communication device to obtain the redirection information;

Redirected to the target base station indicated by the redirect information.

Optionally, the verification module 1303 is specifically configured to:

Obtaining the NAS count according to a part of the bits counted by the NAS;

Obtaining a derived NAS integrity key according to an ASME key of the communication device and the NAS count;

The NAS-MAC is verified according to the derived NAS integrity key and the second RRC parameter.

Optionally, when the second RRC parameter is a ciphertext, the directional module 1304 is specifically configured to:

Obtaining a derived NAS encryption key according to an ASME key of the communication device and the NAS count;

Decrypting the second RRC parameter by using the derived NAS encryption key to obtain the redirection information;

Redirected to the target base station indicated by the redirect information.

Optionally, the communications apparatus in the embodiment of the present invention may further include:

The disconnection module 1305 is configured to disconnect the connection with the source base station when the NAS-MAC check fails.

It should be noted that the embodiments of the present invention may be specifically referred to the related descriptions of the embodiments shown in FIG. 3 and FIG. 5 to FIG. 10, and details are not described herein again.

In the communication device described in FIG. 13, the sending module 1301 sends an extended service request message to the source base station, and the receiving module 1302 receives the RRC connection release message sent by the source base station, where the RRC connection release message includes the NAS-MAC and the second RRC parameter, The second RRC parameter includes redirection information, and the verification module 1303 checks the NAS-MAC according to the NAS integrity key and the second RRC parameter of the communication device. When the NAS-MAC check succeeds, the orientation module 1304 redirects to the redirect. The target base station indicated by the information can identify the source base station and improve the security of the user equipment to perform CSFB.

Referring to FIG. 14, FIG. 14 is a user equipment, where the user equipment includes a processor 1401, a memory 1402, and a transceiver 1403. The processor 1401, the memory 1402, and the transceiver 1403 are connected to each other through a bus. .

The memory 1402 includes, but is not limited to, a RAM, a ROM, an EPROM, or a CD-ROM for storing related instructions and data, such as NAS-MAC, second RRC parameters, and the like. The transceiver 1403 is configured to receive and send data, for example, send an extended service request message to the source base station, or receive an RRC connection release message sent by the source base station, and the like.

The processor 1401 may be one or more CPUs, or one or more MCUs. In the case where the processor 1401 is a CPU, the CPU may be a single core CPU or a multi-core CPU. The processor 1401 can be combined with the communication device shown in FIG.

The processor 1401 in the user equipment is configured to read the program code stored in the memory 1402 and perform the following operations:

An extended service request message is sent to the source base station through the transceiver 1403.

Receiving, by the transceiver 1403, an RRC connection release message sent by the source base station, where the RRC connection release message includes a NAS-MAC and a second RRC parameter, where the second RRC parameter is a generation parameter of the NAS-MAC, where The second RRC parameter includes redirection information.

And verifying the NAS-MAC according to the NAS integrity key of the user equipment and the second RRC parameter.

When the NAS-MAC check succeeds, it is redirected to the target base station indicated by the redirect information.

Optionally, the RRC connection release message further includes a partial bit of the NAS count.

Optionally, the processor 1401 verifies the NAS-MAC according to the NAS integrity key of the user equipment and the second RRC parameter, where specifically:

Obtaining the NAS count according to a part of the bits counted by the NAS;

The NAS-MAC is verified according to the NAS integrity key, the second RRC parameter, and the NAS count.

Optionally, when the second RRC parameter is a ciphertext, the processor 1401 is redirected to the target base station indicated by the redirection information, which may be:

Decrypting the second RRC parameter by using a NAS encryption key of the user equipment, to obtain the redirection information;

Redirected to the target base station indicated by the redirect information.

Optionally, the processor 1401 verifies the NAS-MAC according to the NAS integrity key of the user equipment and the second RRC parameter, where specifically:

Obtaining the NAS count according to a part of the bits counted by the NAS;

Obtaining a derived NAS integrity key according to the ASME key of the user equipment and the NAS count;

The NAS-MAC is verified according to the derived NAS integrity key and the second RRC parameter.

Optionally, when the second RRC parameter is a ciphertext, the processor 1401 is redirected to the target base station indicated by the redirection information, which may be:

Obtaining a derived NAS encryption key according to the ASME key of the user equipment and the NAS count;

Decrypting the second RRC parameter by using the derived NAS encryption key to obtain the redirection information;

Redirected to the target base station indicated by the redirect information.

Optionally, the processor 1401 can also perform the following operations:

When the NAS-MAC check fails, the connection with the source base station is disconnected.

It should be noted that the embodiments of the present invention may be specifically referred to the related descriptions of the embodiments shown in FIG. 3 and FIG. 5 to FIG. 10, and details are not described herein again.

In the user equipment described in FIG. 14, the processor 1401 sends an extended service request message to the source base station by using the transceiver 1403, and receives an RRC connection release message sent by the source base station, where the RRC connection release message includes a NAS-MAC and a second RRC parameter. The second RRC parameter includes redirection information, and the NAS-MAC is verified according to the NAS integrity key and the second RRC parameter of the user equipment, and when the NAS-MAC verification is successful, the target base station indicated by the redirection information is redirected. The source base station can be identified to improve the security of the user equipment to perform CSFB.

Referring to FIG. 15, FIG. 15 is a schematic structural diagram of a communication apparatus according to another embodiment of the present invention. The communication apparatus may include a receiving module 1501, an obtaining module 1502, and a sending module 1503. The detailed description of each module is as follows.

The receiving module 1501 is configured to receive, by using a source base station of the user equipment, a first RRC parameter, where the first RRC parameter packet And including redirection information, where the redirection information is used to indicate a target base station that is redirected by the user equipment.

The obtaining module 1502 is configured to obtain a NAS-MAC according to the NAS integrity key and the second RRC parameter of the user equipment, where the second RRC parameter is a generation parameter of the NAS-MAC, and the second RRC parameter A plaintext or ciphertext containing the first RRC parameter.

The sending module 1503 is configured to send the NAS-MAC to the source base station.

Optionally, the obtaining module 1502 is specifically configured to:

Performing integrity protection on the second RRC parameter to generate the NAS-MAC by using a NAS integrity key of the user equipment; or

And using the NAS integrity key of the user equipment to perform integrity protection on the second RRC parameter and the NAS count to generate the NAS-MAC.

Optionally, the obtaining module 1502 is further configured to use the NAS encryption key pair of the user equipment before obtaining the NAS-MAC according to the NAS integrity key and the second RRC parameter of the user equipment. The first RRC parameter is encrypted to obtain the second RRC parameter.

Optionally, the obtaining module 1502 is specifically configured to:

Obtaining a derived NAS integrity key according to the ASME key and the NAS count of the user equipment;

The second RRC parameter is integrity protected using the derived NAS integrity key to generate the NAS-MAC.

Optionally, the obtaining module 1502 is further configured to: before obtaining the NAS-MAC according to the NAS integrity key and the second RRC parameter of the user equipment, according to the ASME key and the NAS count of the user equipment. Obtaining a derived NAS encryption key; encrypting the first RRC parameter by using the derived NAS encryption key to obtain the second RRC parameter.

Optionally, the sending module 1503 is further configured to send the second RRC parameter to the source base station.

Optionally, the sending module 1503 is further configured to send, to the source base station, part of the bits of the NAS count.

Optionally, the redirection information includes at least one of redirection control information or a physical cell identifier PCI.

It should be noted that the embodiments of the present invention may be specifically referred to the related descriptions of the embodiments shown in FIG. 4 to FIG. 10, and details are not described herein again.

In the communication device described in FIG. 15, the receiving module 1501 receives the first RRC parameter from the source base station of the user equipment, where the first RRC parameter includes redirection information, and the obtaining module 1502 is configured according to the NAS integrity key of the user equipment and the second RRC. The parameter obtains the NAS-MAC, and the sending module 1503 sends the NAS-MAC to the source base station, which can identify the source base station and improve the security of the user equipment to perform CSFB.

Referring to FIG. 16, FIG. 16 is a mobility management entity according to an embodiment of the present invention. The mobility management entity includes a processor 1601, a memory 1602, and a transceiver 1603. The processor 1601, the memory 1602, and the transceiver 1603 Connected to each other via a bus.

The memory 1602 includes, but is not limited to, a RAM, a ROM, an EPROM, or a CD-ROM for storing related instructions and data, such as a first RRC parameter of the user equipment, NAS-MAC, and the like. The transceiver 1603 is configured to receive and transmit data, for example, receive a first RRC parameter from a source base station of the user equipment, or send a NAS-MAC or the like to the source base station.

The processor 1601 may be one or more CPUs, or one or more MCUs. In the processor 1601 is a In the case of a CPU, the CPU can be a single core CPU or a multi-core CPU. The processor 1601 can be combined with the communication device shown in FIG.

The processor 1601 in the MME is configured to read the program code stored in the memory 1602, and perform the following operations:

Receiving, by the transceiver 1603, a first RRC parameter from a source base station of the user equipment, where the first RRC parameter includes redirection information, where the redirection information is used to indicate a target base station that is redirected by the user equipment;

Obtaining a NAS-MAC according to the NAS integrity key and the second RRC parameter of the user equipment, where the second RRC parameter is a generation parameter of the NAS-MAC, and the second RRC parameter includes the first RRC Plain text or cipher text of the parameter;

The NAS-MAC is transmitted to the source base station through the transceiver 1603.

Optionally, the processor 1601 obtains the NAS-MAC according to the NAS integrity key and the second RRC parameter of the user equipment, where specifically:

Performing integrity protection on the second RRC parameter to generate the NAS-MAC by using a NAS integrity key of the user equipment; or

And using the NAS integrity key of the user equipment to perform integrity protection on the second RRC parameter and the NAS count to generate the NAS-MAC.

Optionally, before the obtaining, by the processor 1601, the NAS-MAC according to the NAS integrity key and the second RRC parameter of the user equipment, the following operations may also be performed:

And encrypting the first RRC parameter by using a NAS encryption key of the user equipment, to obtain the second RRC parameter.

Optionally, the processor 1601 obtains the NAS-MAC according to the NAS integrity key and the second RRC parameter of the user equipment, where specifically:

Obtaining a derived NAS integrity key according to the ASME key and the NAS count of the user equipment;

The second RRC parameter is integrity protected using the derived NAS integrity key to generate the NAS-MAC.

Optionally, before the obtaining, by the processor 1601, the NAS-MAC according to the NAS integrity key and the second RRC parameter of the user equipment, the following operations may also be performed:

Obtaining a derived NAS encryption key according to the ASME key and the NAS count of the user equipment;

And encrypting the first RRC parameter by using the derived NAS encryption key to obtain the second RRC parameter.

Optionally, the processor 1601 can also perform the following operations:

The second RRC parameter is sent to the source base station by the transceiver 1603.

Optionally, the processor 1601 can also perform the following operations:

A portion of the bits of the NAS count is transmitted by the transceiver 1603 to the source base station.

Optionally, the redirection information includes at least one of redirection control information or a physical cell identifier PCI.

It should be noted that the embodiments of the present invention may be specifically referred to the related descriptions of the embodiments shown in FIG. 4 to FIG. 10, and details are not described herein again.

In the base station described in FIG. 16, the processor 1601 receives a first RRC parameter from a source base station of the user equipment, where the first RRC parameter includes redirection information, obtained according to the NAS integrity key and the second RRC parameter of the user equipment. The NAS-MAC sends a NAS-MAC to the source base station to identify the base station and improve the security of the user equipment to perform CSFB.

Referring to FIG. 17, FIG. 17 is a communication system according to an embodiment of the present invention. The communication system includes a base station 1701 shown in FIG. 12, a user equipment 1702 shown in FIG. 14, and a mobility management entity 1703 shown in FIG. For details, refer to the description of FIG. 12, FIG. 14 and FIG.

One of ordinary skill in the art can understand all or part of the process of implementing the above embodiments, which can be completed by a computer program to instruct related hardware, the program can be stored in a computer readable storage medium, when the program is executed The flow of the method embodiments as described above may be included. The foregoing storage medium includes various media that can store program codes, such as a ROM or a random access memory RAM, a magnetic disk, or an optical disk.

Claims (39)

A communication method, characterized in that the method comprises: The source base station receives an extended service request message from the user equipment; The source eNB sends a first RRC parameter to the mobility management entity MME according to the extended service request message, where the first RRC parameter includes redirection information, and the redirection information is used to indicate the user equipment. Redirected target base station; The source base station receives a non-access stratum-message verification code NAS-MAC from the MME; The source base station sends an RRC connection release message to the user equipment, where the RRC connection release message includes the NAS-MAC and a second RRC parameter, and the second RRC parameter is a generation parameter of the NAS-MAC. The second RRC parameter includes a plaintext or a ciphertext of the first RRC parameter. The method according to claim 1, wherein the RRC connection release message further includes a partial bit of the NAS, and after the source base station sends the first RRC parameter to the MME, the method further includes: The source base station receives a partial bit of the NAS count from the MME. The method according to claim 1 or 2, wherein the second RRC parameter includes the ciphertext of the first RRC parameter, and the method further includes: The source base station receives the second RRC parameter from the MME. A communication method, characterized in that the method comprises: The user equipment sends an extended service request message to the source base station; Receiving, by the user equipment, a radio resource control RRC connection release message sent by the source base station, where the RRC connection release message includes a non-access stratum-message verification code NAS-MAC and a second RRC parameter, where the second RRC parameter is a generation parameter of the NAS-MAC, where the second RRC parameter includes redirection information; The user equipment verifies the NAS-MAC according to the NAS integrity key of the user equipment and the second RRC parameter; When the NAS-MAC check is successful, the user equipment is redirected to the target base station indicated by the redirection information. The method of claim 4 wherein said RRC Connection Release message further comprises a partial bit of the NAS count. The method of claim 5, wherein the user equipment verifies the NAS-MAC according to the NAS integrity key of the user equipment and the second RRC parameter, including: The user equipment acquires the NAS count according to a part of the bit counted by the NAS; The user equipment checks the NAS-MAC according to the NAS integrity key, the second RRC parameter, and the NAS count. The method according to claim 4 or 6, wherein when the second RRC parameter is a ciphertext, the user equipment is redirected to the target base station indicated by the redirection information, including: The user equipment decrypts the second RRC parameter by using a NAS encryption key of the user equipment, to obtain the redirection information; The user equipment is redirected to a target base station indicated by the redirection information. The method of claim 5, wherein the user equipment verifies the NAS-MAC according to the NAS integrity key of the user equipment and the second RRC parameter, including: The user equipment acquires the NAS count according to a part of the bit counted by the NAS; Determining, by the user equipment, the derived NAS integrity key according to the access security management entity ASME key of the user equipment and the NAS count; The user equipment checks the NAS-MAC according to the derived NAS integrity key and the second RRC parameter. The method according to claim 8, wherein when the second RRC parameter is a ciphertext, the user equipment is redirected to the target base station indicated by the redirection information, including: The user equipment obtains a derived NAS encryption key according to the ASME key of the user equipment and the NAS count; Decrypting the second RRC parameter by using the derived NAS encryption key to obtain the redirection information; The user equipment is redirected to a target base station indicated by the redirection information. The method according to any one of claims 4 to 9, wherein the method further comprises: When the NAS-MAC check fails, the user equipment disconnects from the source base station. A communication method, characterized in that the method comprises: The mobility management entity MME receives the first radio resource control RRC parameter from the source base station of the user equipment, where the first RRC parameter includes redirection information, and the redirection information is used to indicate the target base station that is redirected by the user equipment; The MME obtains a non-access stratum-message verification code NAS-MAC according to the non-access stratum NAS integrity key and the second RRC parameter of the user equipment, where the second RRC parameter is the NAS-MAC Generating a parameter, where the second RRC parameter includes a plaintext or a ciphertext of the first RRC parameter; The MME sends the NAS-MAC to the source base station. The method according to claim 11, wherein the MME obtains the NAS-MAC according to the NAS integrity key and the second RRC parameter of the user equipment, including: The MME performs integrity protection on the second RRC parameter to generate the NAS-MAC by using the NAS integrity key of the user equipment; or The MME counts the second RRC parameter and the NAS by using a NAS integrity key of the user equipment. Perform integrity protection to generate the NAS-MAC. The method according to claim 12, wherein the method further comprises: before the obtaining, by the MME, the NAS-MAC according to the NAS integrity key and the second RRC parameter of the user equipment, the method further comprises: The MME encrypts the first RRC parameter by using a NAS encryption key of the user equipment, to obtain the second RRC parameter. The method according to claim 11, wherein the MME obtains the NAS-MAC according to the NAS integrity key and the second RRC parameter of the user equipment, including: Determining, by the MME, the derived NAS integrity key according to the access security management entity ASME key and the NAS count of the user equipment; The MME performs integrity protection on the second RRC parameter by using the derived NAS integrity key to generate the NAS-MAC. The method according to claim 14, wherein the method further comprises: before the obtaining, by the MME, the NAS-MAC according to the NAS integrity key and the second RRC parameter of the user equipment, the method further comprises: Determining, by the MME, the derived NAS encryption key according to the ASME key and the NAS count of the user equipment; The MME encrypts the first RRC parameter by using the derived NAS encryption key to obtain the second RRC parameter. The method of claim 13 or 15, wherein the method further comprises: The MME sends the second RRC parameter to the source base station. The method of claim 12, 14 or 15, wherein the method further comprises: The MME sends a partial bit of the NAS count to the source base station. The method according to any one of claims 1 to 17, wherein the redirection information comprises at least one of redirection control information or a physical cell identity PCI. A communication device, characterized in that the device comprises: a receiving module, configured to receive an extended service request message from the user equipment; a sending module, configured to send, according to the extended service request message, a first radio resource control RRC parameter to the mobility management entity MME, where the first RRC parameter includes redirection information, where the redirection information is used to indicate the user Target base station for device redirection; The receiving module is further configured to receive a non-access stratum-message verification code NAS-MAC from the MME; The sending module is further configured to send an RRC connection release message to the user equipment, where the RRC connection release message includes the NAS-MAC and a second RRC parameter, where the second RRC parameter is the NAS-MAC And generating a parameter, where the second RRC parameter includes a plaintext or a ciphertext of the first RRC parameter. The apparatus according to claim 19, wherein said RRC Connection Release message further comprises a partial bit of the NAS count; The receiving module is further configured to: after the sending module sends the first RRC parameter to the MME, receive a partial bit of the NAS count from the MME. The apparatus according to claim 19 or 20, wherein the second RRC parameter comprises a ciphertext of the first RRC parameter; The receiving module is further configured to receive the second RRC parameter from the MME. A base station, comprising: a processor, a memory, and a transceiver, wherein the memory stores a set of program codes, and the processor is configured to call program code stored in the memory for performing the following operating: Receiving an extended service request message from the user equipment; Transmitting, according to the extended service request message, a first radio resource control RRC parameter to the mobility management entity MME, where the first RRC parameter includes redirection information, where the redirection information is used to indicate a target that is redirected by the user equipment. Base station Receiving a non-access stratum-message verification code NAS-MAC from the MME; Sending an RRC connection release message to the user equipment, where the RRC connection release message includes the NAS-MAC and a second RRC parameter, the second RRC parameter is a generation parameter of the NAS-MAC, and the second RRC The parameter includes a plaintext or a ciphertext of the first RRC parameter. A communication device, characterized in that the device comprises: a sending module, configured to send an extended service request message to the source base station; a receiving module, configured to receive a radio resource control RRC connection release message sent by the source base station, where the RRC connection release message includes a non-access stratum-message verification code NAS-MAC and a second RRC parameter, where the second RRC parameter For the generation parameter of the NAS-MAC, the second RRC parameter includes redirection information; a verification module, configured to verify the NAS-MAC according to the NAS integrity key of the communication device and the second RRC parameter; And an directional module, configured to redirect to the target base station indicated by the redirect information when the NAS-MAC check succeeds. The apparatus of claim 23, wherein the RRC Connection Release message further comprises a partial bit of the NAS count. The device according to claim 24, wherein the verification module is specifically configured to: Obtaining the NAS count according to a part of the bits counted by the NAS; Verifying the according to the NAS integrity key, the second RRC parameter, and the NAS count NAS-MAC. The apparatus according to claim 23 or 25, wherein when the second RRC parameter is a ciphertext, the directional module is specifically configured to: Decrypting the second RRC parameter by using a NAS encryption key of the communication device to obtain the redirection information; Redirected to the target base station indicated by the redirect information. The device according to claim 24, wherein the verification module is specifically configured to: Obtaining the NAS count according to a part of the bits counted by the NAS; Obtaining a derived NAS integrity key according to an access security management entity ASME key and the NAS count of the communication device; The NAS-MAC is verified according to the derived NAS integrity key and the second RRC parameter. The apparatus according to claim 27, wherein when the second RRC parameter is a ciphertext, the directional module is specifically configured to: Obtaining a derived NAS encryption key according to an ASME key of the communication device and the NAS count; Decrypting the second RRC parameter by using the derived NAS encryption key to obtain the redirection information; Redirected to the target base station indicated by the redirect information. The device according to any one of claims 23 to 28, wherein the device further comprises: And a disconnecting module, configured to disconnect the connection with the source base station when the NAS-MAC check fails. A user equipment, comprising: a processor, a memory, and a transceiver, wherein the memory stores a set of program codes, and the processor is configured to call program code stored in the memory, for Do the following: Sending an extended service request message to the source base station; Receiving, by the source base station, a radio resource control RRC connection release message, where the RRC connection release message includes a non-access stratum-message verification code NAS-MAC and a second RRC parameter, where the second RRC parameter is the NAS- a generation parameter of the MAC, where the second RRC parameter includes redirection information; Verifying the NAS-MAC according to the NAS integrity key of the user equipment and the second RRC parameter; When the NAS-MAC check succeeds, it is redirected to the target base station indicated by the redirect information. A communication device, characterized in that the device comprises: a receiving module, configured to receive a first radio resource control RRC parameter from a source base station of the user equipment, where the first RRC parameter includes redirection information, where the redirection information is used to indicate a target base station that is redirected by the user equipment; An acquiring module, configured to obtain a non-access stratum-message verification code NAS-MAC according to the non-access stratum NAS integrity key and the second RRC parameter of the user equipment, where the second RRC parameter is the NAS- MAC generation parameters, The second RRC parameter includes a plaintext or a ciphertext of the first RRC parameter; And a sending module, configured to send the NAS-MAC to the source base station. The device according to claim 31, wherein the obtaining module is specifically configured to: Performing integrity protection on the second RRC parameter to generate the NAS-MAC by using a NAS integrity key of the user equipment; or And using the NAS integrity key of the user equipment to perform integrity protection on the second RRC parameter and the NAS count to generate the NAS-MAC. The device of claim 32, wherein The obtaining module is further configured to use the NAS encryption key of the user equipment to obtain the first RRC parameter before obtaining the NAS-MAC according to the NAS integrity key and the second RRC parameter of the user equipment. Encryption is performed to obtain the second RRC parameter. The device according to claim 31, wherein the obtaining module is specifically configured to: Obtaining a derived NAS integrity key according to the access security management entity ASME key and the NAS count of the user equipment; The second RRC parameter is integrity protected using the derived NAS integrity key to generate the NAS-MAC. The device of claim 34, wherein The obtaining module is further configured to obtain the derived NAS according to the ASME key and the NAS count of the user equipment before obtaining the NAS-MAC according to the NAS integrity key and the second RRC parameter of the user equipment. Encrypting a key; encrypting the first RRC parameter by using the derived NAS encryption key to obtain the second RRC parameter. A device according to claim 33 or 35, wherein The sending module is further configured to send the second RRC parameter to the source base station. A device according to claim 32, 34 or 35, wherein The sending module is further configured to send, to the source base station, part of the bits of the NAS count. The method according to any one of claims 19 to 37, wherein the redirection information comprises at least one of redirection control information or a physical cell identity PCI. A communication system, comprising: the base station according to any one of claims 19-21, the user equipment according to any one of claims 23-29, and the claims 31-38 A mobility management entity MME as described.

Images