Cipher key replacing method, system and device

Abstract

The invention discloses a key replacement method, which comprises: an evolution node point (eNB) sends an AS key replacement command message with the encryption and integration protected by the old key group to the user equipment (UE); the UE processes the AS key replacement command message with the old key group and sends an AS key replacement completion message with the integration protected by the new key to the eNB; then the UE encrypts or decrypts the user plane (UP) data with a new key; the eNB processes the AS key replacement completion message with a new key group and encrypts or decrypts the UP data with the new key. The invention further discloses a key replacement system and the combination equipment thereof. The adoption of the invention can ensure that the key used by the UE and the network user message is synchronous when the key is replaced, thus avoiding user communication data loss caused by asynchronous UE and network key and improving the communication quality of the user.

Description

technical field [0001] The present invention relates to a key replacement technology in a mobile communication system, in particular to a key replacement method, system and device for a user equipment (UE) and a network in a radio resource control (RRC) connection state. Background technique [0002] The access security of the 3rd Generation Partnership Project (3GPP) Long Term Evolution (LTE, Long Term Evolution) system / system architecture evolution (SAE, System Architecture Evolution) adopts a two-layer security architecture, that is, the access layer (AS, The security mechanisms of Access Stratum) and Non-Access Stratum (NAS, Non Access Stratum) are separate, and each has its own independent security context. Wherein, the security context includes: a key, a key identifier, a security algorithm, and a value of an uplink and downlink counter. The AS security context is terminated at the evolved node (eNB, evolved Node B), and the eNB is responsible for generating, establis...

AI Technical Summary

Problems solved by technology

[0017] The first problem is that the keys of the signaling plane are not synchronized. Currently, TS33.401 stipulates that the key pointed to by the eKSI carried by the SMC is used to protect the integrity of the message. Since step 102 starts, all NAS and AS messages are In the state of using the old key encryption and integrity protection, therefore, the NAS SMC in step 104 stipulates to use the new key for integrity protection, but since the old key has been activated, this NAS message must use the old key for encryption and integrity protection. Integrity verification can ensure that the processing of the UE is passed, otherwise the UE will discard the message, causing communication interruption. If the new key and the old key are used to process the message at the same time, there will be confusion in the integrity verification, step 107 the same problem will occur

[0018] The second problem is that the UP key is not synchronized. Specifically, according to TS33.401, after the eNB sends the AS SMC, the downlink RRC and UP data start to be encrypted immediately.

All these processes need a period of time to complete. In this period of time, the user data between the UE and the network is not terminated and will always be transmitted. The UE user plane data can only be encrypted and decrypted with the old key, but at this time The UP data received from the eNB is all encrypted with the new key, so the UE cannot decrypt the received message, which will cause part of the UP data to be unable to be decrypted correctly due to key replacement

Simply put, there is a time difference between the UE and the eNB using the new key for the UP data, resulting in errors in user data and a decrease in communication quality

Images