Abstract:
A method and an apparatus for protecting data carried on an Un interface between a eNB and a relay node are disclosed. Three types of radio bearers (RBs) are defined over the Un interface: signaling radio bearers (SRBs) for carrying control plane signaling data, signaling-data radio bearers (s-DRBs) for carrying control plane signaling date; and data-data radio bearers (d-DRBs) for carrying user plane data. An integrity protection algorithm and an encryption algorithm are negotiated for control plane signaling data on an SRB, control plane signaling data carried on an s-DRB, and user plane data carried on a d-DRB. With the respective integrity protection algorithm and encryption algorithm, the data over the Un interface can be protected respectively. Therefore, the security protection on the Un interface is more comprehensive, and the security protection requirements of data borne over different RBs can be met.
Abstract:
A method for preventing abuse of an Authentication Vector (AV) and a system and apparatus for implementing the method are provided. Access network information of a non-3rd Generation Partnership Project (3GPP) access network where a user resides is bound to an AV of the user, so that when the user accesses an Evolved Packet System (EPS) through the non-3GPP access network, even if an entity in the non-3GPP access network is breached, or an Evolved Packet Data Gateway (ePDG) connected to an untrusted non-3GPP access network is breached, the stolen AV cannot be applied to other non-3GPP access networks by an attacker.
Abstract:
A method, an apparatus and a system for key derivation are disclosed. The method includes the following steps: a target base station) receives multiple keys derived by a source base station, where the keys correspond to cells under control of the target base station; the target base station selects a key corresponding to the target cell after knowing a target cell that a user equipment (UE) wants to access. An apparatus for key derivation and a communications system are also provided.
Abstract:
Method, device, and system for deriving keys are provided in the field of mobile communications technologies. The method for deriving keys may be used, for example, in a handover process of a User Equipment (UE) from an Evolved Universal Terrestrial Radio Access Network (EUTRAN) to a Universal Terrestrial Radio Access Network (UTRAN). If a failure occurred in a first handover, the method ensures that the key derived by a source Mobility Management Entity (MME) for a second handover process of the UE is different from the key derived for the first handover process of the UE. This is done by changing input parameters used in the key derivation, so as to prevent the situation in the prior art that once the key used on one Radio Network Controller (RNC) is obtained, the keys on other RNCs can be derived accordingly, thereby enhancing the network security.
Abstract:
A method, and related apparatuses are provided. The method comprises receiving an initial layer-3 message, wherein the initial layer-3 message comprises an indication indicating that a part of the initial layer-3 message is encrypted, and generating a keystream, wherein the keystream is used to decrypt the encrypted part of the initial layer-3 message.
Abstract:
A key generation method includes determining, by an access and mobility management function node, key-related information. The method also includes sending, by the access and mobility management function node, a redirection request message to a mobility management entity. The redirection request message includes the key-related information, and the redirection request message is used to request to hand over a voice service from a packet switched (PS) domain to a circuit switched (CS) domain. The method further includes receiving, by the mobility management entity, the redirection request message. The method additionally includes generating, by the mobility management entity, an encryption key and an integrity protection key for the voice service based on the key-related information.
Abstract:
Embodiments of the present invention disclose a key exchange method and apparatus. A network device acquires a first key, and sends a message including the first key to a second user equipment, so that the second user equipment uses, when communicating with a first user equipment by using a D2D link, the first key to protect transmitted information.
Abstract:
A connection resume request method includes generating, by a terminal, a new access stratum key; sending, by the terminal to a target base station, a connection resume request message requesting to resume a radio resource control (RRC) connection; receiving, by the terminal, a connection resume rejection message from the target base station, wherein the connection resume rejection message indicates that the resuming of the RRC connection is rejected; and resuming, by the terminal, the new access stratum key to a previous access stratum key, wherein the previous access stratum key is an access stratum key that is used, before the apparatus enters an inactive state, by the terminal and the source base station.
Abstract:
This application pertains to encryption/decryption methods and related apparatuses. A communication device receives an initial layer-3 message. The initial layer-3 message includes an indication indicating that a part of the initial layer-3 message is encrypted. The communication device generates a keystream, and decrypts the encrypted part of the initial layer-3 message by performing an exclusive OR operation on the keystream and the initial layer-3 message.
Abstract:
The present disclosure relates to mobile communications technologies, and in particular, to a mobile communication method, apparatus, and device. The method includes: receiving, by user equipment UE, a non-access stratum NAS security mode command message from a mobility management entity MME, where the NAS security mode command message carries first verification matching information used to verify UE capability information received by the MME; determining, by the UE based on the first verification matching information, whether the UE capability information received by the MME is consistent with UE capability information sent by the UE to the MME; and if the UE capability information received by the MME is consistent with the UE capability information sent by the UE to the MME, sending, by the UE, a NAS security mode complete message to the MME.