METHOD FOR RESOLVING SECURITY ISSUES USING NH AND NCC PAIRS IN MOBILE COMMUNICATION SYSTEM

[0001] This invention relates to wireless communications technology, and especially relates to a method for resolving security issues in a mobile communications system using NH and NCC pairs.

[0002] Modern mobile communications are leaning more and more towards offering the user multimedia services with high speed transmission. FIG. 1 illustrates a system architecture of System Architecture Evolution (SAE).

[0003] Amongst the system, user equipment (UE) 101 is a terminal device used to receive data. Evolved Universal Terrestrial Radio Access Network (E-UTRAN) 102 is a wireless access network, wherein, the UE includes a wireless network interface that provides access to a macro base station (eNodeB/NodeB). Mobile Management Entity (MME) 103 is responsible for managing mobile context, session context, and security information of UE. Service Gateway (SGW) 104 primarily provides user plane function. MME 103 and SGW 104 can exist within the same physical entity. Packet Data Network Gateway (PGW) 105 is responsible for billing and legitimate interception functions, and can also be located in the same physical entity as SGW 104. Policy and charging rules function entity (PCRF) 106 provides Quality of Service (QoS) policy and billing standards. Service General Packet Radio Service (GPRS) Support Node (SGSN) 108 is a network node device that provides routing for data transmission in a Universal Mobile Telecommunications Service (UMTS). Home Subscriber Service (HSS) 109 is the UE s home attribution subsystem responsible for protection on user information, including the current location of the user equipment, service node address, user security information, a packet data context of the user equipment, etc.

[0004] In release 12 (Rel-12), 3GPP raised the demand for small cell enhancement. Target scenarios of the small cell enhancement include macro cell coverage scenarios as well as scenarios without macro cell coverage, indoors and outdoors, and ideal and non-ideal backhaul enhancement, as shown in FIG. 2.

[0005] Under circumstances where there is macro cell coverage, it is proposed that carrier aggregation technology can be used between different base stations. Macro cells and small cells can work at different bands. There are many kinds of architecture for technology using different carrier aggregations between base stations, such as, radio access network RAN split based UP architecture and core network split based UP architecture. A CN split based architecture refers to that data are sent directly to Pico by the core network SGW for those bearers in pico cell, User plane data is not forwarded through macro cells. In small cell architecture, another possible type of architecture has an S1GW or small cell GW between the base station and the core network. The base station interacts with the CN through the S1GW.

[0006] In regards to a user plane architecture based on core network split, every time the second base station SeNB changes, there is signaling exchange through a core network. In a scenario without macro cell coverage, every time the switch between pico base stations occurs, it must go through a CN signaling exchange. Since the range of pico or SeNB coverage is comparatively small, this type of frequent signaling exchange with CN creates a burden on the core network.

[0007] In order to reduce the signaling exchange with the CN, it is possible to terminate the bearer switch between different base stations, e.g., the switch from SeNB1 to SeN2, at S1GW. However, current security mechanisms do not support switch process termination at the gateway.

[0008] Following is a simple introduction to the current security mechanism.

[0009] Security levels in E-UTRAN are shown in FIG. 3.

[0010] K exists in a permanent key on an Authentication Center (AuC) on a universal integrated circuit card on a universal subscriber identity module (USIM).

[0011] CK and IK are a pair of keys created by AuC and USIM in an AKA (authentication and key agreement) process. CK and IK processes are not the same in the security context of evolved packet service (EPS) and that of legacy.

[0012] Kasme is a key created between the UE and MME after AKA concludes. UE and MME then further create keys for NAS layer encryption (KNASenc) and integrity protection (KNASint) based on Kasme.

[0013] KeNB is a key derived from ME and MME, or from ME and eNB.

[0014] KH is a key created by ME and MME for forward security.

[0015] Based on KeNB, an air interface access layer user plane encrypted key KUPenc, a control plane encrypted key KRRCenc, and a control plan integrity protection key KRRCint are further derived.

[0016] The theory of key generation at switch is shown in FIG. 4. The initial KeNB is calculated based on Kasme and NAS uplink count. When UE and eNB need to setup an initial access stratum (AS) security context, MME and UE derive KeNB and NH. KeNB and NH are derived based on Kasme. NCC has a relation to every KeNB and NH. Every KeNB has a relation to the NCC corresponding to the NH that the KeNB is derived from. At start up, KeNB is immediately derived from Kasme so KeNB is associated with a virtual NH, which is 0 in respect to NCC. During initial setup, the derived NH and NCC1 are associated. When eNB receives an initial context setup request, NCC is initialized as 0.

[0017] During switch, the KeNB* used between UE and a target eNB is derived from the current KeNB or NH. The former is a horizontal key generating mechanism. The latter is a vertical key generation mechanism. When generating the KeNB* based on NH or KeNB, physical cell identity (PCI) and frequency (EARFCN-DL) of a target cell must be bound to the KeNB*. Clearly, in the aforementioned mechanisms, participation is required from both the core network and the UE. Thus, the current security mechanisms cannot support switch termination at S1GW.

[0018] In order to reach the aforementioned goal, this application proposes the following schemes.

[0019] A method for resolving security issues using NH and NCC pairs, including:

[0020] an MME sending a sequence including multiple NH and NCC pairs that correspond to a UE to an S1GW;

[0021] after receiving a handover message or a bearer switch message for the UE from a base station, the S1GW choosing a next unused NH and NCC pair from the sequence received from the MME, and sending the next unused NH and NCC pair to a target base station.

[0022] Preferably, the sequence is sent to the S1GW through an initial context setup request message, a UE context modification request message, a handover request message, a path switch request confirmation message, or a new message.

[0023] Preferably, the MME determines the number of base stations or cells connected to the S1GW based on configuration, and determines the number of NH and NCC pairs to be sent to the S1GW according to the number; or

[0024] the MME determines the number of NH and NCC pairs to be sent to the S1GW based on the number of base stations or cells accessing the S1GW received from the S1GW; or

[0025] the MME sends the sequence including NH and NCC pairs to the S1GW based on the number of NH and NCC pairs requested from the S1GW.

[0026] Preferably, when the number of unused NH and NCC pairs in the sequence received by the S1GW from the MME is less than a default threshold, the method further includes:

[0027] the S1GW requesting a sequence including new NH and NCC pairs from the MME; and

[0028] the MME calculating the sequence including new NH and NCC pairs, and sending the sequence to the S1GW.

[0029] Preferably, after the MME determines a downstream node as the S1GW, the MME sends the sequence of multiple NH and NCC pairs to the S1GW.

[0030] Preferably, the method for the MME to determine the downstream node as the S1GW includes:

[0031] determining, by the MME, the downstream node as the S1GW through operations, administration, and maintenance (OAM) configuration; or

[0032] based on an entity ID of the downstream node and preset corresponding relationships between entity types and entity IDs, the MME determining the downstream node as the S1GW; or

[0033] the MME determining the downstream node as the S1GW based on a TA list received from the downstream node during an S1 setup process; or

[0034] determining the downstream node as the S1GW based on a base station type indicator included in an S1 setup message or an initial UE message sent to the MME by the downstream node.

[0035] Preferably, after the target base station receives the next unused NH and NCC pair, the method further includes: the target base station uses the NH and NCC pair it receives to calculate a KeNB, wherein the KeNB is used as a new key for the UE and the target base station; or

[0036] in regards to an X2 handover, after the target base station receives the next NH and NCC pair, the method further includes: the target base station uses the NH and NCC pair it receives to calculate a KeNB and updates a key used between the UE and the target base station as the calculated KeNB; or

[0037] the target base station stores a next NH and NCC pair it receives and use it in a next handover for the UE.

[0038] Preferably, the method further includes:

[0039] when the UE is located in a small cell, if a MeNB of the UE switches a bearer of the UE on a SeNB to the MeNB or a new SeNB, the S1GW includes a next NH and NCC pair selected in a handover request confirmation message to the MeNB.

[0040] Preferably, after the S1GW sends the next NH and NCC pair to the MeNB, the method further includes:

[0041] the MeNB storing the next NH and NCC pair that it receives for use in a next switch for the UE, and deleting other NH and NCC pairs already exist; or

[0042] the MeNB using the next NH and NCC pair it receives to calculate a KeNB used between the MeNB or new SeNB and the UE, wherein the MeNB or new SeNB uses the KeNB and/or NCC that was calculated.

[0043] Preferably, after the S1GW sends the next NH and NCC pair to the MeNB, the method further includes:

[0044] if the MeNB of the UE switches over the bearer of the UE from the SeNB to a new SeNB, the MeNB sending the next NH and NCC pair that it receives to the new SeNB, wherein the new SeNB uses the NH and NCC pair it receives to calculate a KeNB used between itself and the UE.

[0045] Preferably, when the UE is handed over to be within a jurisdiction of a target S1GW, the MME includes the NH and NCC pair to be used within a target cell and the sequence formed by the multiple NH and NCC pairs in a handover request message or a path switch request confirmation message to be sent to the target S1GW;

[0046] wherein a first NCC value in the multiple NH and NCC pairs and an NCC value used by the target cell are consecutive.

[0047] This invention provides a method for resolving security issues, which can enable part of bearer switch of a UE or the UE switch terminated at S1GW or HeNB GW and reduce impact on the core network and saving system resources.

[0048] As seen in the technical schemes outlined above, in this application, MME will send a sequence including multiple NH and NCC pairs calculated for a UE to S1GW. When S1GW receives a handover message or bearer switch message from a base station for the UE, the S1GW selects a next NH and NCC pair from the sequence received from MME and sends it to the base station. In this way, during the process of UE handover or UE bearer switch, NH and NCC pairs can be issued by S1GW and sent to the base station without requiring participation from the MME entity. Thus, the partial bearer switch of the UE or the UE handover can be terminated at S1GW or HeNB GW, thereby reducing the impact on the core network and saving system resources, ensuring security mechanisms to support a switch terminated at S1GW or HeNB GW.

[0062] In order to more clearly explain the object, techniques, and advantages of the present application, it is described below in detail along with the accompanying drawings.

[0063] FIG. 5 shows a small cell architecture. The base station connects to the core network through S1GW. The S1GW can only have functions on the control plane, or may have functions on both the control plane and the user plane. A base station (eNB) can be a macro base station, a pico base station, or a HeNB. When the base station is HeNB, the S1GW can be HeNB GW defined in the current standard.

[0064] FIG. 6 shows a flow chart of the method of using NH and NCC pairs to resolve security issues in the present invention. As shown in FIG. 6, the method includes the following steps.

[0065] At Step 601, an MME sends a string of (NH, NCC) to S1GW.

[0066] MME can send a string of NH and NCC pairs to S1GW through such as an initial context request message, a UE context modification message, a handover request message, or a path switch request confirmation message, at the time of UE initial access at S1GW.

[0067] Specifically, the number of NH and NCC pairs being sent in the message can be determined by the following methods.

[0068] The MME can know the number of base stations or small cells accessing S1GW based on configuration and determine how many NH and NCC pairs to send.

[0069] Or, S1GW can also send its base station or small cell access number to MME.

[0070] Or, S1GW can first send the number of NH and NCC pairs it needs to MME, and MME can then send the corresponding number of NH and NCC pairs to S1GW according to S1GW s request. Herein, S1GW can send to the S1GW the accessed base station or cell number or the number of NH and NCC pairs needed by S1GW to MME through an initial UE message, a S1 setup request, or a new message.

[0071] At Step 602, when S1GW receives a message related to UE handover or UE bearer switch from a base station, for example, a path switch request, an ERAB switch request, or a handover required, and S1GW needs to send a new NH and NCC pair, the S1GW chooses a next NH and NCC pair from the string of (NH, NCC) pairs it received in step 601, and sends it to a base station. For the UE handover, it is sent to the target base station. For the SeNB change, it is sent to the MeNB.

[0072] For example, S1GW receives from MME 5 NH and NCC pairs to for the UE. The first pair S1GW sends to the base station is the first one among the five pairs. The second time it needs to send a pair, it will send the second pair of the five, and so forth. This ensures that the NH and NCC pairs used at the UE and at the network side are the same.

[0073] Needing further explanation is when the unused NH and NCC pairs among the NH and NCC pairs received from the MME by the S1GW are below a certain threshold, for example, when the NH and NCC pairs received are nearly all used up or there are not enough to use, the S1GW can send a message to the MME requesting new NH and NCC pairs. The MME calculates a new string of NH and NCC pairs and sends them to the S1GW. The MME must save the NH and NCC pairs it sends to the S1GW. In this way, the MME knows which NCC to start from and based on which NH it calculates the next time it makes the calculation.

[0074] The following describes the specific implementation of the method in the present application through detailed embodiments.

[0075] FIG. 7 shows a process of S1GW receiving NH and NCC pairs when resolving security issues according to the first embodiment of the present invention. Here, detailed explanations of steps that do not relate to the present invention have been omitted. The eNB mentioned here could be a macro base station, pico base station, HeNB, etc. If the base station is HeNB, then the S1GW can be HeNB GW. The following is a detailed description of the embodiment, which includes following steps.

[0076] At Step 701, the UE sends a non-access stratum (NAS) message, such as an Attach or a service request, to an eNB.

[0077] At Step 702, the eNB sends an NAS message to the S1GW through an S1AP (S1 Access Protocol) message initial UE message. The S1GW sends the S1AP message initial UE message to the MME.

[0078] At Step 703, alternatively, an authentication/security process is executed. Execution of the security process is the same as in the current technology (refer to TS23.401) and has not been addressed here with a detailed technological description.

[0079] At Step 704, the MME sends an initial context setup request message to S1GW. The message includes a sequence including multiple NH and NCC pairs and a KeNB.

[0080] Herein, as mentioned before, specifically, the number of NH and NCC pairs being sent in the message can be determined by the following methods.

[0081] The MME can know the number of base stations or cells accessing S1GW based on configuration, in order to determine how many NH and NCC pairs to send to S1GW.

[0082] Or, the S1GW can send the number of base stations or cells accessing it to MME. Or, the S1GW can send the number of NH and NCC pairs it needs to MME and MME sends the corresponding number of NH and NCC pairs to S1GW. The S1GW can send the message to MME through an initial UE message, an S1 setup request, or a new message.

[0083] When S1GW needs more NH and NCC pairs, S1GW can also send a request to MME and MME sends the new NH and NCC pairs to S1GW.

[0084] Furthermore, in this step, whether multiple NH and NCC pairs are carried may be decided according to preset conditions. Only when the downstream node is S1GW can MME include multiple NH and NCC pairs in the initial context setup request message. The MME can determine the downstream node as S1GW by the following methods.

[0085] In Method 1, the MME recognizes the downstream node to be S1GW through the operation and maintenance (OAM) configuration.

[0086] In Method 2, the MME can identify different entity types based on the entity identity code of the downstream node (such as an eNB identity, a HeNB identity, or an S1GW identity). For example, the identity of eNB begins with 00, the identity of HeNB begins with 01, and the identity of S1GW starts from 10.

[0087] In Method 3, during the S1 setup process, the MME receives an S1 setup request message including a supported TA list from the downstream node. The S1GW can be made to support specific TA lists. MME can recognize the downstream node as S1GW based on a specific TA list.

[0088] In Method 4, during the S1 setup process, the S1 set up message sent to the MME by the S1GW includes a base station indicator that indicates the downstream node to be S1GW. The indicator can also be used to indicate the downstream node to be HeNB, a macro base station, or a pico base station.

[0089] In Method 5, the initial UE message sent to MME from S1GW includes a base station type indicator that indicates the downstream node to be S1GW. The indicator can also be used to indicate the downstream node to be HeNB, a macro base station, or a pico base station.

[0090] The method by which the MME determines the downstream node to be S1GW can be any of the above-mentioned methods, but is not limited to these methods. Other methods of implementation can be applied without affecting the main contents of the invention.

[0091] At Step 705, the S1GW sends the initial context setup request message to the base station, which includes the KeNB received from the MME.

[0092] At Step 706, the eNB sets up a radio bearer between itself and the UE.

[0093] At Step 707, the eNB sends an initial context setup response message to the S1GW.

[0094] At Step 708, the S1GW sends the initial context setup response message to the MME.

[0095] At this point, the process of this embodiment is concluded. Using the aforementioned process, multiple NH and NCC pairs can be acquired at a S1GW when a UE initial access to the S1GW. The NH and NCC pars can be used in the follow-up for supporting switch terminated at the S1GW for the UE.

[0096] FIG. 8 shows a process of S1GW obtaining NH and NCC pairs when resolving security issues with reference to the second embodiment of the present invention. Here, detailed explanations of steps that do not relate to the present invention have been omitted. The eNB here can be a macro base station, a pico base station, a HeNB, etc. If the base station is HeNB, the S1GW can be HeNB GW. The following is a detailed explanation of the embodiment, which includes:

[0097] At Step 801, a re-authentication process is carried out between the Network and UE.

[0098] At Step 802, an MME sends a UE context modification request message to an S1GW. The message includes a sequence made up of multiple NH and NCC pairs. The message may also include an updated KeNB.

[0099] The MME can determine how many NH and NCC pairs to send to the S1GW based on the base station or cell number accessing the S1GW according to the configuration.

[0100] The MME can also send the corresponding number of NH and NCC pairs to the S1GW because the S1GW sends either the number of base stations or cells accessing it or the number of NH and NCC pairs it needs to the MME. The S1GW can send the information to the MME through an initial UE message or an S1 setup request.

[0101] When the S1GW needs more NH and NCC pairs, the S1GW can also send a request message to the MME, and the MME will send new NH and NCC pairs to the S1GW.

[0102] The MME may only include multiple NH and NCC pairs into an initial context setup request message when the downstream node is the S1GW. The method by which the MME determines the downstream node to be S1GW is identical to that in step 704 and will not be addressed again here.

[0103] The S1GW saves the new NH and NCC pairs it receives and deletes previous NH and NCC pairs.

[0104] At Step 803, the S1GW sends a UE context modification request message to eNB. The message includes a new KeNB.

[0105] At Step 804, an eNB sends a UE context modification response message to the S1GW.

[0106] At Step 805, the S1GW sends a UE modification response message to the MME.

[0107] At this point, the process of this embodiment is concluded. Using the aforementioned process, after updating the key between the network and the UE, the multiple NH and NCC pairs saved in the S1GW can also be updated and used for supporting follow-up switch terminated at the S1GW.

[0108] FIG. 9 shows the third embodiment of the present invention by which the S1GW acquires NH and NCC pairs to resolve security issues. Here, detailed explanations of steps that do not relate to the present invention have been omitted. The eNB here can be a macro base station, pico base station, or HeNB, etc. If the base station is HeNB, then the S1GW can be HeNB GW. In this embodiment, the source eNB (S-eNB) directly connects to the MME, the target eNB (T-eNB) connects to the MME through the S1GW, which is to say the UE connects, through handover, to a base station which accesses the MME through the S1GW. The following is a detailed description of the embodiment, which includes the steps:

[0109] At Step 901, a source eNB sends a handover request message to a target eNB.

[0110] At Step 902, the target eNB sends a handover request confirmation message to the source eNB.

[0111] At Step 903, the source eNB sends a RRC reconfiguration message to the UE.

[0112] At Step 904, the UE sends a RRC reconfiguration complete message to the target eNB.

[0113] At Step 905, the target eNB sends a path switch request message to the S1GW.

[0114] At Step 906, the S1GW sends a path switch request message to the MME.

[0115] At Step 907, the MME sends a bearer modification request message to a SGW/PGW.

[0116] At Step 908, the SGW/PGW sends a bearer modification response message to the MME.

[0117] At Step 909, the MME sends a path switch request confirmation to the target S1GW.

[0118] The message includes a NH and NCC that will be used in the new cell as well as a new string of NH and NCC.

[0119] Specifically, for the synchronized update of NH and NCC in the network and the UE after handover, NH and NCC pair A to be used in the new cell may be included in a path handover request confirmation message. Meanwhile, in order to guarantee that security mechanisms can support the switch terminated at S1GW after the UE switches over to the S1GW, the path switch request confirmation message may also include sequence B including a plurality of NH and NCC pairs corresponding to the UE calculated by the MME. The S1GW uses these NH and NCC pairs when terminating switch. How it is specifically used will be explained in the following embodiments. Herein, NH and NCC pair A and the first NH and NCC pair in sequence B are consecutive so as to ensure that the NCC value in the UE and network side are always maintained consistent.

[0120] At Step 910, the S1GW sends a path switch request confirmation message to the target eNB. The message includes the next NH and NCC pair received from the MME, namely, NH and NCC pair A that will be used by the new cell mentioned above. Requiring further attention is the fact that this is one pair of NH and NCC rather than a sequence of multiple NH and NCC pairs. A sequence of multiple NH and NCC pairs is saved at S1GW and used when switch is terminated at S1GW.

[0121] The target eNB uses the NH and NCC pair in the path switch request confirmation message, the target cell PCI, and the target cell frequency EARFCN-D to calculate the KeNB used between UE and the target eNB. The KeNB is calculated using the current technology, which will not be described in detail here.

[0122] At Step 911, the target eNB sends a resource release message to the source eNB.

[0123] At this point, the process of this embodiment is complete. Through the aforementioned process, multiple NH and NCC pairs can be acquired when the UE, through switch, accesses a base station that connects the MME via the S1GW, and can be used for follow-up switch terminated at the S1GW.

[0124] The three aforementioned processes are all detailed processes by which S1GW acquires multiple NH and NCC pairs. The following is a description of how to use the NH and NCC pairs after multiple NH and NCC pairs are acquired.

[0125] FIG. 10 shows an embodiment of the present invention for resolving security issues by terminating the switch process at S1GW. Herein, the UE carries out S1 handover under the same S1GW. The detailed description of steps that do not pertain to the present invention has been omitted. The eNB here can be a macro base station, pico base station, HeNB, etc. If the base station is HeNB, then the S1GW can be HeNB GW. The following is a detailed description of this embodiment, included of the following steps.

[0126] At Step 1001, a source eNB sends a handover required message to the S1GW.

[0127] At Step 1002, the S1GW decides to terminate the handover process at the S1GW, and sends a handover request message to a target eNB which includes a next NH and NCC pair selected from the saved NH and NCC pairs.

[0128] How it is decided that the handover process should be terminated at S1GW is not the main point of this invention, the detailed description of which has been left out here. In this step, the NH and NCC pair is used to update the KeNB used between the UE and the target eNB.

[0129] At Step 1003, the target eNB uses the NH and NCC pair in the handover request message, the target cell PCI, and the target cell frequency EARFCN-D to calculate the KeNB used between UE and the target eNB. The KeNB is calculated using the current technology and will not be described in detail here. The target eNB associated the received NCC and the KeNB. The target eNB puts the NCC in the NH and NCC pair into the RRC Connection reconfiguration message to the UE and then deletes an older, unusable NH and NCC pair. The target eNB sends the handover request confirmation message to the S1GW.

[0130] At Step 1004, the S1GW sends a handover command message to the source eNB.

[0131] At Step 1005, the source eNB sends an RRC connection reconfiguration message to the UE.

[0132] At Step 1006, the UE sends an RRC connection reconfiguration complete message to the target eNB.

[0133] At Step 1007, the target eNB sends a handover notify message to the S1GW.

[0134] At Step 1008, the S1GW sends a UE context release command message to the source eNB.

[0135] At Step 1009, the source eNB sends a UE context release completion message to the S1GW.

[0136] At this point, the method of the process in this embodiment is complete. In using the aforementioned process, it can be ensured that the security mechanism supports switch termination at S1GW during the S1 handover process because S1GW sends the next NH and NCC pair down to the target eNB rather than requiring participation from the MME.

[0137] FIG. 11 shows the second embodiment of the present invention for resolving security issues by terminating the switch process at S1GW. Herein, UE carries out X2 handover under the same S1GW. Detailed explanations of steps that do not relate to the present invention have been omitted. The eNB mentioned here could be a macro base station, a pico base station, a HeNB, etc. If the base station is HeNB, then the S1GW can be HeNB GW. The following is a detailed description of the embodiment, which includes the steps.

[0138] The processes in steps 1101-1105 and steps 901-905 are the same, which will not be described again here.

[0139] At Step 1106, S1GW sends a path switch request confirmation message to the target eNB. The message includes a next unused NH and NCC pair.

[0140] In steps 1101-1105 mentioned before, the source eNB will send KeNB and NCC to the target eNB which is used between UE and target eNB. The target eNB sends the NCC to the UE. Therefore, in this step, after the target eNB receives the NH and NCC pair, it can save the NH and NCC pair and use it for next handover for the UE, and then delete other saved NH and NCC pairs. Or considering that the source eNB already know the security key eNB between the target eNB and UE, which may bring about a hidden security threat, in this step, after the target eNB receives the NH and NCC pair, it can also update the KeNB according to the NH and NCC pair. That is to say, after this handover is completed, the target eNB initiates the KeNB update process between itself and the UE. The target eNB uses the NH and NCC pair, the target cell PCI, and the target cell frequency EARFCN-D to calculate a new KeNB and uses it to update the KeNB between the target eNB and UE.

[0141] At Step 1107, the target eNB sends a resource release message to the source eNB.

[0142] At this point, the method of the process in this embodiment is complete. In using the aforementioned process, it can be ensured that the security mechanism supports handover termination at S1GW during the X2 handover process because S1GW sends the next NH and NCC pair to the target eNB without requiring participation from the MME.

[0143] FIG. 12 shows the third embodiment of the present invention for resolving security issues by terminating the switch process at S1GW. Herein, UE is located in a small cell, the master eNB of the UE (MeNB) is configured for transmission of control messages for the UE. The secondary eNB (SeNB) is configured for transmission of data of the UE. Naturally, the MeNB can also send data to the UE. SeNB may also send control plane information to the UE. This invention does not limit the function of MeNB and SeNB. Here, detailed explanations of steps that do not relate to the present invention have been omitted. The eNB mentioned here could be a macro base station, pico base station, HeNB, etc. If the base station is HeNB, then the S1GW can be HeNB GW. The following is a detailed description of the embodiment, which includes the steps:

[0144] At Step 1200, the MeNB determines to switch a bearer.

[0145] For example, based on UE measurement results, the SeNB where some bearer of the UE locates can no longer be used, or the SeNB load is too high. The MeNB determines to switch the bearer to new SeNB or MeNB of the UE.

[0146] Herein, if the MeNB decides to switch the bearer to a new SeNB, then step 1201 will be carried out. If MeNB decides to switch the bearer to the MeNB of the UE, then step 1203 will be carried out directly.

[0147] At Step 1201, the MeNB sends a SeNB addition request message to the new SeNB.

[0148] At Step 1202, the new SeNB allocates resources. The new SeNB sends a SeNB addition request acknowledge message to the MeNB.

[0149] At Step 1203, the MeNB reconfigures the UE. The MeNB sends an RRC reconfiguration request message to the UE, and the UE sends an RRC reconfiguration response message to the MeNB.

[0150] At Step 1204, the MeNB sends an ERAB switch request message to the S1GW.

[0151] At Step 1205, the S1GW sends an ERAB switch request confirmation message to the MeNB. The message includes a next unused NH and NCC pair that was from the saved NH and NCC pairs.

[0152] Similar to step 1106 in FIG. 11, after the MeNB receives an NH and NCC pair, the NH and NCC pair received can be saved and used in the next switch of the UE, and then the other saved NH and NCC pairs can be deleted. Or, it can be used to update the KeNB between the MeNB or new SeNB and the UE after completion of this bearer switch.

[0153] Specifically, the method for using the NH and NCC pair for updating the KeNB after this bearer switch can be:

[0154] 1) If the bearer switches to a new SeNB or the MeNB of the UE, then the MeNB can use the NH and NCC pair, the PCI of the target cell, and the frequency EARFCN-D of the target cell to calculate the KeNB used between the new SeNB or MeNB of the UE and the UE. How the KeNB is calculated is an existing technology and a detailed description of the calculation has been omitted from here. The MeNB sends the new KeNB and/or NCC to the new base station (if the new base station is the MeNB, then it does not need to be sent). The new SeNB or the MeNB of the UE associates the NCC and KeNB received. The new SeNB or MeNB of the UE puts the received NCC in the radio resource control RRC message (for example, a RRC reconfiguration message) to be sent to the UE or in a container from the new eNB to the MeNB, and then deletes the old, unusable NH and NCC pair. The RRC message can also be sent to UE by MeNB. The specifics of how an RRC message is sent to UE by MeNB or a new SeNB are not the main point of this invention. The main point in this processing method is that MeNB gets new NH and NCC pairs, calculates a new key used between the UE and the new eNB, and sends the KeNB and/or NCC to the new base station, thereby increasing security.

[0155] 2) If the UE bearer switches from one SeNB to a new SeNB, MeNB can still send the new NH and NCC pair to the new SeNB after receiving it. The new SeNB uses the NH and NCC pair it receives, the PCI of the target cell and the frequency EARFCN-D of the target cell to calculate the KeNB used between the UE and the new SeNB. How the KeNB is calculated is an existing technology and detailed descriptions of the calculation have been omitted from here. The new SeNB associates the received NCC and the KeNB. The new SeNB puts the NCC received in the NH and NCC pair into the UE radio resource control RRC message (for example, an RRC reconfiguration message) or into a container of from the new SeNB to the MeNB, and then deletes the old, unusable NH and NCC pair.

[0156] The new KeNB can also be sent from the new SeNB to the MeNB, and the MeNB sends an RRC message to the UE. The specifics of how an RRC message is sent to UE by MeNB or a new SeNB are not the main point of this invention. The main point in this processing method is that MeNB gets new NH and NCC pairs, sends them to the new SeNB, and the new SeNB calculates the new key used between the new SeNB and UE, thereby increasing security.

[0157] At this point, the process of the method in this embodiment is completed. Using the aforementioned process, while carrying out the SeNB bearer switch process in a small cell, the next NH and NCC pair is sent to the eNB by S1GW without requiring participation from the MME, thereby ensuring that the security mechanism supports the switch terminated at S1GW.

[0158] FIG. 13 is an embodiment of how to safeguard the works of a key chain when a UE moves to another S1GW or macro base station by switching out of the jurisdiction range of a S1GW. The following is a detailed description of the embodiment. Here, some optional processes and steps that do not relate to this invention have been omitted.

[0159] At Step 1301, a source eNB sends a handover required message to a S1GW.

[0160] At Step 1302, the S1GW sends a handover required message to an MME.

[0161] In this step, the message can include a next NH and NCC pair that needs to be used, which may be a next unused NH and NCC pair in the sequence saved in the S1GW. When there is no unused NH and NCC pair, the message can include the next NCC value. Or, the NH and NCC pair currently being used can be included in the message in this step, the new NH can be calculated by the MME itself based on Kasme and the received NH, the specific calculation method of which is the same as that in the current technology. Or, the message in this step can also include all of the unused NH and NCC pairs in the sequence stored at the S1GW. The MME starts using a next unused pair chosen from all of the unused NH and NCC pairs it receives.

[0162] At Step 1303, the MME sends a handover request message to the target S1GW or eNB. The message includes an NH and NCC pair to be used in the new cell.

[0163] Herein, the NH and NCC pair that will be used in the new cell in this step can be received from the source S1GW or calculated by the MME itself.

[0164] If the target base station connects to a new S1GW, the message in this step can also include a new string of NH and NCC pairs that the MME calculated for the UE to be used for follow-up switch of the UE terminated at the new S1GW. The new S1GW uses these NH and NCC pairs when terminate handover procedure. The specific description of usage is the same as in FIG. 6, FIG. 10, FIG. 11, and FIG. 12. Herein, the first NCC value that will be used in the new cell and the first NCC value in the string are consecutive in order to ensure that NH and NCC values of the UE and network side are consistent.

[0165] At Step 1304, if the UE is moved to an eNB under another S1GW, the target S1GW (the another S1GW) sends a handover request message to a target eNB. The message includes the next NH and NCC pair received from the MME. What should be noted is that this is a pair of NH and NCC and not a sequence included of multiple NH and NCC pairs. A sequence including multiple NH and NCC pairs is stored at S1GW and used when switch is terminated at S1GW.

[0166] The target eNB uses the NH and NCC pair in the handover request message, the target cell PCI, and the target cell frequency EARFCN-D to calculate the KeNB used between itself and the UE. The KeNB is calculated using the current technology and will not be described in detail here. The target HeNB correlates the received NCC and the KeNB. The target HeNB puts the NCC from the NH and NCC pair it received into the RRC connection reconfiguration message it sends to the UE, and then deletes the old, unusable NH and NCC pair.

[0167] At Step 1305, the target eNB sends a handover request confirmation message to the target S1GW.

[0168] At Step 1306, the target S1GW or eNB sends a handover request confirmation message to the MME.

[0169] At Step 1307, the MME sends a handover command message to the source S1GW.

[0170] The source S1GW sends a handover command message to the source eNB.

[0171] At Step 1308, the source eNB sends a RRC connection reconfiguration message to the UE.

[0172] At Step 1309, the UE sends a RRC connection reconfiguration complete message to the target eNB. If the UE switches to an eNB under another S1GW, the UE sends a RRC connection reconfiguration complete message to the target eNB. The target eNB sends a handover notify message to the target S1GW.

[0173] At Step 1310, the target eNB or S1GW sends a handover notify message to the MME.

[0174] At Step 1311, the MME sends a UE context release command message to the source S1GW.

[0175] At Step 1312, the source S1GW sends a UE context release command message to the source eNB.

[0176] At Step 1313, the source eNB sends a UE context release completion message to the source S1GW.

[0177] At Step 1314, the source S1GW sends a UE context release completion message to the MME.

[0178] At this point, the method of the process in this embodiment is complete. Using the aforementioned method, it can be ensured that the security mechanism supports the subsequent switch terminated at a target S1GW through the source S1GW notifying the MME of the next NH and NCC pair and through the MME sending to the target S1GW the next NH and NCC pair and a string of NH and NCC pairs used for follow-up switch terminated at the target S1GW when the UE moves out of the jurisdiction area of the source S1GW.

[0179] It can be seen that by the specific implementation of this application, the method for resolving security issues in this application can support switch terminated at S1GW, ensure that participation from an MME is not necessary in the switch process while still bringing about security authentication between UEs and base stations after switch, which reduces impact on the core network as well as saving system resources.

[0180] The preferred embodiments of the present invention described above are not intended to limit the invention. Any changes, equivalent substitutes, improvements, etc., made within the spirit and principles of the present invention, should be included in the scope of protection of the present invention.